1

Hi all,

I’ve got an addressing issue that I need to clean up.

One physical network has two segments addressed as:
172.16.48.0/24
172.16.52.0/24

The other physical network has two segments addressed as:
172.16.49.0/24
172.16.53.0/24

Due to certain circumstances and firewall quirks IPsec tunneling from other sites to these networks hasn’t been an issue, but we are changing platforms to a newer, stricter firewalling system and I think it’s going to be a problem.

I can’t conceive of a way to leave the addressing as is and be able to supernet the two networks separately since they overlap.

The number of active servers in the odd number networks is lower so I’m thinking of changing those to:
172.17.49.0/24
172.17.53/0/24

This shouldn’t take too long to implement and then I should be able to address the two networks as:
172.16.0.0/16

and

172.17.0.0/16

As you can probably tell I am not very knowledgeable about subnetting! Does this seem like a sensible approach?

Thanks!

2 Spice ups
2

Seems sensible to me as it provides a much cleaner definition of your IP scopes plus you have room to create more /24’s in either site if required.

1 Spice up
3

The other you can do it is to put each subnet onto its own VLAN but that depends on the type switches that you have.

4

Thanks People, but how would that help me when it comes to identifying the supernet from a remote location for IPsec tunneling?

5

What do you mean? with IPSEC you’d just connect from one site to the other sites router?

6

Hi Gary,

Sorry I was responding to “PeopleT” - the core issue is that in order to set up IPsec tunnels to both of these sites from a 3rd site, I need some way of uniquely identifying the entire network for each. Not sure how VLANing would help in that endeavor…

7

If you absolutely need to have the same subnet numbers, you can do what’s called “Double Vlanning” Most switches support it.

About 3/4 down the page… Also DELL switches support it natively. Just a thought on your situation, not ideal I still recommend resubnetting your network to perhaps a /22 giving yourself future growth.

8

Out of curiosity, what firewall are you using that you cannot specify the LAN subnets and remote subnets for the tunnel? I have personally never ran into a firewall where I couldn’t do that… Beyond that, you shouldn’t have any issues changing the subnet, but here’s a few things you need to ensure you get:

  • Static IP’s on Servers
  • Static IP’s on Printers
  • Static IP’s on switches, routers, firewalls, Access Points, etc
  • Updating DNS on your DHCP scope
  • Also look up the technet articles on giving a Windows DC a new IP, and if you’re using exchange look up the technet on changing the IP on exchange as well
  • On the firewall, make sure you have all of your ACL’s and NAT’s documented, as those will all change
9

Sigkill has the right question of what type of equipment are you using?

When I setup a ipsec tunnel (Cisco or Juniper), I always have to either setup the IPSEC tunnel with the local and remote subnet(s) that I want to allow over the VPN or do routing based VPN where I tell the route to use the vpn tunnel.

10

Yes, luckily we are just dealing with servers here - and roughly 25 of them so not such an awful late Friday night project.

The old firewalls are Juniper SSG; prepping to move to Sophos UTM.

The issue I’ve encountered historically is when setting up a vpn from a 3rd site on a sonicwall for example - I’ve had no way to uniquely identify these two sites when setting up a proxy ID since their subnets overlap.

Juniper doesn’t seem very strict so going juniper to juniper I’ve been able to simply use 0.0.0.0/0 as the proxy ID and it’s worked - that doesn’t seem to fly when going cross-platform…

11

Gary and Sigkill both have it nailed for you here.

If these are separate sites (it’s not really clear) then re-assigning those IP addresses, then backing off your subnet to /16 is a good way to deal with the current situation. Going forward, if you have more sites, include this in the overall plan - a standard for sites, to also include with your standard for internal ranges on each VLAN.

172.16.x.x\16 for site A

172.17.x.x\16 for site B

172.18.x.x\16 for site C

Consider organizing ranges by region, country or continent.

12

Great - will adjust the one physical site to 172.17.x.x so that they can be uniquely addressed as 172.16.x.x/16 and 172.17.x.x/16 as intended in my OP - many thanks to everyone for the confirmation!

13

Thanks again to everyone.

Only hitch in all this is that for some reason we have been unable to get the junipers and Sophos boxes to route happily with each other - since we needed to move forward, we’ve been forced to take the approach of adding static routes to certain servers (just DCs and file servers luckily) as each site is migrated to Sophos. Once we hit critical mass, we’ll make the Sophos boxes in the datacenters “primary” and reverse the routes to cover just the straggling juniper sites until they are all migrated. Bit of a pain but we ran out of time to figure out what was up with the firewall routing.