Connection to external network via management network. Possible?

[routingpackets]

Hi, this is the only way I found to try to check if this is something possible with netlab. I have netlab running on an esxi server that is on a private network 10.123.123.0/24. This network does not have DHCP enabled and the gateway 10.123.123.1 is already configured on an external router and I can only access it through a VPN. The idea of the lab is to have the mgmt interfaces get an IP from 10.123.123.0/24 and pointing to a different IP on the netlab vm within esxi that would bridge this traffic to 10.123.123.1, so I can access remotely. I tried several things, I could already change the mgmt subnet and it will pull an IP from 10.123.123.0/24, but then netlab configures the 10.123.123.1 on the esxi netlab vm and this conflcts with the external router 10.123.123.1/24. Maybe this is already possible but I am not doing it right and maybe missing something in my topology file =/

I need to have the management interfaces accessible from outside.

`provider: clab
defaults:
device: iol
devices.iol.clab.image: vrnetlab/cisco_iol:17-16-01a
devices.linux.clab.image: ghcr.io/srl-labs/network-multitool

addressing:
mgmt:
ipv4: 10.122.17.0/23
start: 221

nodes:
rc1:
device: iol
rc2:
device: iol
rc3:
device: iol
rc4:
device: iol
pc1:
device: linux
pc2:
device: linux
pc3:
device: linux
pc4:
device: linux

links:

• rc1-rc2
• rc1-rc3
• rc2-rc4
• rc3-rc4
• rc1-pc1
• rc2-pc2
• rc3-pc3
• rc4-pc4`

Thanks in advance!

[ssasso]

Hi, you can use a smaller subnet for your netlab management network (i.e., 10.123.123.128/25), and enable proxy arp on the interface facing the 10.123.123/24 network.

[routingpackets]

Hi, thanks for chiming in...I will give this a shot, nice idea by the way. Where do I enable proxy arp? On the IOL devices or in the topology file? One additional question, is this mgmt network bridged to the outside?
Thanks much!

[ssasso]

Proxy arp needs to be enabled on the external interface of your Linux host running netlab.

The network is routed, but the proxy arp hack can be used to "simulate" that the internal network is in the same segment of the external one.

I suggest you to have a look at what proxy ARP is and how it works: https://www.practicalnetworking.net/series/arp/proxy-arp/

[routingpackets]

Awesome @ssasso, thank you so much for the reference, I just tested it in my environment and it works like a charm. thanks for pointing me into the right direction with the hack, I appreacite it!

[ipspace]

@ssasso -- Awesome idea. Should have thought of that a long time ago.

@routingpackets -- it would be great if you could publish the bits of the topology file and proxy arp setup. I would love to add it as an example to the documentation, and while I know (approximately) how to reproduce it, it's way easier if I get a working solution ;))