Connect windows system to two subnets

In the diagram below I need system (A) to communicate with system (B). System (A) must be able to remain connected to the subnet though.
Subnet is the main windows network and houses the connection to the internet. Subnet consists of POS software. System A needs to run a POS application that talks to the POS server (system (B)) while still being able to communicate with the windows server and Internet via the subnet.

The two switches in the subnet are in seperate buildings and are connected via fiber. There are no other physical connections avaliable between building 1 and building 2.

The two switches are Linksys SRW2016 and SRW2048 devices.

I can not add additional NICs to the systems in subnet I can add additional NICs to systems in the subnet however.
Who is Participating?
linrafConnect With a Mentor Commented:
The systems on the left building is the one that needs access to 2 networks, you put the 2 ip addresses in that 1 nic. Only one gateway, the one for the left side building that gets to the internet.  There must be a cable connecting the switches for the 2 networks also for this to work.

Again I advise you to look into pci compliance before connecting the 2 networks in any way.

Generally for pci compliance you need to have your payment network separated from machines that have access to surf the internet. By connecting this machine ( or even connecting the switches) in pretty much anyway, I think you are violating that.
There are a few options.  First, what is device

One option would be to add a second card in WS and assign it an address on the network then uplink the two switches.

Another option would be to put in router to physically connect the two networks and then add a static route on telling it to go to the router to get to  You will also need a static route on for it to get back.

IT101Author Commented:
Thanks for the fast reply GrayMatter!
I did not take down what the router model was. I know it was a cisco appliance and I'm quite sure it did not have an internal modem (not that that would matter). I'm quite sure it then connects to a modem and VPN that would connect
Option 1: Pull me up anywhere that I miss a step:
Do you mean add another NIC to; assign it as address in the subnet
Link the two switches together that are in the second (right hand) building
Does this mean I have two NICs from the system with different subnets both connected to the switch in the left hand buiding?
If I did this how do I make the switches aware to forward the packets destined for  to the other subnet? I thought you needed a level 3 device to do that?
Option2: Is it possible to make say the router by adding another NIC to it and connecting its second NIC to the switch? I have been asked to accomplish this without additional hardware costs.
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

IT101Author Commented:
missed a sentence above in first paragraph:
*VPN that would connect the POS network to their main sites network.
ffleismaSenior Network EngineerCommented:
hi IT101,

Im assuming subnet needs to be at building 2 (building on the right side). you can try connecting the switch on building 2 to the router at instead of cascading it to the switch on building 1. then do a router on a stick on that router. afterwhich cascade the switch and switch on building 2 while doing trunking between them.

hope it helps :-)
You can also go into the Network card adapter setting where you set your ip address, click advanced and you can add a secondary ip address on the second subnet.

This will allow communication, but you do need to examine why you have 2 separate subnets to begin with. If it is for security, a router is the better option so that you can open it only to hte traffic that you want to allow.
ffleismaSenior Network EngineerCommented:
can routers and do VPN? if so you can do a site to site VPN between the two routers.

hope it helps :-)
IT101Author Commented:
Thanks guys...
Subnet is owned by the POS provider and I am not allowed to reprogram their devices (e.g site to site VPN) and they would charge to reconfigure them if the final plan of attack included any changes on their devices/systems.
This is also the reason why they were originally on seperate subnets (prior to the new requests the systems never needed to talk to one another and all subnet systems were provided by the POS provider.
@ ffleisma: I'm not sure I want to go down the road of the first suggestion as it sounds like too large a change to the network topology and I wouldn't feel comfortable completing this in a small time frame. Also would this mean that I would have to buy another router anyway to keep the network behind the firewall?
@linraf: Can you elaborate on the 2 IPs to one card theory (how this works)?
IT101Author Commented:
I have just had an email from the POS provider on the situation and they advised as follows:

The SRW 2048 & SRW 2016 devices should be able to have the config updated on them to allow the network to be routed through it, you will need the to plug the network onto the network.
Has anyone ever done this before?
ffleismaSenior Network EngineerCommented:
i believe SRW2048 is a switch and is not capable of layer routing as per documentation from cisco.
IT101Author Commented:
Yeah so to do what they are saying it would need to be a layer 3 capable switch?
IT101Author Commented:
I just read this taken from a cisco paper on the SRW devices:

Individual users or applications can be prioritized above others using various Class of Service options - by port, layer 2 priority (802.1p), and Layer 3 priority (TOS or DSCP). Intelligent Broadcast, and Multicast storm control minimizes and contain the effect of these types of traffic on regular traffic. IGMP Snooping limits bandwidth-intensive video traffic to only the requestors without flooding to all users.
What does that mean? It definetly is soley a layer 2 device?
IT101Author Commented:
If the SRW's definetley can not do the job (which from everything I have read (and as ffleisma has pointed out) they are only layer 2); I think I would like 1 "dodgey/no hardware cost" solution (e.g make an existing system route the traffic) and one stable solution (e.g buy a router to join the subnets).
Can you advise me on what the best and cheapest router would be for the job?
I have just looked at the cisco 851-K9 router which looks to be the cheapest in the cisco router range but is there anything even cheaper than this that would do the job that I have missed? Maybe a layer 3 switch? I have never worked with a layer 3 switch before.
As for the other solution can anyone give me a few pointers on the steps to setup an XP Pro machine (say SPN-LVL2-SYS01) to act as a router between the two subnets?
POS systems are generally separated due to security concerns and PCI Compiance.
In order to connect the 2 networks you would almost definitely want a router between so that you only open the required ports.

That being said, a network cable between two switches each with separate subnets makes them physically part of the same network.

If you give a machine 2 ip addresses, one from each subnet ( one gateway), it will be able to communicate via ip address to the second subnet.

To do this:
Control panel
Network connections
Right click on the network connection
highlight internet protocol tcp/ip  (version 4, not 6 if both are listed)
Make sure that original set of ip addresses is set
click advanced
add an ip address from the second subnet and the subnet mask
ok, ok close.

ffleismaSenior Network EngineerCommented:
what firewall are you using? can your firewall do routing? im thinking, maybe you could create two vlans ( subnet and subnet) then trunk it all the way to you firewall, no cost incurred just a change in configuration and adding connection between the two switches for and at building 2

hope this helps :-)
IT101Author Commented:
@linraf: I will give this a go in a test environment. Would the system on the left building then need two gateways or something though? The main windows server and this 2NIC'ed system?
@ffleisma: Yeah its an asa5505 but its not licenced to use any more VLANs so I can not use it to route as you have said unfortunatley.
IT101Author Commented:
thanks linraf, this works just as you have said.
I have tried it now in my lab and have advised the POS techs of this possibility. If it does breach any regulations I will simply add a router on the right hand side building.
All I have left to ask now is "how does the 2 IP solution actually work?"...
Would I be close to say this:
When the switches are joined together they work just as they should as layer 2 devices and update their MAC tables to comply with the new MAC addresses on each side for correct forwarding and therefore packets destined for the POS network are forwarded through the switches to the correct PC with the destination MAC address.
When they arrive to the POS Client destination are they decapsulated and the origin IP checked to see if they originated from the correct subnet?
What I am trying to say is; at what point in the OSI does this now pass where before (without the two IPs) it failed? Is it because the packets are now initially tagged with a correct IP origin that is within the destinations subnet that it now works?
Thanks for all the help!
Once you connect the layer 2 switches without a router, it becomes 1 physical layer 2 network. The only thing separating the layer 3 networks is the different ip addresses. As network cards can accept multiple ip addreses, the card with 2 ip addresses is now part of of both layer 3 networks.
IT101Author Commented:
Thanks for the additional explaination linraf. In terms of the structure of the packets... in the layer 3 encapsulation where the origin IP and destination IP are, does it just know to add its IP that is within the destination subnet as the origin?
Thanks again for all your help
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.