Setting up static route/NAT

[Mushkins]

We just added a second router with hardware vpn to our network for our managed services provider for our cisco phones, and after getting the VPN tunnel to work properly they cant reach our UC560 device internally.

They'd like us to add a static route to our Sonicwall router/firewall to redirect all traffic to/from their servers through their router with its own external IP instead of the regular WAN port on the sonicwall.

Both routers are currently connected to the bridged device from our ISP. The WAN port on the sonicwall has an external IP of xxx.xxx.176.50. The external IP of the VPN router is at xxx.xxx.176.51. The internal connection of the VPN router is then connected to the sonicwall on X3 with a static IP address of 10.2.12.50. The X3 interface has a static IP address of 10.2.12.51.

As it stands, nothing on the internal network can ping 10.2.12.50 or 51, but I can ping the 10.3.12.1 interface on the sonicwall just fine, and if I change the X3 IP to something off of the 10.2.12.xx network I can ping it just fine as well. Im guessing because our regular PC vlan is using the same 10.2.12.0 network. Until this works, I can't get the static route to work to send their traffic through the VPN.

The internal interface on the VPN device is set up with that 10.2.12.50 static IP and I dont have access to the device to change it. Is there an easy trick to make these play nice, or do I have to change the whole VLAN IP address scheme to be able to use that 10.2.12.50 address? attached is a rough sketch of the network

 

[rasczak]

Do you need to setup a static route for 10.3.120 out to the next hop 10.2.12.50?

if not, is 12.51 interface tagged for VLAN x?

Sorry if I may not be helping you, I'm just tossing ideas your way.

 

[Mushkins]

VLAN info in the sonicwall interface is practically nonexistent, and even setting up a static route didnt make a difference.

Hopefully they can just change the internal interface IP on the vpn router to another network and all will be well.

 

[Danimal1209]

You can't have that address outside of your vlan.

The computers think it's in their network. So, why would they send it out of their network? They wouldn't, which is why you can't ping.

I would just change the data vlan to a different subnet and you should be ok.

 

[Lithium381]

You can't have that address outside of your vlan.

The computers think it's in their network. So, why would they send it out of their network? They wouldn't, which is why you can't ping.

I would just change the data vlan to a different subnet and you should be ok.

this is likely the culprit. the network stack decides if it needs to broadcast it locally or if it needs to send to the default gateway for delivery by looking at its own address (up to the subnet mask bits) and comparing it to the destination address (up to the SENDERS subnet mask bits). . . if it's the same it'll send it out on the local lan segment.

 

[Mushkins]

This was resolved by asking the vendor to change the internal ip address to 10.5.12.50 and changing the X3 interface IP to 10.5.12.1 and updating the static route appropriately.

Thanks for the help!