Communicating between two networks with different subnets and masks
I struggled to find an optimal solution at work, I have this configuration:
Company B (Cisco) -->
- Has webservice on an internal host that I don't need to know it's local IP
- Through Site-To-Site VPN, they provided us with 172.20.1.10 as Peer ID
--> VPN --> Internet -->
Company A (SonicWall UTM)
- Local Peer is 172.40.1.10 (on a new 'X7 interface' and a new 'Zone')
- NAT translates this to host: 192.168.168.50 on network 192.168.168.0/24 with subnet mask 255.255.255.0, everything is great, 192.168.168.50 is able 172.20.1.10 successfully through the NAT and access rules.
The problem is Company A has another internal network 10.0.0.0/8, and I need computer 10.0.10.100 to be able to ping 172.20.1.10.
I have tried setting up a NAT rule as:
- Source original: 10.0.10.100
- Source translated: 172.40.1.10
- Destination original: 172.20.1.10
- Destination translated: original
But it won't ping. I was informed by a colleague that due to different netmasks (/8 instead of /24) and different subnets I need to use a router, I tried playing around with SonicWall Static Routes but I couldn't figure it out. Also, the networks were originally designed in mind to not be able to communicate, so I also added the necessary Any-Any allow rules temporarily for testing but to no avail.
How to solve this problem? Do I need to inform Company B and change my Local Peer network to 172.0.0.0/8? Would this even solve the problem, the subnets are now different even if the netmask is the same? Is there a better way so 10.0.10.100 can ping 172.20.1.10 ? I want to avoid adding another network card and assigning a 172.40.1.xxx to computers on the 10.0.0.0/8 network because that means additional hardware and more wires that need to be drawn out from server rooms.
Thanks for reading.
P.S. This is what happens when companies rely on software developers to figure out stuff that isn't usually their area.
Thank you for reading
networking router vpn subnet netmask
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
add a comment |
I struggled to find an optimal solution at work, I have this configuration:
Company B (Cisco) -->
- Has webservice on an internal host that I don't need to know it's local IP
- Through Site-To-Site VPN, they provided us with 172.20.1.10 as Peer ID
--> VPN --> Internet -->
Company A (SonicWall UTM)
- Local Peer is 172.40.1.10 (on a new 'X7 interface' and a new 'Zone')
- NAT translates this to host: 192.168.168.50 on network 192.168.168.0/24 with subnet mask 255.255.255.0, everything is great, 192.168.168.50 is able 172.20.1.10 successfully through the NAT and access rules.
The problem is Company A has another internal network 10.0.0.0/8, and I need computer 10.0.10.100 to be able to ping 172.20.1.10.
I have tried setting up a NAT rule as:
- Source original: 10.0.10.100
- Source translated: 172.40.1.10
- Destination original: 172.20.1.10
- Destination translated: original
But it won't ping. I was informed by a colleague that due to different netmasks (/8 instead of /24) and different subnets I need to use a router, I tried playing around with SonicWall Static Routes but I couldn't figure it out. Also, the networks were originally designed in mind to not be able to communicate, so I also added the necessary Any-Any allow rules temporarily for testing but to no avail.
How to solve this problem? Do I need to inform Company B and change my Local Peer network to 172.0.0.0/8? Would this even solve the problem, the subnets are now different even if the netmask is the same? Is there a better way so 10.0.10.100 can ping 172.20.1.10 ? I want to avoid adding another network card and assigning a 172.40.1.xxx to computers on the 10.0.0.0/8 network because that means additional hardware and more wires that need to be drawn out from server rooms.
Thanks for reading.
P.S. This is what happens when companies rely on software developers to figure out stuff that isn't usually their area.
Thank you for reading
networking router vpn subnet netmask
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
2
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05
add a comment |
I struggled to find an optimal solution at work, I have this configuration:
Company B (Cisco) -->
- Has webservice on an internal host that I don't need to know it's local IP
- Through Site-To-Site VPN, they provided us with 172.20.1.10 as Peer ID
--> VPN --> Internet -->
Company A (SonicWall UTM)
- Local Peer is 172.40.1.10 (on a new 'X7 interface' and a new 'Zone')
- NAT translates this to host: 192.168.168.50 on network 192.168.168.0/24 with subnet mask 255.255.255.0, everything is great, 192.168.168.50 is able 172.20.1.10 successfully through the NAT and access rules.
The problem is Company A has another internal network 10.0.0.0/8, and I need computer 10.0.10.100 to be able to ping 172.20.1.10.
I have tried setting up a NAT rule as:
- Source original: 10.0.10.100
- Source translated: 172.40.1.10
- Destination original: 172.20.1.10
- Destination translated: original
But it won't ping. I was informed by a colleague that due to different netmasks (/8 instead of /24) and different subnets I need to use a router, I tried playing around with SonicWall Static Routes but I couldn't figure it out. Also, the networks were originally designed in mind to not be able to communicate, so I also added the necessary Any-Any allow rules temporarily for testing but to no avail.
How to solve this problem? Do I need to inform Company B and change my Local Peer network to 172.0.0.0/8? Would this even solve the problem, the subnets are now different even if the netmask is the same? Is there a better way so 10.0.10.100 can ping 172.20.1.10 ? I want to avoid adding another network card and assigning a 172.40.1.xxx to computers on the 10.0.0.0/8 network because that means additional hardware and more wires that need to be drawn out from server rooms.
Thanks for reading.
P.S. This is what happens when companies rely on software developers to figure out stuff that isn't usually their area.
Thank you for reading
networking router vpn subnet netmask
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
I struggled to find an optimal solution at work, I have this configuration:
Company B (Cisco) -->
- Has webservice on an internal host that I don't need to know it's local IP
- Through Site-To-Site VPN, they provided us with 172.20.1.10 as Peer ID
--> VPN --> Internet -->
Company A (SonicWall UTM)
- Local Peer is 172.40.1.10 (on a new 'X7 interface' and a new 'Zone')
- NAT translates this to host: 192.168.168.50 on network 192.168.168.0/24 with subnet mask 255.255.255.0, everything is great, 192.168.168.50 is able 172.20.1.10 successfully through the NAT and access rules.
The problem is Company A has another internal network 10.0.0.0/8, and I need computer 10.0.10.100 to be able to ping 172.20.1.10.
I have tried setting up a NAT rule as:
- Source original: 10.0.10.100
- Source translated: 172.40.1.10
- Destination original: 172.20.1.10
- Destination translated: original
But it won't ping. I was informed by a colleague that due to different netmasks (/8 instead of /24) and different subnets I need to use a router, I tried playing around with SonicWall Static Routes but I couldn't figure it out. Also, the networks were originally designed in mind to not be able to communicate, so I also added the necessary Any-Any allow rules temporarily for testing but to no avail.
How to solve this problem? Do I need to inform Company B and change my Local Peer network to 172.0.0.0/8? Would this even solve the problem, the subnets are now different even if the netmask is the same? Is there a better way so 10.0.10.100 can ping 172.20.1.10 ? I want to avoid adding another network card and assigning a 172.40.1.xxx to computers on the 10.0.0.0/8 network because that means additional hardware and more wires that need to be drawn out from server rooms.
Thanks for reading.
P.S. This is what happens when companies rely on software developers to figure out stuff that isn't usually their area.
Thank you for reading
networking router vpn subnet netmask
networking router vpn subnet netmask
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
asked Feb 21 at 16:51
monkaNetworkmonkaNetwork
1
1
2
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05
add a comment |
2
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05
2
2
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1408225%2fcommunicating-between-two-networks-with-different-subnets-and-masks%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1408225%2fcommunicating-between-two-networks-with-different-subnets-and-masks%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
“This is what happens when companies rely on software developers...” no offense, but if there is no one qualified to work on this problem then why isn’t the company looking for someone who is? Is it really that big of a deal to talk with a professional who can help? With that said, there are many places where the problem might be and, terminology aside, this post is confusing and the complexity requires an entire conversation to even begin troubleshooting the problem. You need someone who is qualified to look at your network and ask the right questions.
– Appleoddity
Feb 21 at 18:05