Issues routing from VLAN to LAN

[aespinola]

Hi!

I am having some issues with this current network design we have.

Main office: IP: 172.25.65.166/24 GW: 172.25.65.165

IP: 172.25.65.166/24 GW: 172.25.65.165

Data Center:

GW: 172.25.65.93 -----> vlan200 172.25.65.94/30 (port1)

The internal LAN on the FortiGate on the DC is 172.16.101.0/24

The FortiGate is in NAT mode.

I set the 172.25.65.0/24 in a static route so it gets out from the port1 using the GW of the DC.

I set the policy to allow the port1 traffic to be able to talk to the LAN with without NAT.

I see that the LAN and the VLAN200 show as connected routes on the Fortigate.

This should the traffic that I am trying to get

Office -----> DC GW -----> Fortigate VLAN 200 --------> Server on the LAN

I can reach my FortiGate on the DC but I can't reach any of the machines that are on the LAN even after I set the policy to allow traffic. Am I doing something wrong or missing something like a route?

Help is much appreciated

Thanks!

[EMES]

It looks like you are on the same subnet with all those machines.

IP: 172.25.65.166/24 GW: 172.25.65.165

the /24 tells me you are using a 255.255.255.0 which means 172.25.65.1-254 are usable.

172.25.65.93 and 172.25.65.94 are on the same subnet as your main office.

How are the two offices connected? Using MPLS, Layer2, or IPsec tunnel?

[aespinola]

Yes, that is correct. I was told by the ISP that they (office and DC) are connected through Layer2 on a separate VLAN, in this case, is the VLAN that is on the port1 of the Fortigate on the DC.

[rwpatterson]

Ditto on what EMES said. You should set both sides to /25 subnets if you are married to the scheme 172.16.25.x. One side would be 172.16.25.0/25 (usable from 1-126, 127 broadcast) and the other side would be 172.16.25.128/25 (usable from 129-254, 255 broadcast). These would be perfectly acceptable and routeable addressing schemes. What you have now needs to be spanned and it won't work across a routed domain.

[aespinola]

@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.

[rwpatterson]

aespinola wrote:

@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.

172.16.25.29/30? That is merely a transit route in the same subnet as the other two. (Only usable IP addresses are 172.16.25.29 and .30) Why are you trying to use the same subnet scheme over and over? These are private subnets. You literally have thousands to choose from. Open your network, man! Change one side to 172.16.26.0/24 and watch the traffic start flowing.

[aespinola]

rwpatterson wrote:

aespinola wrote:

@rwpatterson, thanks for answering. Could this bad subnetting be the cause of me not being able to reach the lan? On the routing table on my DC I see 172.16.25.29/30 as a connected route. Would it work if I change my /24 of my office to a /30 too?. Again, thanks for replying.

172.16.25.29/30? That is merely a transit route in the same subnet as the other two. (Only usable IP addresses are 172.16.25.29 and .30) Why are you trying to use the same subnet scheme over and over? These are private subnets. You literally have thousands to choose from. Open your network, man! Change one side to 172.16.26.0/24 and watch the traffic start flowing.

I understand what you mean, the subnets were not chosen by me though, they were given to me by the ISP. They told me to use this subnet here and use this one there. If it was for me I would totally go the way you are saying.

I called them about the /24 I was having in the office and they told me it was a mistake and to change it to /30. Now I have /30 on both sides. Gonna check tomorrow if that solves something.

[rwpatterson]

Your ISP sucks. Their only redemption would be if they wanted you to use 172.16.25.29/30 on one side of the VPN link and 172.16.25.30/30 on the other in between the two boxes. If this is a rented span and not going over the Internet, then this would work. You would have to change the IP subnet on both LANs to be two other unique subnets as well for all that to work.