Solved

Forcing certain Vlan Traffic to go via ASA instead of Catalyst Switch

Posted on 2006-11-19
11
905 Views
Last Modified: 2012-08-14
Hi all,

not sure if this is possible but i would like to achieve the following with my stack of Catalyst 3750's and ASA 5520
                 
            vlan 1-5        vlan 6-10
                        \     /
                         asa
                        /     \
         vlan 11-15        vlan 16-20

i want the switches to be the default gateway for each vlan and that routing happens for the 5 vlans it should know, then it should go to the firewall to get to the other vlans

so traffic lets say from vlan 1 to 5 does not go via the asa but from vlan 1 to 10 does

is this possible at all and what should i look at to get this working?

thanks in advance for any suggestions
0
Comment
Question by:dgas_it
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
11 Comments
 
LVL 5

Expert Comment

by:WGhen
ID: 17974925
Since nobody seems to be taking a crack at this let me ask you a question.  Are the 3750's layer 3 routers as well as switches?  Will They function as the gateways for each group of VLANs?  What interior routing protocal are you using (rip, ospf etc.)?

The way you have it diagrammed it looks like four seperate DMZ's comming off the ASA.   If you have the interfaces to build four DMZ's then, yeah you could do it.

If not you could sort of break it up into four areas.  Let's say that all four 3750's are L3 routers.  You create perhaps an ospf area 0 in each to support your vlans from each one.  Then static route from the 2750's to the asa.  By doing that, you have four seperate ospf areas none of which extend to include the asa which becomes the default route for any traffic not bound for each internalthe ospf area.

          _________    __________
         |  vlan 1-5  | |   vlan 6-10 |
         |          \    | |  /              |
         |_______\ _||_/________|
                         asa
          _________   ___________
         |              /| | \                |
         |vlan 11-15| |    vlan 16-20|
         |_________||___________|

Just a couple of ideas
WGhen
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 17975081
Sure, it is possible.
All 3750's are, indeed, layer 3 switches.
You have many options, including putting physical interfaces of the ASA into respective VLAN ports of the switch, trunking all vlans to the ASA, both options allow the ASA to do all the routing between the vlans and is not exactly what you want.
You can also create "transient" vlans and then trunk these transient vlans through the ASA, and use the L3 routing capability of the 3750's to route between whatever vlans you want to, and route through the transient vlan/ASA between the vlans that you want to control/restrict traffic to/from.
If you could explain your configuration and desires a bit more, we might be able to come up with a more direct suggestion. Same question as WGhen has:
 Are these vlan "blocks" each connected to a different ASA interface, or is this one stack of 4 switches, or 4 stacks of switches, or what?
 
0
 

Author Comment

by:dgas_it
ID: 17977592
Thanks for the reply both,

yes each block is a different interface on the ASA and to have all traffic going through the ASA might be a bit much for the ASA and IPS

also i think the setup i mentioned above is the best setup for NAC which needs to be implemented soon

i would like the default gateway being 10.56.x.1 (ip for the vlan) and the interface on the ASA for that vlan to be 10.56.x.254

the problem i have now is that when i ping a vlan that should go through the ASA it goes direct through the switches as the switches see the vlan as directly connected

all servers and routers and some users are on the 3750's, some other users are on the 2950's
there are 6 3750's and 3 2950 in total

is route-maps maybe a way to go? telling the switch that traffic from vlan 2 to vlan 7 should have a next-hop address that is the ASA or tell it to use the static route definned?

any help/suggestion/anything is more then welcome :)

alex
0
Space-Age Communications Transitions to DevOps

ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.

 
LVL 5

Expert Comment

by:WGhen
ID: 17978589
Hi,
Well you don't mention what internal routing protocol you use, however it sounds like your switches know about the other vlans.  You need to arange it so that they don't.  They then must resort to the default gateway, which would be the ASA.  I don't know how much traffic you'll have between your four areas, or how much your asa can handle.  I think it'll be OK, but might add a little latency.  Does the ASA run a routing protocol like rip, eigrp, ospf etc?  If it does, then this might begin to work the way you want just by turning that off.  Make sure that only the 3750 for the 1-5 VLANs has the router interfaces for 1-5 and that none of the other 3750's have 1-5.  The 3750 for 6-10 will have the interfaces for 6-10 but none of the other 3750's will etc. etc.  All you have to do is find a way to make sure that the groups of vlans are not aware of each other and have to take the default route up stream to the ASA who will have static routes to each group.

WGhen
0
 

Author Comment

by:dgas_it
ID: 17979031
Hi WGhen,

no routing protocol at the moment

the switches do know about the other vlans as most are in a stack and separating them cannot really be done

i was hoping that the route-map might be able point them in the right direction

i have had it working where the subinterfaces on the asa was the default gateway

but now i have to implement NAC  

so i thought the above drawing would be a better solution so i place the nac in between the inside (user) vlans and the firewall

cheers

0
 
LVL 5

Expert Comment

by:WGhen
ID: 17979305
OK,
So the 3750's are a stack, essentially making them one switch with one single IP address?
Something puzzles me here.  What addresses are you using for your VLANs?  All VLANs have their own subnet and individual router interface, correct?  If so, the switches should not be allowing direct traffic in the first place without going through the router interface to get between subnets/VLANs.  But that's not what you want.  So, can the asa become the router for those VLANs instead of the 3750?  Or does it just monitor what's going on?

WGhen
0
 

Author Comment

by:dgas_it
ID: 17979607
Hi WGhen,

all vlans have an IP address, this IP address is the default gateway for and device in that vlan

currently if you want to ping any device in any of the other vlans it works as you expect with inter vlan routing

the problem is when you have two vlans in your DMZ you do not want to traffic to bypass the ASA to get to your inside vlans because it uses the inter vlan routing

so what i am trying is to have all vlan traffic which resides in an firewall interface zone (if thats what you can call it) to be able to talk to each other but if it needs to talk to a vlan in a different firewall interface zone that it goes via the ASA

ps the DMZ having 2 vlans is just an example to try and explain it

hope that helps you help me

alex
0
 
LVL 5

Assisted Solution

by:WGhen
WGhen earned 250 total points
ID: 17979707
We use OSPF in our network, so I would try running four different instances of OSPF so there is one for each group of VLANs.  Then point your default route to the ASA.  I'm assuming (oh oh) that the ASA can have static route entries like a PIX can, and therefor forware traffic to the other areas.  That should provide normal routing between VLANs as long as they belong to the same OSPF instance.  If not, they have to go upstream to the ASA.

WGhen
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 18107888
Are you still working on this? Can you close out this question before the cleanup crew gets around to it?
Thanks!
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question