Mpls vpn bounding and internet traffic


#1

Hello
I have a very simple trouble but with balance it seems to be impossible to solve. Some time ago I have installed two Balance 380 appliance for mpls bounding. I have two sites, one HQ and one remote. This sites are connected with two different mpls and I use balance for vpn bounding. Here is my network diagram:


It is work perfectly and initially the remote site use a proxy for whole internet traffic on the hq site.
Now they need to unplug the proxy and I cannot understand how to send the remote site traffic directly to the internet. At last I need a default route but it is impossible to create it in the LAN menu item. I have solved (i think), in my lab environment, by modifying LAN interface in drop-in with WAN3, adding default gateway and connected WAN3 on the same switch of LAN. I’m not convinced that it is the right way. My modified network diagram:


Is there a way to add a default route on the HQ balance appliance ? I use 380 models with 5.4.1 version of firmware.
Any suggestions ?

Thank you much…


#2

Ummm… looks like we could leverage outbound policy for this. Have a look here and see if it helps?


#3

Yes, sure. But it doesn’t solve my problem.

I have also tried, in place of bridge, an ipforward solution with WAN3 and LAN in the same ip class. In my lab it work very well but on the production side not. The only difference is that in production I have a L3 switch (default gw for my 192.168.1.0/24 network) and in lab only the firewall.

Any ideas ?


#4

OK I see what you are trying to do now. One possible solution is to set your HQ Peplink LAN port to 0.0.0.0 with gateway pointing to 192.168.1.252. This way Internet traffic coming from 192.168.2.0/24 through SpeedFusion should be sent off to 192.168.1.252.

A couple of questions - are we using HQ Peplink as DHCP server for your HQ LAN? Could you please breakdown what we have on HQ LAN for us? We want to make sure this won’t affect other machines on your HQ LAN network.


#5

Sorry for delay in my response but I will away from office. I have tried you suggestion. It doesn’t work. On the NETMASK field I cannot set 0.0.0.0 and I cannot leave that field blank. Maybe this kind of settings must be send to Peplink wish list ?

I’m still trying and searching for solution…


#6

Any netmask from the list will do just fine (yes we will want to add a 0.0.0.0 netmask to the list in future firmware).

A LAN static route like this


Should route all traffic from 192.168.2.0/24 coming through SpeedFusion to 192.168.1.252.

Are we using HQ Peplink as DHCP server for 192.168.1.0/24?


#7

Any netmask from the list will do just fine is not true. I have some C class networks on both side. Consider that the hugest mask that I can select is a /1. So with 0.0.0.0/1 I can reach at last half of expected /0 or any mask…

Is my opinion that “static router” have some limits and that the Peplink maybe can develop a function for gateway of the last resort for lan segment or something like that.

Now i have make work it by assigning tha same ip address on the WAN3 and the LAN and have configured WAN3 in forward mode. At last I have configured connected switch for manage those type of topology.

Thank you much Kurt.


#8

The Balance is a multi-WAN router with multiple WAN default gateways. Outbound traffic for LAN clients is controlled with outbound policy rules.

A LAN default route of 0.0.0.0 is for SpeedFusion peers, and the subnet mask field will be 0.0.0.0 regardless of the setting when a 0.0.0.0 LAN static route is added. Although it is only for reference, we will want to add the 0.0.0.0 subnet mask selection in future firmware.

This feature was added to 5.4 firmware so that SpeedFusion peers could go through a content filtering device on the HQ side.

I hope this helps to answer your questions.


#9

Hi,

We have the same problem: we need to create a static route on the interface 0.0.0.0 mask 0.0.0.0 lan switch pointing to the network core.

We also have two sites connected with two MPLS … What solution is there?