# Question about setting up proper routing....



## Jhigg (Jul 31, 2014)

Hello! I am getting two new Edgerouter Pro's tomorrow and need some help with basic setup. Here is the network I'm trying to setup:










My question is on the Point to Point connection that connects to the edgepro routers, how do I route that traffic properly? I've very new to routing and I can't seem to grasp how I would set that up.

Would I have to send the traffic on the point to point over another subnet? So create a 10.10.40.* network and create a static route pointing to either IP address? Or is there a better way to do this? Thank you for any help!

Edit: I did block out the outside IP address information on the top of the firewalls...fyi.


----------



## Wand3r3r (Sep 17, 2010)

Welcome to TSF!

Is this school work? I have to think so since your ip addressing is wrong.

Your diagram is a bit confusing in that you have lines bypassing the firewalls going to each router. What is up with those?

Yes you need a completely different subnet for the point to point connection.

The Comcast routers would have the public ips not your firewalls in that configuration so no need to blank out.


----------



## Jhigg (Jul 31, 2014)

Thanks! Glad to have found this place. 

Unfortunately no this isn't for school work, where is the addressing wrong? I'm fairly new to networking and I'm trying to learn as I go, I've found the best way to learn is to dive in head first.

Sorry about the diagram, I wasn't sure how to make it look how I have it in my mind. Here is what is going on:

There are 2 Ports on the Ciena router. One for our P2P network, which is figuratively a long ethernet cable, no IP addressing needed. The other is for our Internet. My thought is that I would use the router to route and the firewall to protect. So technically the Router is only bypassing the firewall for the P2P network, not the internet. Does that make sense?

Edit: I should mention that I'm going to make this work in a lab before I go live with it. Just trying to sort everything out before the hardware shows and get some clarification.


----------



## Wand3r3r (Sep 17, 2010)

I am going to assume your internet connections are from Comcast and that is why you have Comcast routers.

"One for our P2P network, which is figuratively a long ethernet cable, no IP addressing needed"

You will need to route with these connections and as such you need a unique subnet for the P2P.
You would pass all traffic through the firewalls with no bypass. Otherwise you need the P2P to be between the two edge routers.

You can not route between interfaces if they are in the same subnet. Your lan is at 10.10.50.x for example. You can not use x.x.50.x between the edge router and the firewall. Nor can you use .50 between the firewall and the Comcast router. Each in-between segment must have a unique subnet.

So if lan is at .50
.40 would be between edge and firewall
.30 would be between firewall and router


----------



## Jhigg (Jul 31, 2014)

Yes we have Comcast Metro Ethernet over fiber. (The Ciena router is comcast property and I don't have access to it) The 5505 ASA firewall has an external IP set on the WAN interface. So the .30 network isn't needed. 

Is this drawing more clear?










So I will have to change my Firewall's IP address to make this work? That part I don't quite understand.


----------



## Wand3r3r (Sep 17, 2010)

If the P2P has no ip how are you going to route it separate from the internet to firewall connection?

Guess that is a moot question since you don't have access to those routers. Which in turn makes your configuration invalid. You can have only ONE connection from the Comcast routers to the firewall since both P2P traffic and internet traffic will have to come through one port. 

Why do you think you can have x.x.50.x and x.x.60.x on two interfaces of the edge routers?

Reason why you wouldn't have the P2P going between the two edge routers?
Are you sure Comcast isn't doing the P2P via the internet connections and as such will only have one entry point for both?


----------



## Jhigg (Jul 31, 2014)

So the Comcast Ciena router does have 2 ports on each side for me to use. One is the P2P, one is the internet. The way it is setup in that last picture is technically going from edgerouter to edgerouter. Sorry I know we are having a bit of a hard some getting this across. I do appreciate all the help though and just talking this out has brought to light some issues that I need to resolve.

Why do you think you can have x.x.50.x and x.x.60.x on two interfaces of the edge routers? Honestly I'm not basing this off of anything, in my head I thought it should work out. But since you are telling me it won't I can absolutely change those IPs on the firewall side of the Edgerouters. Is this better? 










Edit: Updated Image


----------



## Wand3r3r (Sep 17, 2010)

Ip addresses looks better. I would not use the same x.x.40.x on both segments. Each should be unique for both documentation and understanding what is where.

You will have to give Comcast the ip information and routing information they need to input in their routers.

It doesn't matter if you have two ports to use in the Comcast routers. The problem is you want the following

Internet on port A
P2P on port B
traffic to firewall on port C
traffic to edge router on port D

You need A to go to C
You need B to go to D

These routes need to be static with no failover /variations or you will get internet traffic bypassing your firewall and that would not make for a good day.


----------



## Jhigg (Jul 31, 2014)

Wand3r3r said:


> Internet on port A
> P2P on port B
> traffic to firewall on port C
> traffic to edge router on port D
> ...


Oh Oh oh!!! I get what you are saying now. Sorry the 2 ports that they provide are MY ethernet ports for my equipment. There is a 3rd cable plugged in, Comcast's Fiber is directly running to this Ciena Router. Sorry I can update that on the sheet, didn't think it would cause a problem. 

As for the P2P I don't think I will need to provide comcast with anything. If I take the ethernet jack that is assigned to the P2P on the Ciena router (Port 1 on either side) and plug it into my switch at site 1, then go to site 2 and plug my laptop into the same port I am able to get DHCP and network access from Site 1's network. So with this information, do I still need to have separate subnets on either side of the P2P ?

P.S. I live in Tigard, what part of Oregon are you in?


----------



## Wand3r3r (Sep 17, 2010)

It does not make any sense you are getting dhcp from site 1 when at site 2. Your edge router normally would not be providing dhcp services on its wan port.

Yes update the drawing.

I am in Eugene


----------

