Can't split GREEN zone using VLANs

[Guest]

[ixe013]

This is a fairly frequent question, but I have read every post about it and still can't figure it out.

I have Endian Community 3.0 running in my lab. I use it to reproduce a larger deployment for testing purposes. I start with 3 machines on the GREEN interface, static ip. They can connect to the Internet and I have set up rules that allow me to ssh from the RED interface to them. I have also set up access to Endian's GUI and SSH via the RED interface before, so I am not locked out.

Now I want to split the GREEN. I would like to add 192.168.1.0/24 and 192.168.2.0/24 to the existing 192.168.0.15/24. Any IP/CIDR will do, as long as they are separate.

So I created two VLANs, ran the network configuration Wizard, selected the VLAN as part of the green interface. Now machines that were on the GREEN interface can't connect to anything, not even Endian itself (192.168.0.15:10443 for example).


What steps am I missing that will allow me to have multiple vlans in the GREEN zone?

Here is the output in Status>Network status

Code:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 brd 127.255.255.255 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 08:00:27:56:d6:9b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::a00:27ff:fe56:d69b/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
    link/ether 08:00:27:aa:31:e8 brd ff:ff:ff:ff:ff:ff
    inet 10.162.15.110/25 brd 10.162.15.127 scope global eth1
32: eth0.2000@eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 08:00:27:56:d6:9b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::a00:27ff:fe56:d69b/64 scope link 
       valid_lft forever preferred_lft forever
33: eth0.1000@eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 08:00:27:56:d6:9b brd ff:ff:ff:ff:ff:ff
    inet6 fe80::a00:27ff:fe56:d69b/64 scope link 
       valid_lft forever preferred_lft forever
3336: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 08:00:27:56:d6:9b brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.15/24 brd 192.168.0.255 scope global br0

[kieronrob]

Hi,

Please give this a try and post if it works:

http://help.endian.com/entries/25391848-How-to-split-a-zone-in-sub-zones

[ixe013]

I wanted to try it, but I can't get past the requirement "Two or more subnets configured to the same zone (ex. 10.0.1.0/24 and 10.0.2.0/24 for GREEN Zone)".

Configuring subnets to the same zone is what I am trying to acheive. Isolation will come later. I have created vlan's but it is like no IP/CIDR are assigned to them. For starters, I would be happy if any host on any vlan would be able to ping the firewall...

[kieronrob]

Hi,

Use the "network configuration" wizard under the system tab to add subnets on the green interface.

[TheEricHarris]

I have a layer 3 switch that handles the routing for my vlans.   I just create a route for each vlan in Endian and point it to my l3 switch.

[soldolphin]

Hi, ixe013!
I have same problem.
My lab has three subnets, but i can't split their ranges.
Did you resolve it?

[TheEricHarris]

Do yourself a favor,  use Sophos or pfsense.   This project is dead.

[mmiat]

attention: subnets and vlans are different concepts and different technologies

[ixe013]

Thanks everybody, but I needed more help, the step-by-step with screen shots. I had already tried to "Use the network wizard" before posting. I acheived what I wanted to do with pfsense.