VPN Failover Backup

[John McDonnell]

Hello everyone. I want to apologize in advance as I hate bringing up
something that I'm sure has been discussed many times already and the length
of this e-mail is rather long.

I've found a few examples, but they were dealing with older versions of
pfSense and in the pfSense docs, I found something like I wanted to do, but
it had a notice that it doesn't work with the 2.0 branch. I would play
around with it and see if I could figure it out, but this is a really busy
time at work right now (I'm actually at home right now typing this as I
don't have much spare time at work until a few weeks after the new school
year starts) and I would like to find out if this is possible before trying
to convince my boss to go this route. I brought this idea up about a year or
so ago, but was shut down. I'm hoping this time, if I have more information
available, and possibly set up a pair or so of working boxes, we'll go
through with the idea. Especially since our phone system is now all tied
together with VOIP between buildings.

Anyway, here's the background info on our setup. We're a K-12 school
district and we have 5 buildings. 2 of our buildings are next to each other
and connected via fiber. Then between our main DMARC and the other 3
buildings, we have 100meg wireless bridges. Last year, Comcast provided us
with free broadband that we use as a backup. Currently, it's set up as a
manual backup in that we can manually plug a computer into the Comcast
network if needed. What I want to do is configure a couple of pfSense boxes
at each of the 3 remote locations to connect via VPN to the a pfSense box in
the building that is connected via fiber. (Not the main DMARC, most likely
look into plugging that Comcast connection into the main Cisco router for
main network failover.) The Comcast is not static addressing if that makes a
difference. I do have dynamic addresses set up for these Comcast boxes
though, which I think is all that I need for OpenVPN.

Preferably, what I want to do is keep the setup working the same as it is
now, with the addition of a VPN failover. I believe that our core L3
switches are performing basic routing which I think will make this easier. I
can provide relevant info (and am going to verify this is indeed what is
going on later) from the switches if needed, but I think they are basically
routing anything outside of the 10.x range that the individual buildings are
using to the main DMARC which then has routes to the other buildings and
sends everything else over the main internet connection. If this is what is
going on, it should be fairly easy to insert a pfSense box between the core
switch and the wireless bridge and Comcast CSU/DSU.

Now comes the question on the VPN failover setup. I basically will need to
pass all traffic over the VPN when the main link is down, including VLAN
information. Is this possible? I will also need to prioritize the VOIP VLAN
over all other traffic. I'm also curious if it is possible to detect if one
of the other links went down and switch to failover if it has. Our one
building bounces through another building on the wireless bridge, so when
the in-between building goes down, it knocks out both buildings, even if the
link between those buildings is still up. So if possible, I'd like to detect
when that connection goes down and switch from using the wireless link
between buildings (except possibly any traffic that needs to go between
those two buildings) and use the failover VPN to get better performance
instead of all going through one Comcast connection.

I think I explained everything in a semi-understandable manner, if anything
needs explained further in order to explain what I'm trying to do, I can
clarify or possibly include a diagram (I should still have the original
Visio diagram I made to present to my boss last year saved somewhere) to
show things better. (I'm not sure if this list scrubs attachments or not.)

I don't need anyone to come and set this up for me, though that may be an
option in the future if we decide to upgrade to some appliances instead of
using old spare PC's and want a support contract to go with them, but just
some clarification on if what I want to do is possible and some pointers on
where to look to figure out how to configure. Though, I'll gladly also
accept any specific configuration examples as well. As I said, I don't have
much spare time at work, though I might work on setting up the boxes in my
spare time at home.

Thanks in advance for any help you can provide.
--
John McDonnell
gorgarath-***@public.gmane.org



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-***@public.gmane.org
For additional commands, e-mail: support-help-***@public.gmane.org

Commercial support available - https://portal.pfsense.org

[David Miller]

If I'm following what you're saying you don't really have a redundant VPN
issue. You need to setup routing that deals with link failures. pfSense
supports OSPF which should be able to do what you need. Basically the VPN
is just another route with a lower priority to the other buildings.

http://en.wikipedia.org/wiki/Open_Shortest_Path_First

--
David

Post by John McDonnell
Hello everyone. I want to apologize in advance as I hate bringing up
something that I'm sure has been discussed many times already and the length
of this e-mail is rather long.
I've found a few examples, but they were dealing with older versions of
pfSense and in the pfSense docs, I found something like I wanted to do, but
it had a notice that it doesn't work with the 2.0 branch. I would play
around with it and see if I could figure it out, but this is a really busy
time at work right now (I'm actually at home right now typing this as I
don't have much spare time at work until a few weeks after the new school
year starts) and I would like to find out if this is possible before trying
to convince my boss to go this route. I brought this idea up about a year or
so ago, but was shut down. I'm hoping this time, if I have more information
available, and possibly set up a pair or so of working boxes, we'll go
through with the idea. Especially since our phone system is now all tied
together with VOIP between buildings.
Anyway, here's the background info on our setup. We're a K-12 school
district and we have 5 buildings. 2 of our buildings are next to each other
and connected via fiber. Then between our main DMARC and the other 3
buildings, we have 100meg wireless bridges. Last year, Comcast provided us
with free broadband that we use as a backup. Currently, it's set up as a
manual backup in that we can manually plug a computer into the Comcast
network if needed. What I want to do is configure a couple of pfSense boxes
at each of the 3 remote locations to connect via VPN to the a pfSense box in
the building that is connected via fiber. (Not the main DMARC, most likely
look into plugging that Comcast connection into the main Cisco router for
main network failover.) The Comcast is not static addressing if that makes a
difference. I do have dynamic addresses set up for these Comcast boxes
though, which I think is all that I need for OpenVPN.
Preferably, what I want to do is keep the setup working the same as it is
now, with the addition of a VPN failover. I believe that our core L3
switches are performing basic routing which I think will make this easier. I
can provide relevant info (and am going to verify this is indeed what is
going on later) from the switches if needed, but I think they are basically
routing anything outside of the 10.x range that the individual buildings are
using to the main DMARC which then has routes to the other buildings and
sends everything else over the main internet connection. If this is what is
going on, it should be fairly easy to insert a pfSense box between the core
switch and the wireless bridge and Comcast CSU/DSU.
Now comes the question on the VPN failover setup. I basically will need to
pass all traffic over the VPN when the main link is down, including VLAN
information. Is this possible? I will also need to prioritize the VOIP VLAN
over all other traffic. I'm also curious if it is possible to detect if one
of the other links went down and switch to failover if it has. Our one
building bounces through another building on the wireless bridge, so when
the in-between building goes down, it knocks out both buildings, even if the
link between those buildings is still up. So if possible, I'd like to detect
when that connection goes down and switch from using the wireless link
between buildings (except possibly any traffic that needs to go between
those two buildings) and use the failover VPN to get better performance
instead of all going through one Comcast connection.
I think I explained everything in a semi-understandable manner, if anything
needs explained further in order to explain what I'm trying to do, I can
clarify or possibly include a diagram (I should still have the original
Visio diagram I made to present to my boss last year saved somewhere) to
show things better. (I'm not sure if this list scrubs attachments or not.)
I don't need anyone to come and set this up for me, though that may be an
option in the future if we decide to upgrade to some appliances instead of
using old spare PC's and want a support contract to go with them, but just
some clarification on if what I want to do is possible and some pointers on
where to look to figure out how to configure. Though, I'll gladly also
accept any specific configuration examples as well. As I said, I don't have
much spare time at work, though I might work on setting up the boxes in my
spare time at home.
Thanks in advance for any help you can provide.
--
John McDonnell
---------------------------------------------------------------------
Commercial support available - https://portal.pfsense.org

[John Mcdonnell]

That's mostly what I figured, but I thought I had seen on docs saying that what I wanted to do wasn't supported in version 2.0. The only real question I have is on how to configure the following scenario, which I sort of described earlier:

Building A is the main building with the DMARC.
Building B is one of our remote buildings.
Building C is another remote building.

Building B is wirelessly connected "directly" to building A. (It actually bounces off another tower in between, but that is all in the provider's setup.)
Building C is wirelessly connected to building A through building B. (Building B has 2 radio transmitters, one pointed to the provider, the other to building C.)

Now, if the wireless link between A and B goes down it would cause building B to switch over to the Comcast VPN backup. However, most of the time, it is something between buildings B and A that goes out and building C stays connected to building B over the wireless link. Is it possible to detect when the link between buildings A and B goes out so that I can switch building C over to the VPN backup so as to balance the traffic on building B's VPN backup?

Now that I typed this, I think this is what you were referring to with using OSPF. Could you please give me some peace of mind that this would work? And would the VPN allow the VOIP traffic to be prioritized over all other traffic? For some reason in my head I have it stuck that I need to pass VLAN tags over the link, but I'm pretty certain that I do not, correct? This is basically inserting a router in the line instead of being bridged. Will this, by default, disable my ability to ping (among other things) between buildings unless I add rules to allow it? I'm thinking it does, but want to make sure so that I'm not wasting time adding unnecessary rules, making the rules more complex and therefor harder to maintain.

Sorry for being a bother, but just trying to get my head around it while also doing 20 other things. I'm pretty certain that I can get my boss to go for this setup this time around if I have all the facts in front of me. An automatic backup network connection between buildings would have been nice before, but now that our phone system is connected between buildings via VOIP, though there is a sort of backup in that we still have a line at each building so that they can still call out when the network is down, I think it is a bit more important to have something like this working so that full phone functionality is available.

Be a lot easier to do this in a couple weeks after the crunch to get everything done before the start of the school year and the first couple weeks of the new year with the surge of help desk tickets. Trying to get what I can in my spare time in advance though.

 
--
John McDonnell

________________________________
Sent: Thursday, August 11, 2011 9:47 PM
Subject: Re: [pfSense Support] VPN Failover Backup
If I'm following what you're saying you don't really have a redundant VPN issue.  You need to setup routing that deals with link failures.  pfSense supports OSPF which should be able to do what you need.  Basically the VPN is just another route with a lower priority to the other buildings.
http://en.wikipedia.org/wiki/Open_Shortest_Path_First
--
David
Hello everyone. I want to apologize in advance as I hate bringing up

Post by John McDonnell
something that I'm sure has been discussed many times already and the length
of this e-mail is rather long.
I've found a few examples, but they were dealing with older versions of
pfSense and in the pfSense docs, I found something like I wanted to do, but
it had a notice that it doesn't work with the 2.0 branch. I would play
around with it and see if I could figure it out, but this is a really busy
time at work right now (I'm actually at home right now typing this as I
don't have much spare time at work until a few weeks after the new school
year starts) and I would like to find out if this is possible before trying
to convince my boss to go this route. I brought this idea up about a year or
so ago, but was shut down. I'm hoping this time, if I have more information
available, and possibly set up a pair or so of working boxes, we'll go
through with the idea. Especially since our phone system is now all tied
together with VOIP between buildings.
Anyway, here's the background info on our setup. We're a K-12 school
district and we have 5 buildings. 2 of our buildings are next to each other
and connected via fiber. Then between our main DMARC and the other 3
buildings, we have 100meg wireless bridges. Last year, Comcast provided us
with free broadband that we use as a backup. Currently, it's set up as a
manual backup in that we can manually plug a computer into the Comcast
network if needed. What I want to do is configure a couple of pfSense boxes
at each of the 3 remote locations to connect via VPN to the a pfSense box in
the building that is connected via fiber. (Not the main DMARC, most likely
look into plugging that Comcast connection into the main Cisco router for
main network failover.) The Comcast is not static addressing if that makes a
difference. I do have dynamic addresses set up for these Comcast boxes
though, which I think is all that I need for OpenVPN.
Preferably, what I want to do is keep the setup working the same as it is
now, with the addition of a VPN failover. I believe that our core L3
switches are performing basic routing which I think will make this easier. I
can provide relevant info (and am going to verify this is indeed what is
going on later) from the switches if needed, but I think they are basically
routing anything outside of the 10.x range that the individual buildings are
using to the main DMARC which then has routes to the other buildings and
sends everything else over the main internet connection. If this is what is
going on, it should be fairly easy to insert a pfSense box between the core
switch and the wireless bridge and Comcast CSU/DSU.
Now comes the question on the VPN failover setup. I basically will need to
pass all traffic over the VPN when the main link is down, including VLAN
information. Is this possible? I will also need to prioritize the VOIP VLAN
over all other traffic. I'm also curious if it is possible to detect if one
of the other links went down and switch to failover if it has. Our one
building bounces through another building on the wireless bridge, so when
the in-between building goes down, it knocks out both buildings, even if the
link between those buildings is still up. So if possible, I'd like to detect
when that connection goes down and switch from using the wireless link
between buildings (except possibly any traffic that needs to go between
those two buildings) and use the failover VPN to get better performance
instead of all going through one Comcast connection.
I think I explained everything in a semi-understandable manner, if anything
needs explained further in order to explain what I'm trying to do, I can
clarify or possibly include a diagram (I should still have the original
Visio diagram I made to present to my boss last year saved somewhere) to
show things better. (I'm not sure if this list scrubs attachments or not.)
I don't need anyone to come and set this up for me, though that may be an
option in the future if we decide to upgrade to some appliances instead of
using old spare PC's and want a support contract to go with them, but just
some clarification on if what I want to do is possible and some pointers on
where to look to figure out how to configure. Though, I'll gladly also
accept any specific configuration examples as well. As I said, I don't have
much spare time at work, though I might work on setting up the boxes in my
spare time at home.
Thanks in advance for any help you can provide.
--
John McDonnell
---------------------------------------------------------------------
Commercial support available - https://portal.pfsense.org

[David Miller]

I may have spoken too quickly last time as what I said made a lot, probably
too may, assumptions about your network. So lets start over and say as with
most networking things "it depends". You've mentioned that the wireless
links are bridges but you also said that you believe that the switches are
layer 3 and may be used for routing. So the first thing you need to figure
out is if the traffic is being passed between buildings are just forwarded
between buildings using layer 2 mechanisms or is the traffic being routed by
a router, which may be a layer 3 switch in your case.

So if you're dealing with a network that's routing traffic between the
buildings then my original reply stands. You should look at moving to a
dynamic routing solution such as OSPF. But based on some of your other
questions it sounds like this may not be the case.

If you're network isn't currently routing traffic between buildings then
this problem gets to be a bit more complex. Especially if you need to
preserve the broadcast domain of your network. This isn't something that I
have any experience with so maybe someone else on the list could give you
some advice for this. Here are my thoughts on this though. You may be able
to get this to work using GRE tunnels or some other network trickery. But
you'll also need to figure out how to get it to work with a layer 2
multi-path solution. Such as link aggregation or STP. I'm
not convinced that either will work over such a link.

As for your dealing with QoS to work with VoIP goes. I don't see why you
wouldn't be able to do that but I don't know a lot about the QoS stuff in
pfSense other than it does support it so in theory you should be able to
prioritize the traffic as you need though pfSense.

Your question about VLANs is what tips me off that you're not routing
currently. But it's my understanding that a router will strip off the vlan
tags. So you would need to route traffic from one VLAN on network A to the
appropriate VLAN on network B where the frame will be tagged again.

Sorry I don't have any more concrete answers but I hope this information
helps.
--
David

Post by John Mcdonnell
That's mostly what I figured, but I thought I had seen on docs saying that
what I wanted to do wasn't supported in version 2.0. The only real question
I have is on how to configure the following scenario, which I sort of
Building A is the main building with the DMARC.
Building B is one of our remote buildings.
Building C is another remote building.
Building B is wirelessly connected "directly" to building A. (It actually
bounces off another tower in between, but that is all in the provider's
setup.)
Building C is wirelessly connected to building A through building B.
(Building B has 2 radio transmitters, one pointed to the provider, the other
to building C.)
Now, if the wireless link between A and B goes down it would cause building
B to switch over to the Comcast VPN backup. However, most of the time, it
is something between buildings B and A that goes out and building C stays
connected to building B over the wireless link. Is it possible to detect
when the link between buildings A and B goes out so that I can switch
building C over to the VPN backup so as to balance the traffic on building
B's VPN backup?
Now that I typed this, I think this is what you were referring to with
using OSPF. Could you please give me some peace of mind that this would
work? And would the VPN allow the VOIP traffic to be prioritized over all
other traffic? For some reason in my head I have it stuck that I need to
pass VLAN tags over the link, but I'm pretty certain that I do not,
correct? This is basically inserting a router in the line instead of being
bridged. Will this, by default, disable my ability to ping (among other
things) between buildings unless I add rules to allow it? I'm thinking it
does, but want to make sure so that I'm not wasting time adding
unnecessary rules, making the rules more complex and therefor harder to
maintain.
Sorry for being a bother, but just trying to get my head around it while
also doing 20 other things. I'm pretty certain that I can get my boss to go
for this setup this time around if I have all the facts in front of me. An
automatic backup network connection between buildings would have been nice
before, but now that our phone system is connected between buildings via
VOIP, though there is a sort of backup in that we still have a line at each
building so that they can still call out when the network is down, I think
it is a bit more important to have something like this working so that full
phone functionality is available.
Be a lot easier to do this in a couple weeks after the crunch to get
everything done before the start of the school year and the first couple
weeks of the new year with the surge of help desk tickets. Trying to get
what I can in my spare time in advance though.
--
John McDonnell
------------------------------
*Sent:* Thursday, August 11, 2011 9:47 PM
*Subject:* Re: [pfSense Support] VPN Failover Backup
If I'm following what you're saying you don't really have a redundant VPNissue. You need to setup routing that deals with link failures. pfSense
supports OSPF which should be able to do what you need. Basically the VPNis just another route with a lower priority to the other buildings.
http://en.wikipedia.org/wiki/Open_Shortest_Path_First
--
David
Hello everyone. I want to apologize in advance as I hate bringing up
something that I'm sure has been discussed many times already and the length
of this e-mail is rather long.
I've found a few examples, but they were dealing with older versions of
pfSense and in the pfSense docs, I found something like I wanted to do, but
it had a notice that it doesn't work with the 2.0 branch. I would play
around with it and see if I could figure it out, but this is a really busy
time at work right now (I'm actually at home right now typing this as I
don't have much spare time at work until a few weeks after the new school
year starts) and I would like to find out if this is possible before trying
to convince my boss to go this route. I brought this idea up about a year or
so ago, but was shut down. I'm hoping this time, if I have more information
available, and possibly set up a pair or so of working boxes, we'll go
through with the idea. Especially since our phone system is now all tied
together with VOIP between buildings.
Anyway, here's the background info on our setup. We're a K-12 school
district and we have 5 buildings. 2 of our buildings are next to each other
and connected via fiber. Then between our main DMARC and the other 3
buildings, we have 100meg wireless bridges. Last year, Comcast provided us
with free broadband that we use as a backup. Currently, it's set up as a
manual backup in that we can manually plug a computer into the Comcast
network if needed. What I want to do is configure a couple of pfSense boxes
at each of the 3 remote locations to connect via VPN to the a pfSense box in
the building that is connected via fiber. (Not the main DMARC, most likely
look into plugging that Comcast connection into the main Cisco router for
main network failover.) The Comcast is not static addressing if that makes a
difference. I do have dynamic addresses set up for these Comcast boxes
though, which I think is all that I need for OpenVPN.
Preferably, what I want to do is keep the setup working the same as it is
now, with the addition of a VPN failover. I believe that our core L3
switches are performing basic routing which I think will make this easier. I
can provide relevant info (and am going to verify this is indeed what is
going on later) from the switches if needed, but I think they are basically
routing anything outside of the 10.x range that the individual buildings are
using to the main DMARC which then has routes to the other buildings and
sends everything else over the main internet connection. If this is what is
going on, it should be fairly easy to insert a pfSense box between the core
switch and the wireless bridge and Comcast CSU/DSU.
Now comes the question on the VPN failover setup. I basically will need to
pass all traffic over the VPN when the main link is down, including VLAN
information. Is this possible? I will also need to prioritize the VOIP VLAN
over all other traffic. I'm also curious if it is possible to detect if one
of the other links went down and switch to failover if it has. Our one
building bounces through another building on the wireless bridge, so when
the in-between building goes down, it knocks out both buildings, even if the
link between those buildings is still up. So if possible, I'd like to detect
when that connection goes down and switch from using the wireless link
between buildings (except possibly any traffic that needs to go between
those two buildings) and use the failover VPN to get better performance
instead of all going through one Comcast connection.
I think I explained everything in a semi-understandable manner, if anything
needs explained further in order to explain what I'm trying to do, I can
clarify or possibly include a diagram (I should still have the original
Visio diagram I made to present to my boss last year saved somewhere) to
show things better. (I'm not sure if this list scrubs attachments or not.)
I don't need anyone to come and set this up for me, though that may be an
option in the future if we decide to upgrade to some appliances instead of
using old spare PC's and want a support contract to go with them, but just
some clarification on if what I want to do is possible and some pointers on
where to look to figure out how to configure. Though, I'll gladly also
accept any specific configuration examples as well. As I said, I don't have
much spare time at work, though I might work on setting up the boxes in my
spare time at home.
Thanks in advance for any help you can provide.
--
John McDonnell
---------------------------------------------------------------------
Commercial support available - https://portal.pfsense.org

[Chris Buechler]

Post by David Miller
I may have spoken too quickly last time as what I said made a lot, probably
too may, assumptions about your network.  So lets start over and say as with
most networking things "it depends".  You've mentioned that the wireless
links are bridges but you also said that you believe that the switches are
layer 3 and may be used for routing.  So the first thing you need to figure
out is if the traffic is being passed between buildings are just forwarded
between buildings using layer 2 mechanisms or is the traffic being routed by
a router, which may be a layer 3 switch in your case.
So if you're dealing with a network that's routing traffic between the
buildings then my original reply stands.

Yeah that's the usual scenario for multiple buildings, you have one or
several IP subnets per building, with everything routed between. Then
accomplishing failover with a VPN and OSPF is pretty straight forward.
If it's all one big or several big broadcast domains across buildings,
that's not the best design and makes failover to VPN difficult to
impossible to accomplish regardless of what network equipment you're
using. Aside from other reasons you generally want to keep broadcast
domains limited to one physical location in such networks, like
isolating layer 2 problems to a single building, limiting broadcast
traffic, etc. May need a pretty considerable change to make VPN
failover reasonable if everything is bridged together.

This sounds like the kind of scenario where you could benefit greatly
from a few hours of our time to go over your entire network design and
implement an appropriate solution. We have numerous customers in
similar scenarios, responsible for a thousand different things with
minimal time to work on such projects, and we can make your life a lot
easier in that regard and save you a bunch of time. Also an in-depth
network review is generally beyond what you'll be able to get thorough
assistance with on a mailing list as it's time consuming (and probably
more than you want to publicly divulge). See commercial support link
in the footer for info.

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-***@public.gmane.org
For additional commands, e-mail: support-help-***@public.gmane.org

Commercial support available - https://portal.pfsense.org

[Seth Mos]

Hi,

Post by Chris Buechler
This sounds like the kind of scenario where you could benefit greatly
from a few hours of our time to go over your entire network design and
implement an appropriate solution. We have numerous customers in
similar scenarios, responsible for a thousand different things with
minimal time to work on such projects, and we can make your life a lot
easier in that regard and save you a bunch of time. Also an in-depth
network review is generally beyond what you'll be able to get thorough
assistance with on a mailing list as it's time consuming (and probably
more than you want to publicly divulge). See commercial support link
in the footer for info.

I second that. Also, purchase "Designing Large Scale Networks" from
O'reilly from your favourite book store.

I can recommend it highly to figure out what direction you want to
venture in, I've found it to be a great help.

It handles L2 switching, aggregation and redundancy as well as all the
routing solutions. Since then I've implemented routing at work. pfSense
being the internal VLAN router. I'm using Dell R310 servers as the
firewalls.

Regards,

Seth

---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-***@public.gmane.org
For additional commands, e-mail: support-help-***@public.gmane.org

Commercial support available - https://portal.pfsense.org

[John McDonnell]

-----Original Message-----
From: Seth Mos
Sent: Monday, August 15, 2011 2:38 AM
Subject: Re: [pfSense Support] VPN Failover Backup
Hi,
I second that. Also, purchase "Designing Large Scale Networks" from

O'reilly

from your favourite book store.
I can recommend it highly to figure out what direction you want to venture
in, I've found it to be a great help.
It handles L2 switching, aggregation and redundancy as well as all the

routing

solutions. Since then I've implemented routing at work. pfSense being the
internal VLAN router. I'm using Dell R310 servers as the firewalls.
Regards,
Seth

Thanks for the suggestion, I'll have to add that to the list of books I'd
like to pick up.

From: Chris Buechler
Yeah that's the usual scenario for multiple buildings, you have one or

several

IP subnets per building, with everything routed between. Then
accomplishing failover with a VPN and OSPF is pretty straight forward.
If it's all one big or several big broadcast domains across buildings,

that's not

the best design and makes failover to VPN difficult to impossible to
accomplish regardless of what network equipment you're using. Aside from
other reasons you generally want to keep broadcast domains limited to one
physical location in such networks, like isolating layer 2 problems to a

single

building, limiting broadcast traffic, etc. May need a pretty considerable
change to make VPN failover reasonable if everything is bridged together.

I just logged into one of our switches to verify that we do have routes
defined on the switches. While the wireless links are bridges, we do routing
to keep spurious traffic from crossing the WAN links. I remember this now
from when we first switched to the wireless links a couple years ago and
retired the T1 lines. One of our concerns at first was if it was a bridge,
did we have to redo all of the VLAN settings at each building since we would
have multiple VLAN 1's, 2's, etc. But we saved ourselves from that by doing
L3 routing on the core switches.

This sounds like the kind of scenario where you could benefit greatly from

a

few hours of our time to go over your entire network design and implement
an appropriate solution. We have numerous customers in similar scenarios,
responsible for a thousand different things with minimal time to work on
such projects, and we can make your life a lot easier in that regard and

save

you a bunch of time. Also an in-depth network review is generally beyond
what you'll be able to get thorough assistance with on a mailing list as

it's time

consuming (and probably more than you want to publicly divulge). See
commercial support link in the footer for info.

I would love to, but unless you give a friendly K-12 educational discount of
free, I don't think it will happen. Our budget, while it hasn't shrank yet,
it's not gone up in several years now either, so we're constantly trying to
do more with less and I don't think this is something I would be able to
convince my boss to do. I've wanted to get a wireless site survey done for a
couple years now at our one building and that has never happened either,
though I think I have done a pretty good job in placing our AP's through
trial and error. So I'll most likely stick to trial and error testing with a
few more posts to the mailing list.

I may have spoken too quickly last time as what I said made a lot, probably
too may, assumptions about your network. So lets start over and say as with
most networking things "it depends". You've mentioned that the wireless
links are bridges but you also said that you believe that the switches are

layer

3 and may be used for routing. So the first thing you need to figure out

is if

the traffic is being passed between buildings are just forwarded between
buildings using layer 2 mechanisms or is the traffic being routed by a

router,

which may be a layer 3 switch in your case.

We are routing across our L2 links.

So if you're dealing with a network that's routing traffic between the
buildings then my original reply stands. You should look at moving to a
dynamic routing solution such as OSPF. But based on some of your other
questions it sounds like this may not be the case.

We are using static routes currently. Our core switches are Cisco 3750's
performing basic core 3 routing based on destination. Basically something
like this:

ip route 10.20.0.0 255.255.0.0 10.250.250.20
ip route 10.30.0.0 255.255.0.0 10.250.250.30
ip route 10.40.0.0 255.255.0.0 10.250.250.40
ip route 10.222.20.0 255.255.255.0 10.250.250.20
ip route 10.222.30.0 255.255.255.0 10.250.250.30
ip route 10.222.40.0 255.255.255.0 10.250.250.40

The first 3 lines deal with regular network traffic and the last 3 deal with
the VOIP VLAN, though all go to the same locations and I suppose we could of
set up a subnet of something like 10.20.222.0 for VOIP so that we wouldn't
need an extra rule, but I'm guessing it has something to do with QoS.

As for your dealing with QoS to work with VoIP goes. I don't see why you
wouldn't be able to do that but I don't know a lot about the QoS stuff in
pfSense other than it does support it so in theory you should be able to
prioritize the traffic as you need though pfSense.

This is where a lot of my confusion comes from as well. I don't really know
QoS at all.

Your question about VLANs is what tips me off that you're not routing
currently. But it's my understanding that a router will strip off the

vlan tags.

So you would need to route traffic from one VLAN on network A to the
appropriate VLAN on network B where the frame will be tagged again.

Yeah, that was me not completely thinking and having my brain take a
mini-vacation. I knew we were doing routing, but for some reason was
thinking the VLAN tags were still going through, though I should have known
that to not be the case since we have 5 VLAN 1's, one at each location.

One more question about OSPF routing, am I going to want to remove the
routes from the switches or would it be beneficial to leave them in there,
but point to the IP of the pfSense box and have it do OSPF routing to
determine if it should go over the normal wireless links or over the VPN?
I'm not sure, but I'd think that having the switches doing the basic routing
to determine if it needs to go across a link would be more efficient and
faster than passing that to the pfSense box and then back to the switch if
it's only in a different subnet at the same building. Not sure how I'd
incorporate QoS on the VOIP in this manner though, perhaps a virtual IP?

Thank you all for your thoughts and I think I'm a bit closer to being ready
to give this a test run once I get some spare time in a couple weeks.
--
John McDonnell
gorgarath-***@public.gmane.org



---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-***@public.gmane.org
For additional commands, e-mail: support-help-***@public.gmane.org

Commercial support available - https://portal.pfsense.org

[David Miller]

Post by John McDonnell
One more question about OSPF routing, am I going to want to remove the
routes from the switches or would it be beneficial to leave them in there,
but point to the IP of the pfSense box and have it do OSPF routing to
determine if it should go over the normal wireless links or over the VPN?
I'm not sure, but I'd think that having the switches doing the basic routing
to determine if it needs to go across a link would be more efficient and
faster than passing that to the pfSense box and then back to the switch if
it's only in a different subnet at the same building. Not sure how I'd
incorporate QoS on the VOIP in this manner though, perhaps a virtual IP?

Yes for inter-VLAN routing within the building I'd use the switches to get
the line speed routing available in the switch. I don't see any reason to
send the traffic to pfSense just to have it send the traffic back if you
don't have to. Also I just had a look at the 3750 spec sheet it appears to
support OSPF and EIGRP (Cisco's proprietary dynamic routing solution). It's
not too common for a Layer3 switch to support dynamic routing protocols so I
can't say how complete this support is but it's there in some form. I'm not
sure what image you need to have on the switch to get access to this
functionality. So you would have to do some research into if your images
support these protocols and if they support enough of the protocol to do
what you need. If they do then you could keep all the routing on the Cisco
switches and just use pfSense to setup the VPN tunnel. Otherwise I would
use the hybrid approach and let the pfSense boxes route between buildings
leaving the switches to route between vlans.

Thank you all for your thoughts and I think I'm a bit closer to being ready

Post by John McDonnell
to give this a test run once I get some spare time in a couple weeks.

Good luck. Let us know how it works out.
--
David

[Adam Thompson]

The Cisco 3750 does support full layer-3 capability, its OSPF implementation is about as complete as you’d find in a x800-series router running IPBASE. In fact, it’s routing speed will be pretty close to what an 1801 router could do – i.e., not wonderful.

Some 3750s (not many) come with “LAN-Lite” or “LAN-base” software, however, and all L3 functions are disabled in those builds. From the console, run “show version”, and then go to Cisco’s site (or post here) to decode the “image name”, which will look something like “c3750-ipbaselmk9-tar.122-55.SE3.tar”. If it says “ipbase” or “ipservices” you’re good to run OSPF. If it also says in “k9” you’re able to use encryption (but you won’t want to, as the CPU is very slow).



-Adam Thompson

<mailto:athompso-gKoiEJA+***@public.gmane.org> athompso-gKoiEJA+***@public.gmane.org





From: David Miller [mailto:david3d-***@public.gmane.org]
Sent: Thursday, August 18, 2011 09:42
To: support-***@public.gmane.org
Subject: Re: [pfSense Support] VPN Failover Backup



On Thu, Aug 18, 2011 at 1:11 AM, John McDonnell <gorgarath-***@public.gmane.org> wrote:

One more question about OSPF routing, am I going to want to remove the
routes from the switches or would it be beneficial to leave them in there,
but point to the IP of the pfSense box and have it do OSPF routing to
determine if it should go over the normal wireless links or over the VPN?
I'm not sure, but I'd think that having the switches doing the basic routing
to determine if it needs to go across a link would be more efficient and
faster than passing that to the pfSense box and then back to the switch if
it's only in a different subnet at the same building. Not sure how I'd
incorporate QoS on the VOIP in this manner though, perhaps a virtual IP?


Yes for inter-VLAN routing within the building I'd use the switches to get the line speed routing available in the switch. I don't see any reason to send the traffic to pfSense just to have it send the traffic back if you don't have to. Also I just had a look at the 3750 spec sheet it appears to support OSPF and EIGRP (Cisco's proprietary dynamic routing solution). It's not too common for a Layer3 switch to support dynamic routing protocols so I can't say how complete this support is but it's there in some form. I'm not sure what image you need to have on the switch to get access to this functionality. So you would have to do some research into if your images support these protocols and if they support enough of the protocol to do what you need. If they do then you could keep all the routing on the Cisco switches and just use pfSense to setup the VPN tunnel. Otherwise I would use the hybrid approach and let the pfSense boxes route between buildings leaving the switches to route between vlans.

Thank you all for your thoughts and I think I'm a bit closer to being ready
to give this a test run once I get some spare time in a couple weeks.


Good luck. Let us know how it works out.
--
David

[John McDonnell]

Post by Adam Thompson
Yes for inter-VLAN routing within the building I'd use the switches to get the
line speed routing available in the switch. I don't see any reason to send the
traffic to pfSense just to have it send the traffic back if you don't have to.
Also I just had a look at the 3750 spec sheet it appears to support OSPF and
EIGRP (Cisco's proprietary dynamic routing solution). It's not too common for
a Layer3 switch to support dynamic routing protocols so I can't say how
complete this support is but it's there in some form.

As Adam says:
The Cisco 3750 does support full layer-3 capability, its OSPF implementation is
about as complete as you’d find in a x800-series router running IPBASE. In
fact, it’s routing speed will be pretty close to what an 1801 router could do –
i.e., not wonderful.

Post by Adam Thompson
... If they do
then you could keep all the routing on the Cisco switches and just use
pfSense to setup the VPN tunnel. Otherwise I would use the hybrid
approach and let the pfSense boxes route between buildings leaving the
switches to route between vlans.

I think that if running OSPF on the 3750 is going to bottleneck everything, I'll just use the static routes I currently have, just change them to point to the pfSense box instead of the wireless link and let the pfSense box do the routing between buildings and the VPN backup. If I'm understanding this correctly, I do not need to set up the pfSense box to be a trunked port as it will already have VLAN tags stripped by the switch correct? I'll have to look up info on QoS next and then hopefully get some spare time to set up a box again to get a feel for everything over the weekend. And then as soon as everything calms down after the start of the new school year, maybe go in over a weekend with the boss and try and put it in place to see how it works. Probably only at one remote building and my office, which is the DMARC for the building and connected by fiber to the main DMARC.

One concern I just thought of now. How much of an impact would it be having the pfSense box that acts as the main VPN endpoint at the DMARC in my building instead of the main DMARC at the other end of the fiber.

Basically,
Building A = Main DMARC
Building B = Connected via Fiber
Building C = Remote Building
Building D = Remote Building
Building E = Remote Building

Building A hosts the main internet connection.
Building B is connected via fiber to Building A (believe it is a 2Gb backbone)
Building C is connected to Building A via ~150Mb wireless
Building D is connected to Building C via 100Mb wireless (Building C has 2 separate wireless radios)
Building E is connected to Building A via 100Mb wireless

All 5 buildings also have a cable connection provided by Comcast over which I will be running the backup VPN.

The core router (for whatever archaic reason) is located in Building B. Building B also used to have a second router (it still does, just not active) that was connected to the T1 lines to the remote buildings. (I believe this is why the core router is in Building B as the main internet was not always the wireless tower that was installed at building A.)

Now that I recall how the network is set up, I don't think there will be an issue having the VPN terminate in my building.

Post by Adam Thompson
Good luck. Let us know how it works out.

Will do. :)

Also, I apologize for previously requesting a read receipt on my last email.
--
John McDonnell
gorgarath-***@public.gmane.org


---------------------------------------------------------------------
To unsubscribe, e-mail: support-unsubscribe-***@public.gmane.org
For additional commands, e-mail: support-help-***@public.gmane.org

Commercial support available - https://portal.pfsense.org