Router Mode

[ahenning]

This post may be outdated. Please refer to the Router Mode



Support:
The Router mode feature can be enabled and configure in Express, but support is only available for Plus since routing, policy based routing, gateways and high availability can get complicated and unique to each case.

Overview:
In router mode, only the wan0 interface is used. In this mode Wanos supports two or more ip addresses on the same interface. Primary wan0, Secondary virtual lan0. Both addresses bind to the wan0 interface.

Traffic from the wan is directed to the standard wan0 ip address.
Traffic from the lan is directed to the virtual lan0 ip address.

All sites can be in router mode or a mix of router mode and bridge mode.


Typical Configuration:

This address may overlap with wan0. In most cases, this is all that needs to be configured on Wanos. Other than this setting, the network needs to be configured to direct the traffic to these two addresses. Use routing, policy based routing or default gateways to direct traffic to the correct addresses.

To verify that the virtual lan0 is active, ping the address from the network e.g. from server or router. Remember to enable promiscuous / mac spoofing or equivalent.

Stop here for the initial configuration. "VIRT_LAN0" is the only Wanos config required.



Advance setup with multiple subnets:
Optional* Multiple secondary lan0 networks are also supported, if the workstations will direct their default gateways directly to the virtual gateways configured on Wanos. To configure these multiple additional virtual lan0 networks, these extra networks can be added to /tce/etc/wanos/virtual_lan.
e.g:
10.1.1.1/24
10.2.2.1/24
10.3.3.1/24
All these networks will be available as secondary virtual ip addresses to be used as gateways for the workstations or servers.





Examples:
In the diagram the Wan Accelerator is deployed out of path at the main site. Traffic from the wan is directed to the wan0 address 10.0.0.2. Traffic from the lan that needs to be optimized is directed to the virtual lan address 10.0.0.1




Example 2:
In the following diagram the data center wan accelerator primary address shares a segment with the gateway router. Traffic from the wan is directed to the wan0 address 10.0.0.2. Devices on the lan have their default gateways set to be the wan accelerator virtual lan addresses 10.1.1.1 and 10.2.2.1. High availability is possible by configuring secondary routes.



Verification
While pinging a host at the remote site. tcpdump should produce the following output on wan0:

sudo tcpdump -i wan0 host x.x.x.x

Both the icmp echo and echo replies are seen in the output. Noting only echos and no replies, or only replies and no echos indicates that routing or default gateway or PBR needs to be reviewed.

[ahenning]

Maybe this email will help one or two with the configuring router mode:


In bridge mode (Layer2), the inside and outside interfaces indicate the source of the traffic. In router mode (Layer3) , we use the same principle, but use two IP addresses on the same interface. In router mode, only the wan0 physical interface is used. Both inside and outside addresses bind to this interface.

To enable router mode, the lan0 virtual ip address is configured by editing the config file with IP Address and mask e.g. 192.168.1.254/24 :
vi /tce/etc/wanos/wanos.conf
VIRT_LAN0=172.16.1.201/24
To exit vi press:
<esc> :wq

A soft reset from the gui would be needed to apply the change. After the soft reset the virtual IP address will be accessible on the wan0 interface along with the primary address. Using source based routing traffic from the lan can be directed to the lan0 virtual ip address. Traffic from the Wan can be redirected to the primary wan0 address.

The secondary ip address can be on the same range as the primary e.g.:
Wan0 = 172.16.1.200
Lan0 = 172.16.1.201

[ahenning]

Another PBR example.

The router has an IP address of 10.0.0.254. Wanos has 10.0.0.1 for wan0 and secondary virtual address 10.0.0.2. Both bind on the physical wan0.
Here the router is used to channel IP traffic from the WAN interface to 10.0.0.1.
The router has a second policy to channel IP traffic from the lan servers to 10.0.0.2.




The Wanos addresses can be tracked to disable the policy redirect.

Remember to not enable PBR on the same router (sub-)interface that Wanos is connected to, else traffic from Wanos will be redirected to itself.

Since Router mode requires routing on the network, it is recommended to use the simple bridge mode where possible.

[pippipmilk]

I'm not sure my network chops are up to this question.

I can understand why max spoofing needs to be enabled in the L2 setup, but why does mac spoofing need to be enabled if you are using the two IPs of the WANOS as default gateways?

[ahenning]

Router mode uses a lan0 sub-interface, which uses a separate MAC address. This is used to split the traffic between lan and wan on the same physical interface and hence usually less strict MAC settings are needed.

That said 2.6.2 is in the works that includes a tunnel mode for the optimized traffic and requires only a single IP and MAC. To use tunnel mode only the LAN side machines needs to point their gateways towards Wanos. This will ease the routing requirements where it may be difficult to achieve e.g. hosted space.