PepVPN bridge across same topology networks

jaegermeister · March 9, 2019, 7:43am

Hello everybody,

an office of a customer of mine currently runs well over Balance 30, but has decided to move the production servers to a farm, task for which I have borrowed a Balance 20 to first try the config.

Essentially the idea is perfectly bridging the two local historical networks:
192.168.1/24 (notag)
192.168.70/24 (vlan70)
which run under a L3 switch whose uplink is a Balance 30 on 192.168.255/24 (notag) network, thanks to static routes, with the same topology networks under the Balance 20. Here follows a graphical explanation.

In order to try this I first configured a normal PepVPN between the two Balance devices, but it reported a “route conflict” (a sign that local static routes on Balance 30 are working well).

When I instead tried (both with and without STP) to establish a direct L2 PepVPN using the main LAN network of each Balance device like in this example How to Configure Layer 2 SpeedFusion VPN , the connection could not be established, always reporting a “Starting…” status.

Does anybody have valuable clues to get me out of this dead end? The presence of a “bridge” functionality should allow for the same network to exist on both sides (e.g. 192.168.1/24) or am I assuming something wrong?

Also: does PepVPN just need UDP 4500 port to operate or more?

Thanks in advance,
Pasha

MartinLangmaid · April 28, 2019, 1:11pm

L2 PepVPN bridging is between VLANs, and since prior to fw8 you can only have a single PepVPN tunnel between peers so you can bridge either the untagged network at both locations or the vlan70 segment but you can’t do both.

One way to bypass this limitation would be to setup a site to site L2 PepVPN link between the untagged LANs on both Balance routers, then use another L3 device like a managed switch or another router at each location to be responsible for routing the two VLANs. The Balance routers become a virtual ethernet cable between the locations that you can then build two VLANs over.

FW 8.0 is advertised as supporting simultaneous L3 and L2 PepVPNs between peers - but you can still only support a single VLAN @ L2 but maybe you would be able to change the topology a little to cope with that limitation. If not then you’ll need to move the ownership of the VLANs away from the Peplink to a managed switch.

Ports 32015 for handshake and 4500 for data.