Extending LAN through an ISP

[rcasta]

Hello,

My two locations are independetly serviced by the same ISP, but in different cities. Each ISP location houses a server farm. Do you know if there is a way of joining these two server farms as if were in the same LAN? The reason behind this is for making farm server1 the backup of farm server2 and visceversa.

CityA CityB
LAN1 LAN2
farm server1 farm server2
| |
| |
| |
ISP X ISP X

Have I posted this on the right board?

Best regards,

 

[gdschertz]

There are several ways to set up an extended lan. If you are using a router capable of tunneling or vpns you can connect that way. Serveral quiestions to answer are but not exclusive to. What protocals do you need between the lans? Are your computers IBM, Apple, or? Do you use wins or name reselution. How secure do you want the link to be? Is encription reqired, is there sesitive data being transfered? And what is the expected bandwidth used for server to server replication or updating? Can your Internet connection hadle the load?

 

[tschouten]

I'm noticing a trend to design questions in here a lot lately. gdschertz is right though and his set of questions are valid in trying to answer your questions.

 

[rcasta]

Gdschertz, thank you for replying back promptly. You see, still there is not a connecting device between LAN1 and the ISP transmission media. Nevertheless, I will go over your questions as possible:
* Protocol used: IP only
* Computers are of several vendors (mainly IBM, but also a couple of ULTRAs)
* Nop, no WINS/NAME resolution used
* At first, it really doesn't have to be secure since it won't pass through routing, at least I reckon on that, but through Layer 2 path all the way.
* At this point, no encription is required. Maybe on later stages.
* This traffic is mainly Data Base and won't cross the Internet since will be handled by the ISP backbone all the way by its transmission facilities. Expected throughput is roughly 60Mbps.

thank you !

 

[rcasta]

Can anyone follow up the issue posted earlier?

best regards,

 

[gdschertz]

rcasta,
Well first to send data across the ISP you will need to use ip routing. And you will be limmited to the bandwidth provided by your ISP. If your ISP is providing you with 60mbps of internet bandwidth then you have more than a ds3, or T3 at each site. but anyway, I would sugest that you tunnel your data to the remote site. And definaly I would encript it. You will need to set up a tunnel at each site pointing to the Public address provided by your ISP at the other site. With the final destination being your local ip addressing at each end.You should use a authentication process so you know that router 1 is talking to router 2 at the other site. So that it is harder to hijack your data transmission. Do a search on

http://www.cisco.com.

You can find serveral ways to setup what you want.

lan1>r1>tunnel0 > ISP-----ISP< tunel0<r2< lan2

You can set up private addressing for the tunnel interface address, then use the public address of the other site as the destination. add an IP route to the lan at the other end and use the tunnel as the gateway. Mirror the setup on the other end and you will be good to go. A strong wordof caution. In this situation encription and autentication is the only way to protect your data and both of your networks!!!

 

[rcasta]

gdschertz,

Under this scenario kindly provided, LAN1 and LAN2 would be different broadcast domains, wouldn't they? My goal is to provide a broadcast domain path from site 1 to site 2.

As when using LAN bridges for extending the LAN. In this way hosts on site 1 will be part of the same subnet as the ones at site 2. And by using GRE tunneling this way, I think, an ip address on each ethernet interface must be configured, mustn't it?

cheers,

 

[gdschertz]

Yes they would be different broadcast domains. And unless there is no other way to make the connections you want, it should be. How many PCs do you have at each location? You can set the cisco routers to forward broadcasts but that is turned off by default. For the routers to route they have to be sending to a different network. So unless you use nat or somthing simmulare the networks will have to be on different subnets. And yes the ethernet interfaces must have ip addresses, and they must be on a different network from any other interface on the router. If you set up IRB, then you could bridge all the incoming ethernet traffic to your tunnel interface on each end. I haven't tried it but it should work.

 

[rcasta]

I already tried using tunnels along with IRB. Unfortunately, it didn't work as expected. It seems that Cisco still doesn't support this feature on tunnels.

But by using a LAN extender which has an ethernet port as well as a STM-1 interface, it will do. I can notice I did not mention earlier the possibility of connecting this device-namely a RAD from the RIC-155 family-to an ADM (add/drop multiplexer)of the ISP.

best regards,