Routing Tables

[Ahhzz]

Ok, routing always gave me a headache... at a previous employer, we had two network protocols (ethernet and token ring) over several buildings in different cities, and 1 server in 1 building. I know it was possible for us to "route" traffic from the token ring sides to the Ethernet server, but it always gave me fits trying to comprehend it, especially since once we started converting TR users to Ethernet, we had to manually enter a Route statement in their PC to get them back across.

I've run into it again, and need some help. We have a client with network cameras on two different networks, in two different buildings, and on two different External (internet viewable) addresses. The Internet provider has issued 2 static IPs into a single drop, and we split it with a switch, sending it to the two different buildings, with their own routers.

Building two is on 192.168.254.***, and has 4 IP cameras in place (they're on IP addresses 192.168.188.**). Building one is on 192.168.1.***, and the Network Video Recorder (NVR) is located at 192.168.1.24, and the cameras in that building are on 192.168.188.**.

I need the NVR to see the 4 remote cameras. The gentleman in Building 1 owns both buildings, and wants cameras on both. With access to both routers (they're using PFSense), I think I need to add a route statement to each, so they can see the other, but I'm failing miserably I'm afraid. Can a get a little assist here? Thanks!!

edit added a pic as point of clarification

 

[Rhyseh]

I've tried to type out an answer for this three times. Each time I find myself starting to talk about broadcast domains and layer 3 networks. Which isn't going to make sense to you.

If you are expected to address this as part of your job. You should really spend some time learning about the basics of networking.

My advice is get a CBT nuggets subscription and do the Cisco ICND 1 module. It will give you the foundation you need to be able to figure this out and you'll be able to handle more things in the future.

Either that or pay someone who knows what they are doing to redesign your network.

 

[Ithanul]

Yeah, trying to explain that stuff is a bit of a pain. Though, first time I ever seen two routers using a switch in between each other then to go through to a internet connection. Unless, is that top switch a layer 3 switch?

Only seen so far where routers talk directly with each other and using switches between each other with all them going back to on master switch that then hooks to a router that routes out to the internet. If it was done that way it probably be easier then to use VLANs. My experience is still small in setup of routing though.

 

[FR@NK]

Is there a reason for the two different IP addresses for the buildings? Seems weird since the buildings are connected to a switch and then to the internet at a single point.

 

[Caring1]

Wow, that seems complicated just to access remote cams.
I'm far from an expert, but if you know the cams I.P. isn't it only a matter of also knowing which port they forward from and entering that in the NVR's software or the I.P. in a browser to access?

 

[Kursah]

Wow, that seems complicated just to access remote cams.
I'm far from an expert, but if you know the cams I.P. isn't it only a matter of also knowing which port they forward from and entering that in the NVR's software or the I.P. in a browser to access?

Agreed. To me it appears we have two LAN subnets that need static routes set on both sides to allow traffic traversal. At least if the diagram is correct from the, what I assume is an L3 switch that both routers are connected to. Gotta dig into the top of the network pyramid here to accomplish that.

This might help though: http://superuser.com/questions/753472/pfsense-to-route-between-multiple-subnets-on-same-lan

In theory if the routers are not connected to the same device you manage for controlling routes, there is an option of WAN-to-WAN routing. Again this depends on the accuracy of the above diagram, but that option would be an IPSEC or OpenVPN tunnel(s), site-to-site. PFSense makes these pretty easy to setup. Not sure what PFSense version you're on, but these should work even with 2.3.x's new UI. VPN tunnels are very easy to setup on a PFSense router, and especially between them, but even if there was a SonicWall or Cisco, etc. it's not too bad to accomplish.

https://blog.monstermuffin.org/create-an-ipsec-site-to-site-tunnel-between-two-pfsense-firewalls/
https://doc.pfsense.org/index.php/OpenVPN_Site_To_Site

Though the issue with VPN tunnels is they can slow down traffic, and depending on the network connection, hardware in the routers, and possible QoS filtering, could cause degraded video quality. But if this traffic must traverse the Internet at all (which it doesn't appear to), I would absolutely be streaming over an encrypted VPN tunnel with AES 256, SHA 256 and RSA2048.

I'd like to know how that switch is setup, if there are active VLAN's if it's acting as a gateway switch to maintain faster VLAN packet routing...if that's the case, a route here may be necessary.
https://community.spiceworks.com/to...-default-gateway-for-vlans-and-layer-3-switch
http://www.cisco.com/c/en/us/suppor...-routing/41860-howto-L3-intervlanrouting.html

I hope some of those links are helpful. Frankly though if your routers don't have routes on the switch if it is in-fact in L3 mode, issues could occur. I have a feeling if you can access the potential L3 router at the top, that would be a good place to start with static routes, inter-VLAN routing, etc. I apologize I'm very tired and meant to comment earlier. I hope my post makes sense where my train of thought has gone for solving this issue. Also are the LAN switches at each site L2 or L3? If L3 is it in L3 mode being utilized or staged in L2 configuration?

 

[Ahhzz]

Thanks for all the replies, esp all at once lol

Yeah, trying to explain that stuff is a bit of a pain. Though, first time I ever seen two routers using a switch in between each other then to go through to a internet connection. Unless, is that top switch a layer 3 switch?

Only seen so far where routers talk directly with each other and using switches between each other with all them going back to on master switch that then hooks to a router that routes out to the internet. If it was done that way it probably be easier then to use VLANs. My experience is still small in setup of routing though.

Is there a reason for the two different IP addresses for the buildings? Seems weird since the buildings are connected to a switch and then to the internet at a single point.

The top switch is there to split the ISP provided connection. There's one connection outside building 2, and the ISP provided 2 IP addresses on the same circuit. The switch allows us to give each company its respective IP address . It's just a basic netgear 5-port Gigabit. The reason there are 2 IPs is because there are 2 companies Building 1 Business owner actually owns both buildings, and wants to provide camera coverage for the whole area, since he owns the buildings. Feels it's his responsibility to maintain security.

Wow, that seems complicated just to access remote cams.
I'm far from an expert, but if you know the cams I.P. isn't it only a matter of also knowing which port they forward from and entering that in the NVR's software or the I.P. in a browser to access?

The problem is that the cameras use port 8000 for remote access, but that's the port forwarded in the router (bldg 1) to allow remote access to the NVR itself, so we can't forward that port from the cameras to the NVR conflicting port traffic .

I've tried to type out an answer for this three times. Each time I find myself starting to talk about broadcast domains and layer 3 networks. Which isn't going to make sense to you.

If you are expected to address this as part of your job. You should really spend some time learning about the basics of networking.

My advice is get a CBT nuggets subscription and do the Cisco ICND 1 module. It will give you the foundation you need to be able to figure this out and you'll be able to handle more things in the future.

Either that or pay someone who knows what they are doing to redesign your network.

I do need to improve my networking skills, even as old as I am. I've just got too many spots where it's weak.


So, I did manage to figure out routing, at least for this mess. I had to tell the router in BLDG 2 that BLDG1 router knows how to find the 188 subnet, and then told BLDG 1` router that the NVR knows how to find the 188 subnet, which worked fine, as far as it went. Telling BLDG 1 how to get to the 254 subnet wasn't much more. The problem occurred when I realized that the NVR couldn't be told how to find the 254 subnet . The NVR is basically a mini-router as well, as evidenced by it talking to the cameras on a 188 subnet, instead of whatever it is attached to on the front end.

What we ended up doing, was pulling a second line from Bldg 1 to Bldg 2. This connection goes from a single port on the back of the NVR to a POE switch in Bldg 2, and from there to the additional 4 cameras covering Bldg 2 and surrounding area. The NVR assigned each camera to an open "virtual" port, with its correct IP, and seems to work great. I think I might have been able to make it work if I could have gotten in the depths of the NVR's OS, but more likely would have opened a new can of "What else don't I know?", and this was a more efficient method.

Anyway, thanks so much for all the help and input, everyone! Appreciate it!