Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

Bit confused over how to handle a likely simple routing issue.

I VPN into my Cisco ASA on 10.1.x.x subnet. Now, I would like to not only interact with private 10.1.x.x, but also with dmz on 172.16.x.x.

In a TAC session Cisco rep confirmed that traffic is allowed for my VPN user on both subnets; he said the issue is that while traffic is flowing from 10.1.x.x to 172.16.x.x just fine, traffic is not passing back from 172 to 10; therefore a routing issue on the target server.

On a Linux system (CentOS), how would one add a route so that traffic initiated from say, 10.1.50.1 to 172.16.50.1 (the default gw and primary server nic) can flow back and forth?

While I like experimenting I'd prefer not to butcher the route and have customers complain that their websites are not loading ;-)

Example setup: eth0 is 172.16.50.1 and has gateway of 172.16.1.1 with mask 255.255.0.0 eth1 is 10.1.50.1 with mask 255.255.0.0 VPN user IP is in the 10.1 subnet, e.g. 10.1.200.1

Thanks for pointers!

share|improve this question
Ideally, you'd tell your core routers that the 10.1.x.x network is located on the Cisco ASA - and things should work itself out by itself. – Kvisle Oct 26 '11 at 18:07
There are no separate physical routers, just the ASA and servers (there's a switch involved, but that's on unrelated 192.168.x.x subnet that the ASA knows nothing about). Basically when 10.1 talks to 172.16, then 172.16 should talk back to 10.1 and not itself. – virtualeyes Oct 26 '11 at 19:10
The primary gateway is the router I'm talking about – Kvisle Oct 26 '11 at 19:14
How is it supposed to work? For traffic to flow from one subnet to another, some device must have an IP in both subnets and route traffic between them. What device spans the two subnets? (If none, it can't possibly work.) – David Schwartz Oct 26 '11 at 19:59
actually it does work, see my answer. VPN user can "see" both subnets, but the lack of a return route on the server was causing traffic to flow back out through the dmz (default gw) rather than to vpn user on 10.1 subnet. – virtualeyes Oct 26 '11 at 20:52

1 Answer

up vote 2 down vote

The question was how to route to a different subnet on Linux. I explained in detail the situation, general replies without specifics were given.

I hacked it out on a dev server:

route add -net 10.1.200.0 (VPN ip pool) netmask 255.255.255.0 gw 172.16.1.1

and then applied to production. Works a charm and, to boot, conserves a host that would have otherwise counted against ASA base license limit of 10 hosts -- i.e. when ssh'ing into 10.1.50.1 host count increased by 1 since VPN user is considered "outside" the ASA, but when ssh'ing into the same machine on 172.16.50.1, host count remains the same since this interface has already consumed a host by virtue of its constant in/out traffic with outside world.

share|improve this answer
1  
Remember that this route will be forgotten on shutdown, refer to the Red hat manual on setting a permanent route. (CentOS is very very similar to red hat) – Silverfire Oct 27 '11 at 3:55
you could try setting a default route by using "route add default gw 172.16.1.1" or something – Silverfire Oct 27 '11 at 3:56
@silverfire, yes, I know, added to /etc/init.d/rc.local init script, the route will remain in place (but good to point out for benefit of others, +1) – virtualeyes Oct 27 '11 at 8:01
@silverfire, "route add default gw 172.16.1.1" is the default gw, eth0 is on dmz 172.16.x.x subnet and therefore any other nic in the system will use 172.16 as its default gw (unless you add a new route to say traffic originating from other-subnet to default-subnet, should go back out on other-subnet and not on default subnet) – virtualeyes Oct 27 '11 at 8:04
Depending on the setup sometimes its just easier to give all the traffic from a server to one router or if possible, install RIPv2 or OSPF or something on the server. Really need more info to make a call. – Silverfire Oct 28 '11 at 3:37
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.