Routing question 3

[arell12]

We have about 10 offices and each office has dual network connections. 1 is a private line (T1) that connects all offices and the other is a High Speed internet connection. Each office will use its own High speed connection for internet traffic and the private line for all inter office communications. We also have a Citrix Branch Repeater in most offices to compress and utilize WAN bandwidth.

I have attached a picture of how it is setup now but I think that it is causing an issue with the reporting on the Branch repeater because I think that all internet traffic is crossing the BR twice.

Any ideas on how I could move the Firewall so that traffic is not going over the BR twice?

 

[primeaum]

couldn't you put it on the second FE port on the 2821? you would give it a different address but that shouldn't matter...

 

[arell12]

I tried that, and when I give the FE0/1 an address of 172.16.132.20 I get an error saying it overlaps with the other interface. Do I need to change the addressing of the LAN IP of the firewall?

 

[primeaum]

you would need to change the fe0/1 to something like 192.168.0.1 255.255.255.252 and make the firewall IP 192.168.0.2 255.255.255.252
how is routing setup? you need to change the default gateway on the router to reflect the new address on the firewall.

 

[arell12]

I was hoping to not have to change the IP addresses of the Firewalls, but it looks like I might have to. We use BGP on the MPLS to generate routing tables and the gateway of last resort is the firewalls so that the internet traffic goes through them.

 

[primeaum]

yeah, I think you have to...I'm definitely not as good as some guys around here though so there may be another way to do it that I'm missing.

 

[unclerico]

you have four options:
1) do as primeaum says and use the other fe interface on the 2821
2) use the firewall as the gateway with some static routes pointing to the 2821 for private network access
3) replace the lan switch in your diagram with a multilayer switch and use that as the gateway. you'll obviously need to re-address some devices
4) use the Citrix appliance in routed mode instead of bridge mode (i'm assuming it has that capability). again you'll need to re-address some devices.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[primeaum]

unclerico, thanks for the additional reply. I'm a firm believer that there is always more than one way to do things and your reply helps me learn as well!