[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 815
  • Last Modified:

Topology for two gateways and MPLS in a single LAN

Hi Experts,
We are about to move on to deploy MPLS (with SIP, internet). The MPLS will co-exist with the currently-existing Verizon internet T1 which will be disconnected while the 3 year contract expires next year. I'm very confused about how the two gateways are going to co-exist. Please help me figure if this topology is going to work.
As you can see on the attached file, there will be two gateways -- each from different ISP. Each firewall will be the gateway and handle NAT.
In this case, in order to make the two gateways available to all computers inside the LAN, should I connect Switch-1 and Switch-2? Does it make sense? If not, then how to have pc-A connect to the MPLS?

Stone-MPLS-with-Verizon-T1.JPG
0
Castlewood
Asked:
Castlewood
  • 2
  • 2
1 Solution
 
ShareefHuddleCommented:
Yes connect switches and in your Asa add routes to your 2610 for mpls subnets.
0
 
pwindellCommented:
With a single-subnet LAN you should have done this below.  It requires creating an additonal Internal LAN Segment (example 10.10.10.x and 10.10.11.x).  The MPLS Router would have the LAN Interface set to run on the second IP Segment.



Simple-Single-Subnet-LAN-with-se.jpg
0
 
CastlewoodAuthor Commented:
pwindell:
Thank you for the idea. But Cisco1841 has two ports -- port0/1 for SIP & Internet should be connected to Firewall while port 0/0 for MPLS should be to the LAN switch. All traffice to MPLS will be routed to my branch office site . Then what is your Second Internal Segment for?

With your idea, I come out with the following modified diagram. I kind of feel something not very right as the 10.10.10.2 become meaningless. And 10.10.11.x doesn't seem right either. Can you help?
Thanks bunch.
Stone-MPLS-with-Verizon-T1-2.jpg
0
 
pwindellCommented:
You have to keep the routing Symmetrical.

You can have separate lines on the outside of the 1841,...but not on the inside.  The PBX runs on the LAN the same way as everything else,...the "type" of traffic comming from it is irrelevant.  The traffic types won't be on separate lines untill after they leave to 1841 out into the MPLS Cloud.  You cannot have the line you show as "MPLS 10.10.10.3" in that above diagram,...the 1841 would have 3 lines,...2 T1'a on ther serial side and 1 on the Ethernet side going to the side of the ASA

You have a single subnet LAN,...therefore you can't have multple routing devices sitting on it at the same "level" unless you are going to go around and maintain individual Routing Tables on every individual Host,...that's what Asymmetrical routing causes (among other problems).

Therefore what you need is a single routing device (the ASA) on the LAN and any subsequent routing devices branching off of that one outbound downstream (the 1841).  This allows the single LAN routing device to make all the primary routing decisions.   That's symentrical routing.

The additonal secondary internal segment could just be a /30bit Point-to-Point between the ASA and the 1841,...or you can run it as a /24 segment and use it as a normal LAN segment for future growth.  Note,..that from the ASA's perspecitic that addtional LAN segment is not a DMZ,..it is just an additioanal trusted internal LAN segment.
0
 
CastlewoodAuthor Commented:
It should be PIX515E instead of 2610 in my diagram.
We ended up use two firewalls in this project to keep in only one subnet 10.10.10.0.
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now