off subnet VPN

To start from the top I have configured a superscope on my network to
contain 192.168.48.x and 192.168.47.x because I started running out of
addresses in my poorly configured DHCP pool on the 192.168.48.x network.
When someone grabs an IP from the 47.x network all is well and it can
communicate with everything on the 48.x network.

I have setup a VPN server and now when someone grabs an IP from the 47.x
network they have no idea about how to get to the 48.x network. That is,
unless the client has the "use default gateway on remote network" then there
is a default route for all traffic. This isn't what I want, though. The
client must use their own connection to surf the internet because of
bandwidth constraints.

My question is how do I give the client a static route to reach the 48.x
network if they grab a 47.x address?

I will buy a beer (or six) for the person that has a good solution for this


TIA.
-Steven-

Well, today when you connect you´ll get a route towards the network whos IP
you are assigned. You need to provide an additional route for the network on
which, for the moment, you are not assigned an IP, but still needs to
communicate with.

It doesn´t say which kind of firewall you are using or what kind of VPN
solution you have, but I would recomend that you do as much as you can with
the routingtable and rulebase on your firewall/VPN gateway. If you can´t
solve the problem there you can, provided the client supports it, you can
assign the VPN client with connectionspecific routes whenever it connects.

--
----------------------------------------------------------------------------------------------------------------------------
Johan Engdahl
CCSA, CCSE, CCA, MCP | johan AT firewall1 DOT nu | http://www.firewall1.nu

"Steven Platt" <(E-Mail Removed)> wrote in message
news:e%(E-Mail Removed)...
> To start from the top I have configured a superscope on my network to
> contain 192.168.48.x and 192.168.47.x because I started running out of
> addresses in my poorly configured DHCP pool on the 192.168.48.x network.
> When someone grabs an IP from the 47.x network all is well and it can
> communicate with everything on the 48.x network.
>
> I have setup a VPN server and now when someone grabs an IP from the 47.x
> network they have no idea about how to get to the 48.x network. That is,
> unless the client has the "use default gateway on remote network" then
> there is a default route for all traffic. This isn't what I want, though.
> The client must use their own connection to surf the internet because of
> bandwidth constraints.
>
> My question is how do I give the client a static route to reach the 48.x
> network if they grab a 47.x address?
>
> I will buy a beer (or six) for the person that has a good solution for
> this
>
> TIA.
> -Steven-
>

"Steven Platt" <(E-Mail Removed)> wrote in message
news:e%(E-Mail Removed)...
> To start from the top I have configured a superscope on my network to contain
> 192.168.48.x and 192.168.47.x because I started running out of addresses in my
> poorly configured DHCP pool on the 192.168.48.x network. When someone grabs an
> IP from the 47.x network all is well and it can communicate with everything on
> the 48.x network.

I'd like to backup to the beginning and look at the original issue you mention
here. I'm not quite willing to accept that you had to do that to start with. I
always believe in [properly] solving the original problem first,...then the
other issues no longer exist.

The most important question to ask: How many Hosts are on the LAN? Just
hosts,..I don't want to hear about subnets.

Second most important question: What are the specs of the original Scope?
(Full IP Range used? The Exclusions?)

Do you understand that subnets are supposed to stay below 250-300 Hosts? When
you go over that many, you are supposed to create a new segment,...not make a
bigger segment.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed (as annoying as they are, and as stupid as they sound), are
my own and not those of my employer, or Microsoft, or anyone else associated
with me, including my cats.
-----------------------------------------------------

Thanks for the reply. I am using Windows 2003 RRAS as the VPN server and
the builtin Windows XP VPN client. You said exactly what I need and that is
connection specific routes. Is it possible to do this in my environment?

Thanks,
-Steven-


"Johan Engdahl" <(E-Mail Removed)> wrote in message
news:eU%(E-Mail Removed)...
> Well, today when you connect you´ll get a route towards the network whos
> IP you are assigned. You need to provide an additional route for the
> network on which, for the moment, you are not assigned an IP, but still
> needs to communicate with.
>
> It doesn´t say which kind of firewall you are using or what kind of VPN
> solution you have, but I would recomend that you do as much as you can
> with the routingtable and rulebase on your firewall/VPN gateway. If you
> can´t solve the problem there you can, provided the client supports it,
> you can assign the VPN client with connectionspecific routes whenever it
> connects.
>
> --
> ----------------------------------------------------------------------------------------------------------------------------
> Johan Engdahl
> CCSA, CCSE, CCA, MCP | johan AT firewall1 DOT nu | http://www.firewall1.nu
>
> "Steven Platt" <(E-Mail Removed)> wrote in message
> news:e%(E-Mail Removed)...
>> To start from the top I have configured a superscope on my network to
>> contain 192.168.48.x and 192.168.47.x because I started running out of
>> addresses in my poorly configured DHCP pool on the 192.168.48.x network.
>> When someone grabs an IP from the 47.x network all is well and it can
>> communicate with everything on the 48.x network.
>>
>> I have setup a VPN server and now when someone grabs an IP from the 47.x
>> network they have no idea about how to get to the 48.x network. That is,
>> unless the client has the "use default gateway on remote network" then
>> there is a default route for all traffic. This isn't what I want,
>> though. The client must use their own connection to surf the internet
>> because of bandwidth constraints.
>>
>> My question is how do I give the client a static route to reach the 48.x
>> network if they grab a 47.x address?
>>
>> I will buy a beer (or six) for the person that has a good solution for
>> this
>>
>> TIA.
>> -Steven-
>>
>
>

I always like to fix the big picture first as well. But my problem is there
aren't enough hours in the day to go digging around on all of my printers,
computers, etc... to look for static IPs. The problem is that the first
DHCP pool was set to 60 hosts (192.168.48.12-192.168.48.114 and there are
several exclusions). I figured that since there are bigger masks than /24
it was okay if you had more than 253 hosts. A superscope is really the best
solution for my situation.

-Steven-

"Phillip Windell" <@.> wrote in message
news:%(E-Mail Removed)...
> "Steven Platt" <(E-Mail Removed)> wrote in message
> news:e%(E-Mail Removed)...
>> To start from the top I have configured a superscope on my network to
>> contain 192.168.48.x and 192.168.47.x because I started running out of
>> addresses in my poorly configured DHCP pool on the 192.168.48.x network.
>> When someone grabs an IP from the 47.x network all is well and it can
>> communicate with everything on the 48.x network.
>
> I'd like to backup to the beginning and look at the original issue you
> mention here. I'm not quite willing to accept that you had to do that to
> start with. I always believe in [properly] solving the original problem
> first,...then the other issues no longer exist.
>
> The most important question to ask: How many Hosts are on the LAN? Just
> hosts,..I don't want to hear about subnets.
>
> Second most important question: What are the specs of the original Scope?
> (Full IP Range used? The Exclusions?)
>
> Do you understand that subnets are supposed to stay below 250-300 Hosts?
> When you go over that many, you are supposed to create a new
> segment,...not make a bigger segment.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
> The views expressed (as annoying as they are, and as stupid as they
> sound), are my own and not those of my employer, or Microsoft, or anyone
> else associated with me, including my cats.
> -----------------------------------------------------
>
>

"Billingsley" <(E-Mail Removed)> wrote in message
ws:(E-Mail Removed)...
>I always like to fix the big picture first as well.

I asked only two primary questions in my last post and you didn't answer either
one.

> But my problem is there aren't enough hours in the day to go digging around on
> all of my printers, computers, etc... to look for static IPs.

You don't need to know every static machine's IP#. Your current Scope
Exclusions tell you all you need to know.

> The problem is that the first DHCP pool was set to 60 hosts
> (192.168.48.12-192.168.48.114 and there are several exclusions).

What about the first question I asked? How many hosts are on the LAN? All
Hosts,...dynamic, static, reserved,...it doesn't matter,...just how many are
there?
There is appearantly less than 102 with that Scope Range.

You also didn't answer the second question. What are the exact specs of the
exisitng orginal Scope?

No the superscope isn't the best solution.
The problem is your original Scope. The Scope should contain the full Address
Range
192.168.48.1 - 192.168.48.254

As long as the Mask doesn't need changed you can simply edit the Scope.
If the mask needs changed, then you'll have to delete and recreate the Scope.
Fix the scope and you will have enough addresses, then you won't screw up the
LAN and make a larger "mess" to clean up in the future by turning it into a
Multi-Net. Did you account for the fact that you *still* have to buy a LAN
Router because it still requires a router to get across the logical segments
even though they run on the same physical & logical wire?

And then,... :-) you would probably leave there and the next guy would
probably be writing to us complaining about you leaving him a mess as you
complained about the previous guy leaving you a mess, and asking us to help him
straighten it all out.
It's true,...it happens,..I've been doing these groups for about 7 years.

Never, ever, ever do sloppy work because you don't think you have the time to do
it right. Make the time. We both have the same number of hours in the day. I
am a one-man IT Dept at one of 30+ Sites in a 2600 user Corp network,...and I
still find time to handle these newsgroups with other peoples problems. :-)

> I figured that since there are bigger masks than /24 it was okay if you had
> more than 253 hosts. A superscope is really the best solution for my
> situation.

The purpose of bigger Masks is to "supernet",...meaning you require less routes
in the routing table of the router,...the larger segmets are then split up into
smaller pieces as it is moved futher "downstream",...so when you get down to the
hosts themselves you still have segments less than 254 hosts. This is why
physically adjacent segments in a single physical area of a building or campus
tend to be numbered sequentially so that the routers "along the way" to getting
there can use supernetting.

This is also how the Internet works between the different "levels" of providers
in the internet "food chain".

But now someone needs me downstairs,...it's that "time" thing. We can deal with
this more in the next post if we need to.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed (as annoying as they are, and as stupid as they sound), are
my own and not those of my employer, or Microsoft, or anyone else associated
with me, including my cats.
-----------------------------------------------------

Answers in-line...
"Phillip Windell" <@.> wrote in message
news:(E-Mail Removed)...
> "Billingsley" <(E-Mail Removed)> wrote in message
> ws:(E-Mail Removed)...
>>I always like to fix the big picture first as well.
>
> I asked only two primary questions in my last post and you didn't answer
> either one.

Wow... pushy.
1. about 150
2. already answered, (don't want to list the exclusions... waste of time.)

>> But my problem is there aren't enough hours in the day to go digging
>> around on all of my printers, computers, etc... to look for static IPs.
>
> You don't need to know every static machine's IP#. Your current Scope
> Exclusions tell you all you need to know.

This isn't true. If you want me to extend my current scope I would need to
know the printers et. al. that aren't in the current DHCP scope so I won't
have a problem with my DHCP server handing out addresses that are already
being used by static hosts.

>> The problem is that the first DHCP pool was set to 60 hosts
>> (192.168.48.12-192.168.48.114 and there are several exclusions).
>
> What about the first question I asked? How many hosts are on the LAN? All
> Hosts,...dynamic, static, reserved,...it doesn't matter,...just how many
> are there?
> There is appearantly less than 102 with that Scope Range.

No, read above.

> You also didn't answer the second question. What are the exact specs of
> the exisitng orginal Scope?

What kind of specs do you want? I told you that it was from
192.168.48.12-192.168.48.114. Do you want the reserved? exclusions? But,
wait. You said a second ago you don't want that stuff... just the hosts on
the LAN.

> No the superscope isn't the best solution.
> The problem is your original Scope. The Scope should contain the full
> Address Range
> 192.168.48.1 - 192.168.48.254

I understand that you don't like the fact that I am trying to superscope. I
just wanted something quick and easy so I can avoid walking to every
printer/computer to check their TCP/IP settings (IP Address in particular
along with static or DHCP).

> As long as the Mask doesn't need changed you can simply edit the Scope.
> If the mask needs changed, then you'll have to delete and recreate the
> Scope.
> Fix the scope and you will have enough addresses, then you won't screw up
> the LAN and make a larger "mess" to clean up in the future by turning it
> into a Multi-Net. Did you account for the fact that you *still* have to
> buy a LAN Router because it still requires a router to get across the
> logical segments even though they run on the same physical & logical wire?

Got that covered. I already have a LAN router. It's up and running just
fine.

> And then,... :-) you would probably leave there and the next guy would
> probably be writing to us complaining about you leaving him a mess as you
> complained about the previous guy leaving you a mess, and asking us to
> help him straighten it all out.
> It's true,...it happens,..I've been doing these groups for about 7 years.

I know it happens. That's what I am dealing with now. I don't create DHCP
scopes that don't use the full range of the mask (maybe set aside 10-20 for
printers, etc...).

> Never, ever, ever do sloppy work because you don't think you have the time
> to do it right. Make the time. We both have the same number of hours in
> the day. I am a one-man IT Dept at one of 30+ Sites in a 2600 user Corp
> network,...and I still find time to handle these newsgroups with other
> peoples problems. :-)

You only handle one site? Lucky you. You shouldn't judge the time I
do/don't have... you simply don't know.

>> I figured that since there are bigger masks than /24 it was okay if you
>> had more than 253 hosts. A superscope is really the best solution for my
>> situation.
>
> The purpose of bigger Masks is to "supernet",...meaning you require less
> routes in the routing table of the router,...the larger segmets are then
> split up into smaller pieces as it is moved futher "downstream",...so when
> you get down to the hosts themselves you still have segments less than 254
> hosts. This is why physically adjacent segments in a single physical area
> of a building or campus tend to be numbered sequentially so that the
> routers "along the way" to getting there can use supernetting.

Thanks for the explanation.

> This is also how the Internet works between the different "levels" of
> providers in the internet "food chain".
>
> But now someone needs me downstairs,...it's that "time" thing. We can
> deal with this more in the next post if we need to.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
> The views expressed (as annoying as they are, and as stupid as they
> sound), are my own and not those of my employer, or Microsoft, or anyone
> else associated with me, including my cats.
> -----------------------------------------------------
>
>

"Billingsley" <(E-Mail Removed)> wrote in message
news:ey%(E-Mail Removed)...
>> I asked only two primary questions in my last post and you didn't answer
>> either one.
>
> Wow... pushy.

Sorry. Newsgroup messages don't communicate tone of voice well. It sometimes
comes across more harse than I intend.

> 1. about 150
> 2. already answered, (don't want to list the exclusions... waste of time.)

It isn't that bad, you've only got 150. For the printers, sooner or later you
are going to have to know what they are, that stuff needs documented. I just use
a speadsheet for my IP list. It's up to you.

>>> The problem is that the first DHCP pool was set to 60 hosts
>>> (192.168.48.12-192.168.48.114 and there are several exclusions).

Ok. So the first thing would be to expand the over all range as I said.
192.168.48.1 -- 192.168.48.254

Leave the exclusions there that are already there and add these:
Exclusion 192.168.48.1 - 192.168.48.11
Exclusion 192.168.48.115 - 192.168.48.254
I don't remember if it allows overlaping Exclusions or not,...if you have
overlap and it complains you will have to deal with that.

At this point you have the same thing you already have (*.12 - *.114) except
that now you have the abiltiy to shrink the Exclusions I listed above to give
youself more addresses.

There is no way around the fact that you need to know the details of what you
have, so things are going to have to get documented. Then once you have that
done you really needs to cleanup the Exclusions. The one thing you do not want
is a whole bunch of individual Exclusions for single IP#s. The Exclusions need
to be grouped together sequentially.

Typically I run a group of 25 at the bottom and a group of 25 at the top giving
me 50 addresses that I can statically use while leaving myself 204 dynamic
addresses.

Like:
Range: 192.168.48.1 -- 192.168.48.254
Exclusion 192.168.48.1 - 192.168.48.24
Exclusion 192.168.48.204 - 192.168.48.254
Leaves usuable dynamic range of 192.168.48.25 - 192.168.48.203
254 hosts total

Going back to your original problem. It ain't gonna work. You can't do that
without a router. By the time you buy the router get it configured and tweeked
and get all the Multi-netting "mess" working,...you could easily (and more
quickly) have just corrected things as I described and have a lot more cleaner
and more dependable system.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed (as annoying as they are, and as stupid as they sound), are
my own and not those of my employer, or Microsoft, or anyone else associated
with me, including my cats.
-----------------------------------------------------

Thanks for the reply. I know how my DHCP _should_ be but unfortunately I am
playing clean-up for something I didn't do. I have setup several networks
using almost all of the addresses in the pool. I usually start at 20 and go
up to 254 and just know that I assign static devices from 2-19... this way I
don't have to mess with exclusions. My multi-net is working perfectly, the
router configuration consisted of a one-liner (ip address 192.168.47.254
255.255.255.0 secondary). The problem lies in the configuration handed out
by DHCP on my VPN clients... if they receive a 47.x address they don't know
how to get to the 48.x network unless they choose "use default gateway on
remote network."

After some consideration I think I will clean this thing up. I have decided
to do about 10 devices/day and it should be done in a couple of weeks. I
will be much happier and my broadcasts won't be so huge. Here I am trying
to enhance network performance by increasing my broadcast domain!?!?!
Doesn't make much sense, I know!

I am still interested to know if I can give a route to my VPN clients some
way. Now that I think about it my VPN clients couldn't even get to any of
my other subnets unless they check "use default gateway on remote network."
I guess I could setup another DHCP server and use option 249 but that is an
overkill IMO... oh well, mystery goes on.

-Steven-

"Phillip Windell" <@.> wrote in message
news:%(E-Mail Removed)...
> "Billingsley" <(E-Mail Removed)> wrote in message
> news:ey%(E-Mail Removed)...
>>> I asked only two primary questions in my last post and you didn't answer
>>> either one.
>>
>> Wow... pushy.
>
> Sorry. Newsgroup messages don't communicate tone of voice well. It
> sometimes comes across more harse than I intend.
>
>> 1. about 150
>> 2. already answered, (don't want to list the exclusions... waste of
>> time.)
>
> It isn't that bad, you've only got 150. For the printers, sooner or later
> you are going to have to know what they are, that stuff needs documented.
> I just use a speadsheet for my IP list. It's up to you.
>
>>>> The problem is that the first DHCP pool was set to 60 hosts
>>>> (192.168.48.12-192.168.48.114 and there are several exclusions).
>
> Ok. So the first thing would be to expand the over all range as I said.
> 192.168.48.1 -- 192.168.48.254
>
> Leave the exclusions there that are already there and add these:
> Exclusion 192.168.48.1 - 192.168.48.11
> Exclusion 192.168.48.115 - 192.168.48.254
> I don't remember if it allows overlaping Exclusions or not,...if you have
> overlap and it complains you will have to deal with that.
>
> At this point you have the same thing you already have (*.12 - *.114)
> except that now you have the abiltiy to shrink the Exclusions I listed
> above to give youself more addresses.
>
> There is no way around the fact that you need to know the details of what
> you have, so things are going to have to get documented. Then once you
> have that done you really needs to cleanup the Exclusions. The one thing
> you do not want is a whole bunch of individual Exclusions for single IP#s.
> The Exclusions need to be grouped together sequentially.
>
> Typically I run a group of 25 at the bottom and a group of 25 at the top
> giving me 50 addresses that I can statically use while leaving myself 204
> dynamic addresses.
>
> Like:
> Range: 192.168.48.1 -- 192.168.48.254
> Exclusion 192.168.48.1 - 192.168.48.24
> Exclusion 192.168.48.204 - 192.168.48.254
> Leaves usuable dynamic range of 192.168.48.25 - 192.168.48.203
> 254 hosts total
>
> Going back to your original problem. It ain't gonna work. You can't do
> that without a router. By the time you buy the router get it configured
> and tweeked and get all the Multi-netting "mess" working,...you could
> easily (and more quickly) have just corrected things as I described and
> have a lot more cleaner and more dependable system.
>
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
> The views expressed (as annoying as they are, and as stupid as they
> sound), are my own and not those of my employer, or Microsoft, or anyone
> else associated with me, including my cats.
> -----------------------------------------------------
>
>

"Billingsley" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks for the reply. I know how my DHCP _should_ be but unfortunately I am
> playing clean-up for something I didn't do. I have setup several networks
> using almost all of the addresses in the pool. I usually start at 20 and go
> up to 254 and just know that I assign static devices from 2-19... this way I
> don't have to mess with exclusions.

Yes. Some guys do it that way, but you should "want" to mess with exclusions.
You would have an exclusion for 1-19 and use the full range in the Scope.

> My multi-net is working perfectly, the router configuration consisted of a
> one-liner (ip address 192.168.47.254 255.255.255.0 secondary). The problem
> lies in the configuration handed out by DHCP on my VPN clients... if they
> receive a 47.x address they don't know how to get to the 48.x network unless
> they choose "use default gateway on remote network."

The Router should have two intefaces (one for 47.x and one for 48.x) and they
need to be on the same "wire" by cabling them into the same hub/switch. Then in
the DHCP Scopes that you have inside the superscope you would include the router
interface for that particular IP logical segment. Use Scope Options and not
Server Options.

> After some consideration I think I will clean this thing up. I have decided
> to do about 10 devices/day and it should be done in a couple of weeks. I will
> be much happier and my broadcasts won't be so huge. Here I am trying to
> enhance network performance by increasing my broadcast domain!?!?! Doesn't
> make much sense, I know!

Actually that makes sense in a sort of twisted way. That is why Multi-nets
stink. In a Multi-Net (and also on a VLAN shared wire) there is no benefit to
IP Segmenting because all the logical segments are using the same physical wire.
Therefore all the broadcast, regaurdless of which broadcast domain they belong
to still travels over the same wire. So the physical wire still has just as
much bandwidth usage as it would have with a single segment, except that the
whole system has all the convoluted complexities created by the Multi-net on top
of that,...so,...as far as I am concerned,...it is a train wreck waiting to
happen.

> I am still interested to know if I can give a route to my VPN clients some
> way. Now that I think about it my VPN clients couldn't even get to any of my
> other subnets unless they check "use default gateway on remote network."

The "use default gateway on remote network" is what makes it work and it has to
be enabled. That is the only thing you are supposed to do. If you find you have
to do anything else, then there are things wrong elsewhere that are then causing
you to have to "band-ade" around them. I have VPN users here as well and have 4
subnets here locally and an "un-godly" number of subnets on the overall Corp
LAN,...the VPN Clients route perfectly fine with only the "use default gateway
on remote network" enabled.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The views expressed (as annoying as they are, and as stupid as they sound), are
my own and not those of my employer, or Microsoft, or anyone else associated
with me, including my cats.
-----------------------------------------------------