Skip to main content
Fullmoon
Fullmoon
New Member
February 5, 2020
Question

overlapping subnet mpls and sdwan

  • February 5, 2020
  • 1 reply
  • 6332 views

Just wondering anyone of you here enabled overlapping subnet on FortiGate interfaces. What are the implications if you enabled this options? I have on going POC which it halted for me for few days already. Customer has 3 WAN links namely DSL, IP Radio and MPLS for Branches and HQ. This is for SDWAN requirement running on FOS 6.0.9 DSL and IP Radio are properly configured on both sites. IPSEC VPN are working fine too from Branch to HQ. Workstations at the branches uses MPLS ip addresses. Now, we need to add MPLS link through our FortiGate unit which we need to introduce new set of subnet for LAN. The existing MPLS ip address will be part of WAN links already. As of now we cant push this design because we need to coordinate with telcos for additional routes needed. Here's the Branch Side propose workaround setup while waiting for the approval for additional routes. WAN1: 10.10.10.2 (DSL) WAN2: 10.10.20.2 (IP Radio) WANx: 192.168.1.1 (MPLS) LAN: 192.168.1.2 Workstations DGW: 192.168.1.1 --->>>The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

Branch Side existing topology Workstations (192.168.1.x)----L2 Switch-------<192.168.1.1>(Router) <----->MPLS any useful suggestion is much appreciated.

    1 reply

    emnoc
    emnoc
    New Member
    February 5, 2020

    The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

     

    You can't duplicate the same address/subnet on 2 interfaces on fortigate. It would error out. Since this is rfc1918,you should design your subnets correctly, imho

     

    Ken Felix

     

    Ken Felix

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    February 5, 2020

    This situation really is ...frelled.

    Enabling 'overlapping subnets' or 'asymmetrical routing' will effectively disable stateful firewalling, and RPF checks. Without state, there is not much left of a firewall, just a simple packet filter.

    IMHO there is no way but to redesign the address space. (Admins should be punished for using 192.168.[0-2].0/24 in a live network...).

    What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.

    Fullmoon
    FullmoonAuthor
    New Member
    February 5, 2020

    ede_pfau wrote:

    What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.

    I will look at this Ede, thanks for hint as well.

    Do you think this will work?

    I will create 2 VDOMs root and LAN_VDOM. All my other WAN links (DSL and IP Radio) including my MPLS link <192.168.1.1> will be assigned in root VDOM and  192.168.1.2 LAN VDOM then I will play with vdom links plus firewall policies. ;)

     

    Terms & ConditionsAccessibility statement