topic Re: Presenting multiple ISP circuits on 1 VS - vRouter? VSLS issue.. in Firewall and Security Management

Presenting multiple ISP circuits on 1 VS - vRouter? VSLS issue..

JackPrendergast — Thu, 08 Oct 2020 08:49:42 GMT

Hi all,

Debating over a design snag I have.

The customer has multiple ISP subnets (around 4/5) all presented via the same circuit and tagged with the same VLAN.

I appreciate multiple subnets to 1 VLAN is bad design but thats out of scope for us right now.

I need to present these circuits ideally to 1 VS.

For inbound traffic, there is the possibility I could use proxy arp:

vSwitch attached to the bond, tagged with the said VLAN above with a wrp link to the VS
wrp link on VS has an IP in 1 of the 4/5 subnets above
Proxy ARP all the rest of the subnets to the IP assigned above...

But then you face the issue with outbound traffic and NAT'ing internal servers behind IP addresses that dont exist on the OS i.e there is no route.

vRouters seem like it could solve the issue. Multiple IP's attached to the router and a default route on the VS pointing to the vRouter.

Cluster is currently running VSLS however so that rules out vRouters for now - however cluster could be converted to HA if the vRouters would work effectively.

Any design ideas for you guys?

All ideas appreciated. Thank you

Re: Presenting multiple ISP circuits on 1 VS - vRouter? VSLS issue..

JackPrendergast — Tue, 13 Oct 2020 15:12:12 GMT

Just bumping this thread - I presumed there wouldn't be many solutions to this so will close this thread in a few days if no responses.

Re: Presenting multiple ISP circuits on 1 VS - vRouter? VSLS issue..

Wolfgang — Tue, 13 Oct 2020 19:24:03 GMT

@JackPrendergast

Why not using one of the external subnets as connection to the provider and then let the provider route all traffic for the other subnets to your IP of the VS (no need of a vswitch)

I‘m wondering if you really get all subnets with the same VLAN ID from your provider? This way you have to have one IP of every subnet on your gateway and another IP from the same subnet on the providers router.

With my description you get all external subnets on your gateway and you can do NAT incoming our outgoing without problems. Normally This should be no problem for your provider to set the needed routes.

Wolfgang

Re: Presenting multiple ISP circuits on 1 VS - vRouter? VSLS issue..

JackPrendergast — Mon, 23 Nov 2020 20:23:49 GMT

Hi Wolfgang.

Apologies on the late late reply to this.

In hindsight you are absolutely correct. The customer I was supporting didnt want to engage with their ISP, so it was up to us to work out a solution.

In best practise world, your answer would be much better. In the end, we ended up running another connection between the VSX and the switch!