91 lines
3.5 KiB
Markdown
91 lines
3.5 KiB
Markdown
|
|
## 20250721-Meeting
|
|
|
|
- 19.08.2025 Termin fuer Firewall Migration
|
|
|
|
## General
|
|
|
|
- Interfaces need to be defined on each device. They are not synced
|
|
|
|
|
|
## Current Firewall
|
|
|
|
| Name | Ethernet | VLAN | Network | Gateway | DHCP | Comment |
|
|
| -------------- | -------- | ---- | ---------------- | --------------- | --------------------------------- | ------------------- |
|
|
| WAN | eth1 | none | 62.245.142.26/29 | 62.245.142.25 | none | Mnet 500 Mbit Fiber |
|
|
| LAN | eth0 | 1 | 172.22.0.0/22 | 172.22.3.254 | 172.22.0.10 - 172.22.3.199 | |
|
|
| GA | eht2 | 400 | 172.22.4.0/24 | 172.22.4.254 | 172.22.4.100 - 172.22.4.199 | Gebaeudeautomation |
|
|
| DMZ | eth4 | none | 172.22.5.0/24 | 172.22.5.254 | | DMZ? |
|
|
| Homematic | eht2 | 600 | 172.22.6.0/24 | 172.22.6.254 | 172.22.6.100 - 172.22.6.199 | Home? |
|
|
| W-LAN CQSE_VPN | eth2 | 147 | 192.168.147.0/24 | 192.168.147.254 | 192.168.147.100 - 192.168.147.199 | Was |
|
|
| | eht3 | | | | | HA Sync if |
|
|
|
|
## New Firewall
|
|
|
|
|
|
| Name | Ethernet | VLAN | Network | Gateway | DHCP | Comment |
|
|
| -------------- | ------------ | ---- | ------------------- | --------------- | --------------------------------- | ------------------- |
|
|
| WAN | igc1 | none | 62.245.142.26-27/29 | 62.245.142.25 | none | Mnet 500 Mbit Fiber |
|
|
| LAN | igc0 | 1 | 172.22.0.0/22 | 172.22.3.254 | 172.22.0.10 - 172.22.3.199 | |
|
|
| GA | parent: igc2 | 400 | 172.22.4.0/24 | 172.22.4.254 | 172.22.4.100 - 172.22.4.199 | Gebaeudeautomation |
|
|
| DMZ | igc3 | none | 172.22.5.0/24 | 172.22.5.254 | | DMZ? |
|
|
| Homematic | parent: igc2 | 600 | 172.22.6.0/24 | 172.22.6.254 | 172.22.6.100 - 172.22.6.199 | Home? |
|
|
| W-LAN CQSE_VPN | parent: igc2 | 147 | 192.168.147.0/24 | 192.168.147.254 | 192.168.147.100 - 192.168.147.199 | Was |
|
|
| | ax0 | | 10.0.0.0/31 | / | / | HA Sync if |
|
|
|
|
|
|
## WAN
|
|
|
|
- External WAN: 62.245.142.26/29
|
|
- WAN gateway: 62.245.142.25
|
|
- WAN broadcast: 62.245.142.31
|
|
- WAN not-used addresses: 62.245.142.27-30
|
|
|
|
## OPNsense Cluster
|
|
|
|
### Master
|
|
|
|
MGMT: 172.22.3.252/24
|
|
WAN: 62.245.142.28/29
|
|
WANsbx: 10.11.12.2/24
|
|
pfSync: 10.0.0.1/31
|
|
|
|
### Slave
|
|
|
|
MGMT: 172.22.3.253/24
|
|
WAN: 62.245.142.27/29
|
|
WANsbx: 10.11.12.3/24
|
|
pfSync: 10.0.0.2/31
|
|
|
|
### Virtual IP
|
|
|
|
WANsbx IP: 10.11.12.4/24
|
|
WAN IP: 62.245.142.26/29
|
|
LAN IP address: 172.22.3.254/24
|
|
|
|
## Switches
|
|
|
|
### cqse-sw-1og-1.cqse.lan
|
|
|
|
- IP: 172.22.3.200
|
|
- untagged in MGMT VLAN
|
|
- carries 3 VLANs on igc2: GA, Homematic, WLAN-CQSE_VPN
|
|
- Trk1: 49-50 (Sw2Sw Trunk)
|
|
- Port 1: Sophos Node1 eth0
|
|
- Port 2: Sophos Node2 eth0
|
|
- Port 3: Sophos Node1 eth2
|
|
- Port 4: Sophos Node2 eth2
|
|
|
|
### cqse-sw-1og-2.cqse.lan
|
|
|
|
- IP: 172.22.3.201
|
|
- untagged in MGMT VLAN
|
|
- carries 3 VLANs on igc2: GA, Homematic, WLAN-CQSE_VPN
|
|
- Trk1: 49-50 (Sw2Sw Trunk)
|
|
|
|
### cqse-sw-3.cqse.lan
|
|
|
|
- IP: 172.22.5.200
|
|
- All ports in DMZ
|
|
|