Balance 380 ~ Two Sub-nests & Network Configs

Product Discussion Peplink Balance
1

Hello,

I have been racking my brain around a current networking project that I need to complete in the next few weeks while meeting the objectives below:

  1. Connect two different sub-nets (192.168.30.0/24 & 192.168.63.0/24) together at one of my locations to my Balance 380.
  2. Create an IPsec tunnel to a remote site for the 192.168.63.0/24 network to utilize. (I know this can be done with an Outbound policy, setting one for the path to utilize the IPsec tunnel).
  3. Isolate the IPsec tunnel from my network, only allowing access to the 192.168.63.0/24 network. The remote network already utilizes multiple sub-nets that I have currently deployed (and cannot change) and do not wish to grant additional access to my LANs.
  4. I would like my sub-nets to have the ability to access the 63 network and vice-versa, but the IPsec tunnel traffic can only access the 63 network.
  5. Any proposed network equipment for building B preferably needs to take native DC power (either 12V, 24V, 48V), the MAX-BR1-T is my current plan if a router is needed (cost effective), as there is already an extensive DC power system with battery backup in place.

I have attached two PDFs, one is the current physical network. The second (Thought1.pdf) is my current thought for network layout, but not sure on the configurations needed to best accomplish this project. Thanks for any input the community may have.

~WFF

2

Hello,

The network capture provided is a little confusing. If you could confirm the below network diagram as the basic setup for this proposed network.

1390×423 4.78 KB

Yes this is possible,

You will need to do the following in response to your numerical list above

  1. create a VLAN or Static Route to add a secondary network
  2. establish a VPN tunnel (would recommend pepvpn over ipsec)
    2a) enabling expert mode to define pepvpn routes (if using pepvpn, which is recommended)
  3. Create a inbound firewall rule for this.
    3a) Default Rule = Deny All. Create a inbound rule to allow access to the 192.168.63.0 network
  4. No configuration needed as this is already being done in step 3
  5. MAX-BR1-T will work but for only $100 bucks more you can upgrade to the LTE model.
3

Jarid,

Not quite. Here a bit more clarification. I am using PepVPN to connect my Field Offices to the main office. The other agency and vendor that we would be connecting the 192.168.63…0/24 network only supports IPsec. I am trying to get the to deploy a PepVPN capable router to easier connect our two sites, but don;t see that being a feasible option currently.

Visio-Balance380_30x_63x_Networks.pdf (30.2 KB)

~WFF

4

Hello,

If it is just a wireless bridge (not going over the internet?, is this just a repeater connecting building a to building b?) Then you would not need to create a VPN. You would just need to create a static route in the B380…I.E:
Network: 192.168.63.0 Subnet Mask: 255.255.255.0 Default Gateway: 192.168.30.2

Once created this will allow the B380 to see the 192.168.63.0 network and will be able to control it by firewall rules/outbound policies.

5

Hello Jarid,

Question, with the static route you listed above, you had set the gateway to 192.168.30.2.

A) Does this infer that I need a router in building B with an assigned WAN ip of 192.168.30.2?

B) Or is the ip of 192.168.30.2 just used (internally) to route data between sub-nets so equipment with 192.168.63.0/24 address can be on the same physical LAN and communicate?

~WFF

6

Hello,

A, Correct. If the proposed network diagram had a BR1 it’s WAN IP would need to be 192.168.30.2 (Or there current router if there is one).

7

Jarid, do I even need a router to bridge the two sub-nets, or will the static route surfice?

8

Hi,

Below is the design:-

192.168.63.0/24 –> BR1/Others router –> 192.168.30.0/24 –> Balance 380 –> Remote Office via PepVPN/Internet

You just need to perform actions below:-

  • Configure BR1 WAN interface as IP Forwarding (if you are using BR1). Dashboard > Click “Details” of WAN > Click “?” of Routing Mode > Click “here” > Select IP Forwarding.

  • Add static route at B380. Network > LAN > Static Route Settings > Enter parameter below:-
    Destination Network: 192.168.63.0
    Subnet Mask: 255.255.255.0 (/24)
    Gateway: 192.168.30.2

9

Hello,

TK’s last reply is the full setup process if using a BR1. Technically no you would not need a router in office B, a static route would suffice.

10

How would that static route be configured then if there wasn’t a router in building B?

~WFF

11

Typically, you would still need a layer 3 device. I.E. a switch or something that is adding this second network, in this case a switch or another layer 3 device will get a 192.168.30.x address from the main Balance (which will be the default gateway in the static route) and would NAT to 192.168.63.x address (network address in the static route settings).

Or if using VLANs you would just need a switch in building B that is capable of VLAN Tagging, as this would work as well. It ultimately depends on what equipment you currently have available in that building on which route to go or what device(s) you are planning on adding.

12

Jarid,

Thanks for the info. As far as hardware goes at this point in time, I could go either way, a managed switch (that support VLAN tagging) or I could implement a router. I’m just trying to figure out the best hardware combination to accomplish the objective.

~WFF

~WFF

13

WFF,

Sounds good. As always, should you have any additional questions/inquiries along the way, don’t hesitate to ask.

14

Hi,

Based on your diagram (PDF) you need to have VLAN enabled switches:

  1. Create the two VLANs on both switches
  2. Tagged the ports where the wireless bridge terminates on both sites
  3. Create VLANS on LAN on Peplink and from there make your IPsec.

Thanks,

Charris Lappas