Re: one iSeries ethernet card and two routers -- MIDRANGE-L

There is an important detail when using two default routes, priority must be set to 8 or higher.

Chris Bipes wrote:

The problem with having two default routes is, if traffic comes in route A
and you cannot tell, which route do you respond through.  You end up with a
circular route.  That is where traffic comes in A and is responded through
B.  By running some sort of router protocol such as BGP you can fix this.
Your best bet is to inbound NAT on one router with a route to that subnet
thru the NAT router.  Everything else uses the other router as the default
route.
I would get professional consultant in to help you define your network
routing protocols.
-----Original Message----- From: Jim Franz [mailto:franz400@xxxxxxxxxxxx] Sent: Sunday, May 01, 2005 9:51 PM To: MIDRANGE-L@xxxxxxxxxxxx Subject: one iSeries ethernet card and two routers

(continued from dsl dilemna thread) I think my problem is that I defined 2 *dftroutes and have the 2 routers in same lan segment: a dsl router for vpn access for remote iSeries users, and a T1 router/firewall for iSeries webserver & pc internet traffic, email, etc. iSeries with 1 ethernet card 10.10.10.10 subnet 255.0.0.0 and a public ip 70.x.x.x for web traffic (firewall only allows port 80 thru to iSeries). dsl router 10.10.10.11 (all users thru vpn assigned a 172.x.x.x private address) T1 router 10.10.10.12 I have a *dftroute to each router. This has never worked. For a while webserver worked fine, but dsl did not. Telco changed dsl config & now it works but then webserver unreachable from web. iSeries can ping both routers on the lan. It seems confused by 2 default routes.

If having 2 routers, do they need to be on different lan segments? Will this work? (idea from a thread in Aug 2001) - iSeries 10.10.10.10 subnet 255.255.255.0 and also 10.10.1.10 subnet 255.255.255.0 dsl router 10.10.10.11 (same as before) T1 router 10.10.1.12 (and forwarding web traffic to 10.10.1.10) (changing this router to x.x.1.x) *dftroute *none 10.10.10.11 *dftroute *none 10.10.1.12 There is nothing unique about remote address of vpn users thru dsl, or web traffic users thru T1. Is iSeries smart enough to know which dftroute to return on (because it's not doing it now...) Is this such an odd setup? btw - even though current subnet is 10.0.0.0 - only 10.10.10.x addresses have been assigned in this network, either fixed or thru dhcp.