overlapping subnet mpls and sdwan

[Fullmoon]

Just wondering anyone of you here enabled overlapping subnet on FortiGate interfaces. What are the implications if you enabled this options? I have on going POC which it halted for me for few days already. Customer has 3 WAN links namely DSL, IP Radio and MPLS for Branches and HQ. This is for SDWAN requirement running on FOS 6.0.9 DSL and IP Radio are properly configured on both sites. IPSEC VPN are working fine too from Branch to HQ. Workstations at the branches uses MPLS ip addresses. Now, we need to add MPLS link through our FortiGate unit which we need to introduce new set of subnet for LAN. The existing MPLS ip address will be part of WAN links already. As of now we cant push this design because we need to coordinate with telcos for additional routes needed. Here's the Branch Side propose workaround setup while waiting for the approval for additional routes. WAN1: 10.10.10.2 (DSL) WAN2: 10.10.20.2 (IP Radio) WANx: 192.168.1.1 (MPLS) LAN: 192.168.1.2 Workstations DGW: 192.168.1.1 --->>>The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

Branch Side existing topology Workstations (192.168.1.x)----L2 Switch-------<192.168.1.1>(Router) <----->MPLS any useful suggestion is much appreciated.

[emnoc]

The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

You can't duplicate the same address/subnet on 2 interfaces on fortigate. It would error out. Since this is rfc1918,you should design your subnets correctly, imho

Ken Felix

Ken Felix

[ede_pfau]

This situation really is ...frelled.

Enabling 'overlapping subnets' or 'asymmetrical routing' will effectively disable stateful firewalling, and RPF checks. Without state, there is not much left of a firewall, just a simple packet filter.

IMHO there is no way but to redesign the address space. (Admins should be punished for using 192.168.[0-2].0/24 in a live network...).

What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.

[Fullmoon]

ede_pfau wrote:

What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.

I will look at this Ede, thanks for hint as well.

Do you think this will work?

I will create 2 VDOMs root and LAN_VDOM. All my other WAN links (DSL and IP Radio) including my MPLS link <192.168.1.1> will be assigned in root VDOM and  192.168.1.2 LAN VDOM then I will play with vdom links plus firewall policies. ;)

[emnoc]

Do it right the 1st time in order to not comeback and redo it again. That's a good motto to go by. I would also NOT use  192.168.1.xxx in a production network. It will cropped back up and is one of the most common by-default network used in the rfc1918 address space. Do everything and anything to not use it, is a rule that I follow.

Ken Felix

[ede_pfau]

emnoc is absolutely right. Although, this topic keeps popping up again and again.

[Toshi_Esumi]

By the way, why can't your MPLS provider assign different subnet other than 192.168.1.0/24(?) to a customer MPLS location? They should be able to. Because if it's a multiple location customer, the first location might be 192.168.1.0/24 then 192.168.2, 3, 4.0/24 and so on and on for the other locations. Then they just need to skip .1.0/24 that conflict with your network. You should talk to them as well.

Toshi

[Fullmoon]

You can't duplicate the same address/subnet on 2 interfaces on fortigate. It would error out. Since this is rfc1918,you should design your subnets correctly, imho

Ken Felix

Thank you for the insight Ken. Well of course from my side I insist this would not be perfect design but somehow some IT admin  we're dealing had narrow understanding in regards to this matter as long we delivered what their needs despite of its setbacks. :)