Sunday, March 7, 2021

Need help knowing why this static route works

Hello all, I hope everyone is well, considering.

So I am working with a network I inherited at a new job. This network has several vlans and is structured less than optimally, imho. After studying the primary routers config as well as the sonicwall, its odd structure is starting to make sense. I really thought it all made sense to me but encountered an odd issue today.

The sonicwall is configured as follows:

LAN: 192.168.5.25/24 It does not have a default gateway configured for the interface.

WAN: 68.68.68.68/29

DMZ: Transparent Mode with the WAN's IPs. I had never seen this before but was able to understand pretty quickly.

There is an internal router that is the default gateway of all the nodes on the network. Its route table consists of you basic routes to the other networks and VLANs with a default route that points to the sonicwall.

ip route 0.0.0.0 0.0.0.0 192.168.5.25

So if any traffic sent to it isn't one of the other internal networks it gets sent to the sonicwall that sends it out into the ether.

I was cleaning up some routes in the sonicwall because several were there for testing and old network configurations. I deleted the following route from the sonicwall:

Source: Any --- Destination: 192.168.1.1-192.168.255.255 --- Service: Any --- TOS-MASK: Any --- Route:Standard --- Gateway: 192.168.0.60 --- Interface: X0(LAN) --- Metric: 20

So I deleted it because that gateway is on a different subnet than the LAN interface of the sonicwall, right? Like, how can this work? Also the LAN interface doesn't have a default gateway so it should only know how to talk to 192.168.5.0/24 ips.

However, when I deleted it, all the devices on the lan behind the internal router no longer had internet. .60 is a legit addess that the internal router listens on but still, how could the sonicwall talk to it without a default gateway? Even if the interface of the internal router was configed with a 192.168.5.0 and a 192.168.0.0/24 address, it still wouldn't help.

Maybe I am missing something obvious here and ultimately I really just want to understand how it is working. My plan is to test deleting it again to make sure the behavior I saw wasn't coincidence but this is an in-prod network, I will have to test after hours. Also, I thought that if it does cause it to break again, I could put a default gateway on the LAN interface which would be the internal router, and this route won't be necessary anymore. Am I correct with that logic?

I appreciate any input on this, and will provide any info requested.



No comments:

Post a Comment