Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

pfSense short config summary:

WAN interface is on a registered Internet block of addresses 
    connected to ISP via fibre
LAN interface has IP address 10.200.1.3/24
OPT1 interface has IP address 192.168.184.1/24 

A separate wireless network exists on 172.16.0.0/12 subnet, via an HP MSM760 wireless controller.

Problem summary: I cannot route from the wireless subnet 172.16 to the LAN subnet 10.200.1

Configuration
-------------

172.16.0.0/12 network
HP ProCurve VSC wireless subnet
          |
          |
(traffic from 172.16 intercepted by HP MSM760 and egress to 
 interface with IP 192.168.184.2)
          |
          |
     192.168.184.2  (external interface on MSM760 controller)
          |
          |
          |
          |
     192.168.184.1  (OPT1 interface on pfSense server)



On pfSense the following gateway is set as:

Name: BYOD,  Interface: OPT1,  Gateway: 192.168.184.2

... and the following route is set as:

Network: 172.16.0.0/12,  Gateway: BYOD - 192.168.184.2,  Interface: OPT1

Diagnostics: A host in the 172.16 network has the address 172.16.0.4 and it has no firewall, so it can respond to PING

I can ping 172.16.0.4 from the OPT1 interface in pfSense' Diagnostics/Ping page but I cannot ping that address from the WAN or LAN interface in pfSense.

Is there anything obvious from the above description that would explain why I cannot see the 10.200.1 net from the 172.16 net?

Here is a screenshot of the VSC config on the MSM760. The 172.16.0.0 network is defined by the DHCP server config at the bottom of the shot.

This is the VSC config on the MSM760

And these are relevant pages from pfSense. As you can see there is a route to the 172.16.0.0/12 network via gateway 192.168.184.2 (which is an IP interface connected to VLAN #9 on the MSM760)

This is the pfSense config

At the end you can see a diagnostic Ping from the pfSense to a host on the 172.16 network.

And just to clarify what the VSC Egress Mapping is going to:

MSM760 BYOD interface enter image description here

share|improve this question
    
Did you verify the MSM760 controller config? Perhaps it doesn't know how to route out of its subnet? Or perhaps its an ACL issue? –  MysticRyuujin Mar 20 '14 at 5:12
    
To be honest, I'm not 100% sure how the VSC Egress traffic interception works - it seems to be some 'black box' trickery on the MSM760's part. Would it help if I posted a link to some screenshots of the VSC config? –  ChrisNZ Mar 20 '14 at 5:47
    
Sorry, I can't add comments. So what is the default gateway of the wireless clients? –  MysticRyuujin Mar 20 '14 at 6:18
    
I've added some screenshots. The wireless clients gateway (as defined in the VSC) is 172.16.02, and this appears to be intercepted (as per the VSC egress mapping) and routed out to the VLAN BYOD interface which has an IP address of 192.168.184.2 –  ChrisNZ Mar 20 '14 at 23:04

1 Answer 1

I would put up a sniffer between the pfsense OPT interface and the MSM760 just to see what the packets look like and if they're even making it onto that line.

You'd want to see if:

1. Your pings TO the 172.16 network from LAN and WAN are even exiting the OPT interface and

2. Packets FROM the 172.16 network destined to the LAN are making it passed the MSM760 to the pfsense.

Either one of those two isn't happening OR there's something wrong with ARP. I'm still confused about what 172.16.0.2 is? What device is their default gateway? If the MSM760 is intercepting it and putting it onto the OPT1 connection, is it re-writing the packet so that it's new destination is the OPT1 interface IP or is it just dumping it onto the wire?

share|improve this answer

protected by Community Mar 21 '14 at 9:03

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.