RED15w Connected but no VLAN Traffic

Quick followup:

From a workstation on-site I can actually ping the Internal Interface of the SG230 at Head Office - but can't get to the Dell Switch on the same subnet.

So Workstation onsite (10.0.50.22, GW 10.0.50.253) - RED15 (10.0.50.253) - Internal Interface of SG230 at Head Office (10.0.10.250) pings fine

Workstation onsite (10.0.50.22, GW 10.0.50.253) - RED15 (10.0.50.253) - through tunnel - Dell 6248 VLAN 50 Interface (10.0.50.254, also tried vlan 10 interface of 10.0.10.254) no pings :(

Still looking for hints/tips :)

David, I would have to see a diagram to wrap my head around your topology.  Do you need a common VLAN on both sites?

Cheers - Bob

Cheers Bob - give me an hour or so to knock up a quick diagram. Working from home today as I have a couple of flooring guys coming to give me some quotes ;)

OK, basic Network Diagram attached - hopefully text is not too small? Let me know

Essentially all we want to do is:

4 Win 10 Workstations to connect to Corporate Domain at Head Office, just like the do at Head Office (DC, Exchange, Sharepoint etc all on vLAN10)

4 VOIP Phones that need to get to and from Phone System Server at 192.168.1.204 (vLAN 999). Tested VOIP handsets on different subnets at Head Office and with the intervlan routing there it works fine

Because we have a number of vLANs at Head Office to segregate network traffic I thought it was a 'no brainer' just to simply setup a new vLAN (vLAN50) for the new remote site and the RED product literature brags about 'just plug it in and away you go ;)

I was thinking about putting an RODC at the site (10.0.50.1) and setting it up as a site in AD as well. A number of different users will rotate to the new site so it would allow thm to log onto the PC's onsite locally - but the RODC would need to be able to communicate via the RED Link as well.

In my pre-Sophos days I was using a Cisco 5510 and crappy Netgear products using IPSEC to do exactly this and it worked well.

Any tips or hints would be extremely welcome - as its starting to frustrate me ;)

Images from UTM Screens:

Let me know if you need any more info!

OK, basic Network Diagram attached - hopefully text is not too small? Let me know

Essentially all we want to do is:

4 Win 10 Workstations to connect to Corporate Domain at Head Office, just like the do at Head Office (DC, Exchange, Sharepoint etc all on vLAN10)

4 VOIP Phones that need to get to and from Phone System Server at 192.168.1.204 (vLAN 999). Tested VOIP handsets on different subnets at Head Office and with the intervlan routing there it works fine

Because we have a number of vLANs at Head Office to segregate network traffic I thought it was a 'no brainer' just to simply setup a new vLAN (vLAN50) for the new remote site and the RED product literature brags about 'just plug it in and away you go ;)

I was thinking about putting an RODC at the site (10.0.50.1) and setting it up as a site in AD as well. A number of different users will rotate to the new site so it would allow thm to log onto the PC's onsite locally - but the RODC would need to be able to communicate via the RED Link as well.

In my pre-Sophos days I was using a Cisco 5510 and crappy Netgear products using IPSEC to do exactly this and it worked well.

Any tips or hints would be extremely welcome - as its starting to frustrate me ;)

Images from UTM Screens:

Let me know if you need any more info!

Adding some screenshots from the Dell 6248 at Head Office

 vLAN 50 setup - setup exactly the same as all the other Internal vLANs for Workstations

 vLAN 50 Interface setup

  IP Subnet bindings manually setup on switch

 vLAN Routing Summary

 vLAN Route Table

 default route

I am back at Head Office today and forgot to grab screenshots of the vLAN setup on the Ubiquiti EdgeSwitch at the Site. But in essence I have set it up exactly the same in most regards

Ubiquiti Switch: 10.0.51.1 - Management on vLAN1 (Native)

Added vLANs 10, 50 and 999

vLAN interface setup for each new vLAN:

vLAN 50 - 10.0.50.252

vLAN 10 - 10.0.10.252

vLAN 999 - 192.168.1.252

Routing Tables/Summaries look ok with the relevant vLAN Int as the 'Next Hop' and default route set to: 0.0.0.0 - 10.0.50.253 (Newsite Interface on UTM, which is pingable by all workstations on site)

Untagged vLAN50 on Ports 1-8 and Port 24 (Uplink to Red15W)

Tagged vLAN999 Ports 1-4 (VOIP Phones) and Port 24

Tagged vLAN10 on Port 24

That's a lot to wrap my head around, even with all of the documentation.  I can tell that you're really good with Cisco, TCP/IP & networking, but that this is the first time you've configured using UTM WebAdmin...

I probably would have configured VLAN Interfaces on the UTM and let it create all of the routing instead of having to create and keep track of static routes.  First, although I haven't tried it, I would bridge reds1 with eth0 and then define all of the VLANs on br0 - that might get the VLAN tags through the RED tunnel.

Sorry I can't be of more help, David, but this would be at least a half-day consulting gig.

Cheers - Bob

Bugger! Cheers Bob was hoping a glaringly obvious misconfigured route was the problem :(

I've opened up a Support Case and pointed them to this thread - hopefully we can work out the issue ASAP ;)

Actually - hold the phone!

On a hunch I setup 3 new Interfaces on Eth5 as Ethernet VLANs (vlan50, 999, 10) each with their own IPs (10.0.x.251 - where X is vLAN number).

I then Bridged the RED NewSite Interface with Eth5

On my Dell Layer 3 switch I configured Port 46 as a General Port and UNTAGGED vLAN50 and TAGGED vLANs 999 and 10 and patched it to Eth5 on the UTM

Deleted and recreated Firewall rule on UTM to:

Source: Interface NewSite - Service: Any - Destination: Interface Internal

Source: Interface Internal - Service: Any - Destination: Interface NewSite

Now I can:

Ping from the Head Office side of the network to not only the Ubiquiti Switch's vLAN Interfaces at the Site Office but also Ping the VOIP Phones and PC's directly as well

Ping from Site Workstation to the Dell Layer 3 Switch at Head Office

Site Workstations appear to connect to web via the RED - then UTM. Tracerts show 10.0.50.253 as the hop before the ISP, this is the RED Interface on the UTM.

No one is currently at the site, I am about to drive over, but I can now dial the VOIP deskphones, before it was straight to Message bank - now they appear to be ringing from this end (Will confirm).

What I still cant do:

Connect to any internal domain resources at Head Office

Cannot connect to desktop of Site PC's via RDP

My ScreenConnect app on each Desktop is not connecting back to our ScreenConnect Server, luckily I dropped TeamViewer on one of the Workstations on site last Thursday. This is connecting and giving me access remotely to the site.

Log onto Workstations as any other users - no access to Logon servers

I've run up an RODC here at the office, set it up as 10.0.50.1 and will take it out onsite with me.

Will advise outcome - but if anyone can let me know about the spoofed packets I am seeing it would be appreciated.

I think I am now 3/4's of the way there ;)

Cheers

David