Tag Info

New answers tagged

1

but doing a traceroute from the pfsense machine to an ip in the encryption domain range sends the traffic out over the internet This is a clear indication that you do not have your IPsec Phase 2 entries configured correctly. IPsec matches traffic purely on source/dest IP subnet, and if it's not sending your desired traffic down the tunnel, you have a ...


1

Maybe I'm missing something from your setup but here's what I think is the issue. If the Modem is connected to one of the switch as pictured in your design via an access port, then that modem needs to have routes for all of your VLAN pointing back to your OpenBSD firewall. That would explain why the Modem seems to only "see" the Firewall since it's layer 2 ...


2

If the VLANs are trunked to the other closets, you only need ip routing on the core switch.


1

I don't know the details of the network configuration files of recent Debian releases, but you should achevie what you want following these steps: remove base interface (bond0) IP using the command "ip addr flush dev bond0" or "ifconfig bond0 ip 0.0.0.0" insert an iptables rules that drop any traffic coming from the untagged interface (bond0) using the ...


0

I would presume something like this should work: auto lo iface lo inet loopback auto bond0 iface bond0 inet static pre-up ifconfig bond0 up pre-up ifenslave bond0 eth0 || /bin/true pre-up ifenslave bond0 eth1 || /bin/true down ifenslave -d bond0 eth0 || /bin/true down ifenslave -d bond0 eth1 || /bin/true auto bond0.50 iface ...


0

The problem ended up being an older firewall kept being attached to the network by a different team, several network devices away. So those of you who said "duplicate IP" were correct.


0

This is a very common situation and unfortunately the initial response should not be technical. Inter-Vlan routing is fine if it works for your company. Yes there are possible security and performance issues but do you have the staff to manage the requirements if you lock your systems down? As long as you have designed your network properly you should be ...


0

Generally speaking, even untagged ports need to be assigned a NATIVE VLAN id AND only if this is different from the default id of 1. This is to help the switch understand how to forward packets. If you do not provide a vlan and it is bridged, it's considered a routed interface. You should not generally specify subinterfaces (ie tags) on interfaces unless you ...


1

First let me start out by adding just a bit of info. It looks like you intend all IPs to be private network addresses. The IPs that start with 172 must belong to 172.16.x.x - 172.31.x.x for them to be considered private. Since this is just a packet tracer lab, this doesn't really matter. Some of the commands I am entering might be unnecessary if you don't ...


0

Like this: 10.6.0.0/24 10.6.1.0/24 10.6.2.0/24 10.6.3.0/24 10.6.4.0/24 10.6.5.0/24 10.6.6.0/24 10.6.7.0/24 10.6.8.0/24 10.6.9.0/24 10.6.10.0/24 10.6.11.0/24 10.6.12.0/24 ... 10.6.254.0/24 each /24 can hold 250+ hosts plus gateway address and broadcast address.


0

Ok, I managed to get my hands on a spare RB to try this configuration. It turns out that I haven't read the documentation carefully. It states that you can only access the router itself (as in management access) only from the trunk port. http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features#Management_IP_Configuration Management IP Configuration ...



Top 50 recent answers are included