A tough question

hugeload · Post by **hugeload** » Mon Mar 30, 2015 8:00 am

Hey guys, I got a question from my teammate regarding to a networking question from a test, as I'm an infra guy so not helps, hope somebody would be interested in, thanks in advance!

You have a set of boxes configured with network addresses in the 10.1.5.0/24 range, the default gateway
supplied to you is 10.1.1.15 and you have set this as the default gateway for the boxes. After the boxes are
installed in the customers network they are not appearing on the server that they should be. You are
supplied with the following log snippet from the customers network administrator and you are unable to
connect to the boxes:

6|May 16 2011|08:16:38|302013|85.158.143.3|29280|10.1.1.14|25|Built inbound TCP connection 6133363 for outside:85.158.143.3/29280
(85.158.143.3/29280) to inside:10.1.1.14/25 (62.173.121.212/25)
6|May 16 2011|08:16:38|302016|8.8.8.8|53|10.1.5.12|37140|Teardown UDP connection 6133362 for outside:8.8.8.8/53 to inside:10.1.5.12/37140
duration 0:00:00 bytes 108
6|May 16 2011|08:16:39|302014|85.158.143.3|29280|10.1.1.14|25|Teardown TCP connection 6133363 for outside:85.158.143.3/29280 to
inside:10.1.1.14/25 duration 0:00:00 bytes 17524 TCP FINs
6|May 16 2011|08:16:39|302015|8.8.4.4|53|10.1.5.13|36809|Built outbound UDP connection 6133364 for outside:8.8.4.4/53 (8.8.4.4/53) to
inside:10.1.5.13/36809 (62.173.121.210/36040)
6|May 16 2011|08:16:39|110003|8.8.4.4|53|10.1.5.13|36809|Routing failed to locate next hop for UDP from outside:8.8.4.4/53 to
inside:10.1.5.13/36809
6|May 16 2011|08:16:39|305012|10.1.5.16|35940|62.173.121.210|44535|Teardown dynamic UDP translation from inside:10.1.5.16/35940 to
outside:62.173.121.210/44535 duration 0:00:30
6|May 16 2011|08:16:40|302016|8.8.4.4|53|10.1.5.13|36809|Teardown UDP connection 6133364 for outside:8.8.4.4/53 to inside:10.1.5.13/36809
duration 0:00:00 bytes 164

At this point, the boxes that you have configured are a few hundred miles away from you, and you have
no access to a VPN or other means to be able to login to the boxes you have configured, the only data
available is the firewall log as provided by the customers network administrator.

Q1.a From this can you tell what the issue with the networking is?
Q2.b Is it a problem with our configuration?
Q3.c Is it a problem on the customers network?
Q4.d What would the next steps be?

Post by **Philip** » Thu Apr 02, 2015 9:31 am

10.1.5.0/24 (netmask 255.255.255.0) IP range is: 10.1.5.1 - 10.1.5.254
i.e. range only allows for 254 IPs, the gateway IP is not in that range

It should be configured something like this:
10.1.5.0/21 (netmask 255.255.248.0) range: 10.1.0.1 - 10.1.7.254

That way the gateway/default route (10.1.1.15) is on the same subnet, within the same IP range

Check out this subnetting table: http://www.speedguide.net/articles/subn ... asses-1883