Hot!overlapping subnet mpls and sdwan

Author
Fullmoon
Platinum Member
  • Total Posts : 875
  • Scores: 13
  • Reward points: 0
  • Joined: 2010/08/02 18:02:10
  • Status: offline
2020/02/04 16:50:26 (permalink)
0

overlapping subnet mpls and sdwan

Just wondering anyone of you here enabled overlapping subnet on FortiGate interfaces. What are the implications if you enabled this options?
I have on going POC which it halted for me for few days already. Customer has 3 WAN links namely DSL, IP Radio and MPLS for Branches and HQ. This is for SDWAN requirement running on FOS 6.0.9
DSL and IP Radio are properly configured on both sites. IPSEC VPN are working fine too from Branch to HQ. Workstations at the branches uses MPLS ip addresses. Now, we need to add MPLS link through our FortiGate unit which we need to introduce new set of subnet for LAN. The existing MPLS ip address will be part of WAN links already. As of now we cant push this design because we need to coordinate with telcos for additional routes needed.
Here's the Branch Side propose workaround setup while waiting for the approval for additional routes.
WAN1: 10.10.10.2 (DSL)
WAN2: 10.10.20.2 (IP Radio)
WANx: 192.168.1.1 (MPLS)
LAN: 192.168.1.2
Workstations DGW: 192.168.1.1
--->>>The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

Branch Side existing topology
Workstations (192.168.1.x)----L2 Switch-------<192.168.1.1>(Router) <----->MPLS

any useful suggestion is much appreciated.

Fortigate Newbie
#1

7 Replies Related Threads

    emnoc
    Expert Member
    • Total Posts : 5508
    • Scores: 355
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/04 19:48:00 (permalink)
    0

    The question now would be, what would be effect if LAN and WANx are on the same network address provided that overlapping subnet was enabled? What would be the behavior of the packets when passing the Fortigate? Do it may affect the flow of the traffic from Branch to HQ?

     
    You can't duplicate the same address/subnet on 2 interfaces on fortigate. It would error out. Since this is rfc1918,you should design your subnets correctly, imho
     
    Ken Felix
     
    Ken Felix

    PCNSE 
    NSE 
    StrongSwan  
    #2
    ede_pfau
    Expert Member
    • Total Posts : 6184
    • Scores: 510
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 00:39:07 (permalink)
    0
    This situation really is ...frelled.
    Enabling 'overlapping subnets' or 'asymmetrical routing' will effectively disable stateful firewalling, and RPF checks. Without state, there is not much left of a firewall, just a simple packet filter.
    IMHO there is no way but to redesign the address space. (Admins should be punished for using 192.168.[0-2].0/24 in a live network...).
    What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #3
    Fullmoon
    Platinum Member
    • Total Posts : 875
    • Scores: 13
    • Reward points: 0
    • Joined: 2010/08/02 18:02:10
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 06:06:16 (permalink)
    0

    You can't duplicate the same address/subnet on 2 interfaces on fortigate. It would error out. Since this is rfc1918,you should design your subnets correctly, imho
    Ken Felix



    Thank you for the insight Ken. Well of course from my side I insist this would not be perfect design but somehow some IT admin  we're dealing had narrow understanding in regards to this matter as long we delivered what their needs despite of its setbacks. :)
     

    Fortigate Newbie
    #4
    Fullmoon
    Platinum Member
    • Total Posts : 875
    • Scores: 13
    • Reward points: 0
    • Joined: 2010/08/02 18:02:10
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 06:16:44 (permalink)
    0
    ede_pfau
    What if you create a VDOM for the WAN side, and use the remaining root VDOM for the LAN side? Maybe you could then NAT all traffic across the inter-VDOM link and thus avoid the address conflicts. Just a thought.



    I will look at this Ede, thanks for hint as well.
    Do you think this will work?
    I will create 2 VDOMs root and LAN_VDOM. All my other WAN links (DSL and IP Radio) including my MPLS link <192.168.1.1> will be assigned in root VDOM and  192.168.1.2 LAN VDOM then I will play with vdom links plus firewall policies. ;-)
     

    Fortigate Newbie
    #5
    emnoc
    Expert Member
    • Total Posts : 5508
    • Scores: 355
    • Reward points: 0
    • Joined: 2008/03/20 13:30:33
    • Location: AUSTIN TX AREA
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 06:58:37 (permalink)
    0
    Do it right the 1st time in order to not comeback and redo it again. That's a good motto to go by. I would also NOT use  192.168.1.xxx in a production network. It will cropped back up and is one of the most common by-default network used in the rfc1918 address space. Do everything and anything to not use it, is a rule that I follow.
     
    Ken Felix

    PCNSE 
    NSE 
    StrongSwan  
    #6
    ede_pfau
    Expert Member
    • Total Posts : 6184
    • Scores: 510
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 08:37:27 (permalink)
    0
    emnoc is absolutely right. Although, this topic keeps popping up again and again.

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #7
    Toshi Esumi
    Expert Member
    • Total Posts : 1928
    • Scores: 168
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: overlapping subnet mpls and sdwan 2020/02/05 09:06:13 (permalink)
    0
    By the way, why can't your MPLS provider assign different subnet other than 192.168.1.0/24(?) to a customer MPLS location? They should be able to. Because if it's a multiple location customer, the first location might be 192.168.1.0/24 then 192.168.2, 3, 4.0/24 and so on and on for the other locations. Then they just need to skip .1.0/24 that conflict with your network. You should talk to them as well.
     
    Toshi
    #8
    Jump to:
    © 2020 APG vNext Commercial Version 5.5