WLAN and LAN Combo (diff subnets)

[bnewtown]

Hi everybody,

i'm new to this forum and after a couple of searches, I decided to start a new thread according to my scenario. Also, english is not my first language but I have a fair enough understanding and sometimes it's just the way I want to express myself (syntax or grammar too) that lacks a little bit Bare with me.

Notice that I found this thread that has been very useful and I want to thank any contributors to it: http://forums.smallnetbuilder.com/showthread.php?t=18652&page=3

Unless the VLAN part, the scenario is almost the same as mine but includes dhcp relay, wireless antennas and remote installation. Let me explain further into it...

I have a small (remote) network site on a basic 192.168.8.x/24 structure. I provided a schema so it will be easier for you to understand it.

Here is the story:

The only way for that site to have internet access at the moment, is coming from a small village at about 15Km from the network site. It's a regular DSL modem with a crap bandwidth. It's connected over ipsec with other networks I manage and it works fine anyways.

So it's coming in the modem and through a FortiGate 60C unit which itself is connected in internal port to a (poe injector) wifi antenna on top of the building. Actually, it is a Motorola microwave tower that points to another in town which points to another in the woods which finally points to the top of a building on site. Yes... we're in 2014 but it works and there are a lot of hills in the area.

I would like to achieve wireless in another subnet with or without using vlans. I simply use a Picostation from ubnt and configured it to be in the 98.x/24 network just like on the schema. I want my dhcp server to handle the scope of that network so I created the scope accordingly.

On my Fortiunit, I created a second IP address for internal network in the 98.x range. It pings well because the route has created automatically in it. Fair enough.. On that interface, I activated the dhcp relay option which points to my dhcp server.

Problem is, i think, when a client attempts to connect to AP1, it does a dhcp request broadcast and the server in the 8 network can't get it because it doesn't have two network cards. So that's why the request must go back to the router and then pops out with the dhcp relay feature. That's common sense.

But i'm wondering if the request drops when comes the time to pass through the towers? The wifi clients cannot properly get an ip address and I want to use it as an AP and not a SOHO Router or something. Maybe I could be considering this but it must work with the dhcp relay on the fortiunit.

Also, the Cisco L3 switch could handle this but i'm not sure how to proceed. I have two VLAN at the moment. 100 for voice and 1 for everything. I would like to seperate the network in the near future but I have to review things a little bit and don't know where to start.

Thank you for your help in advance!

B

 

[abailey]

First, I would recommend a design change if possible. With the current design you have the 192.168.8 broadcast traffic going out over the wireless bridge which eats up bandwidth and airtime. Personally I would put a small router (like a Ubiquiti Edgerouter) at the remote site. If you have no LAN network at the Town location then you could leave everything alone on that side and with your towers and then create a new subnet for your Remote Location. You could also create more subnets and VLANs there if you wanted to for your wireless clients. Then you could have your DHCP run locally off of the router. If you do have a LAN and client devices at the town location I would use a different port on your FortiGate to connect to your antenna. I would put all the Antenna's in their own subnet so that no broadcast traffic from either site traverses the wireless bridge.
If all of this is not possible then you can do what you are trying to do as long as your switches are managed switches. You will need to make trunk ports on any port that needs to carry multiple VLAN's. Define your VLAN's in the switches and either make a virtual interface or use an actual interface on the FortiGate for the 192.168.98 network.

 

[bnewtown]

Thanks for you reply.

Any improvement is possible

With the current design you have the 192.168.8 broadcast traffic going out over the wireless bridge which eats up bandwidth and airtime. Personally I would put a small router (like a Ubiquiti Edgerouter) at the remote site.

I would do the same thing and was exactly thinking about it. The broadcast requests of the network goes all the way down to the village (where there is nothing else than a modem/router - no clients).

I would put all the Antenna's in their own subnet so that no broadcast traffic from either site traverses the wireless bridge.

That's a good point and for troubleshooting purposes, i could use a policy to allow ping internally/externally from VPN to know which tower goes down for power outage or else.

I think i'll go with the solution of bringing my Fortigate at the remote site. Connect the PoE antenna directly in the modem. Change the network for the towers and connect the PoE antenna of the remote site in the forti directly.

No fancy changes but add a second router at the town location for diagnostics from the corporate office.

I guess my clients attempting to connect to the AP in the 98.x network would dhcp request to the forti which is going to relay them to the dhcp server.

Thanks for you ideas. Great help.