Re: How expand domain subnet?

I will have a stab at the VPN routing question you raise. I think that
you are making an assumption which is not really true.

You seem to assume that, it you set up your LAN as 192.168.0.0/22, VPN
clients with 192.168.1.x/24 addresses will only be able to access LAN
machines which have 192.168.1.x addresses, and not be able to access
machines with, say, 192.168.2.x addresses.

IP routing doesn't work like that. 192.168.1.30/24 is not the same thing
as 192.168.1.30/22 . A machine in a subnet with a 24-bit subnet can route to
all of the machines in a subnet with a 22-bit subnet mask.

I believe that you will have trouble with your VPN if you change the
subnet mask on the LAN. If the LAN and the remotes are using addresses in
the same IP subnet, it is not using normal IP routing. It is using some sort
of proxy ARP (ie the server is doing proxy ARP on the LAN to receive packets
addressed to the remote clients) , and it will fail if you change the LAN
subnet mask.


"Phillip Windell" <@.> wrote in message
news:Oo4LwgZ3GHA.5000@xxxxxxxxxxxxxxxxxxxxxxx
"Newell White" <NewellWhite@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5BDAB452-376F-4BC6-9142-CE9FF7F32AD3@xxxxxxxxxxxxxxxx
Gentlemen,
I understand that you are encouraging me to follow what is generally
regarded as best practice, and I thank you for your time. But you seem to
ignore some points of my plan.

I'm not ignoring those points,...I'm telling you to stop doing them if you
want this to work right. Being "feasible" isn't the question for me and I
am not going to play it that way. "Two-Cans-and-a-string" is feasible,
but I'm not going to tell anyone to use that.

If you want the machines to "hang on" until you get into the office then
use the default DHCP Lease period of 8 days. That gives you about 4 days
to get in to fix it. If that isn't enough then make it thirty days which
gives you 15 days. The reason of the "half period" is because DHCP
Clients attempt to renew their lease at 50% of the Lease.

Creating a disaster of a LAN design just because you want to have the
machines not be affected by a down DHCP until you get back in the office
is...well...I don't know how to say it in a good way. LAN design is
primary,...DHCP schemes are secondary (not the other way around).

If you want one DHCP to keep it all running indefinately if one goes
down,..do this...
1. If you have 200 Hosts, then use two separate segments of 254 each.
(/24)
2. Have 100 hosts in each.
3. Identically configure two DHCP boxes as I described before and divide
them up with Exclusions. Remember to configure two Scopes on each to
represent each segment.
4. Configure the LAN router to forward DHCP Queries to the two DHCP
Servers.
5. Add a static Route to the Pix so that it knows to use the LAN Router as
the path to the segment on the far side of the router. Correct the Local
Addess Table on the PIX to include both LAN IP Ranges

Now there will be less than half the avialable address in use in either
segment,...which means that just one DHCP Server by itself will have
enough addresses to keep thing going indefinately,...and you are not
violating proper LAN design in the process of doing so.

If I think of anything else,..I'll post agan.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com




.

Relevant Pages

  • Re: Continuing internet oddities
    ... From your bellsouth address and the fact that you have DHCP, I presume you are also have to contend with PPPoE. ... Boot the old machine from the SmoothWall CD, follow the installation dialogue, and in twenty or thirty minutes you shall have a firewall/router configured for PPPoE. ... SmoothWall can act as a DHCP server for your local area network; or you may assign static IP addresses to the machines in your LAN. ...
    (Debian-User)
  • Re: VDQ : machine names??
    ... When anaconda asks me whether to use dhcp, I can click on manual, type in a name, click back to using dhcp, and that name lasts. ... I'm not even sure now whether it's mere logging out and back in, or just actual reboots that do it, but in a location subject to longer power failures than the UPSs I can afford will ride out, I get enough reboots, too. ... I want something that shows up in the prompts, and that I can use in ssh and scp, without having to look up IP numbers on the router all the time -- especially since not all LAN machines are on one floor. ...
    (Fedora)
  • Re: Problems with Internet / Netgear router on SBS 2003
    ... Your SBS network has a 'lan' side; your SBS should be the DHCP server for ... The router also has a 'lan' side, and it's on the same addressing as your ... You can elect to turn on the DHPC server for your router; ... Even without DHCP turned on at the router, you can still connect there, you ...
    (microsoft.public.windows.server.sbs)
  • Re: ISA Server & a WiFi Hotspot (some DHCP for good measure too)
    ... have the LAN side of the wireless router be in the 10.0.0.x ... your SBS has two nics - its WAN nic is using 10.0.0.2 ... The SBS handles DHCP for the ... The SBS firewall not only keeps the wireless clients ...
    (microsoft.public.windows.server.sbs)
  • VDQ : machine names??
    ... I want to stop calling all the machines on my LAN ... using dhcp, and that name lasts. ... reboots, too. ...
    (Fedora)
Loading