troubleshooting Question

Cisco Switch 3560 Configuration Question

Avatar of ejaramillo
ejaramillo asked on
RoutersSwitches / HubsNetwork Management
9 Comments3 Solutions4153 ViewsLast Modified:
Hello All-

I currently have a content filter (St. Bernard's Iprism) outside my firewall with a public IP address. My goal is to put the iprism inside my firewall with a private address so I can connect it to my DC and have users authenticate to the iprism. Currently thats not possible because it sits outside my firewall. Here is my current network layout:

Cisco 3660 (www)
      |
      |
Content Filter (Iprism)
      |
      |
Firewall (Fortigate Appliance) Also does my Natting, VLANs, ACLs
      |
      |
MDF (Alcatel 5022)


I purchased a Cisco Switch 3560 which has layer 3 capabilities to place in between the MDF and Firewall. So it would now look like:

Cisco 3660
      |
Firewall
      |
Content Filter
      |
Cisco 3560 Switch
      |
MDF


Here is the config (with different IP addresses) I tried on the switch but couldnt get it to work


Building configuration...

Current configuration : 2947 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable secret 5
!
no aaa new-model
ip subnet-zero
!
!
password encryption aes
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1 (connected to internal port on iprism with crossover)
 switchport access vlan 9
 switchport mode access
!
interface FastEthernet0/2
 switchport access vlan 2
 switchport mode access
!
interface FastEthernet0/3
 switchport access vlan 8
 switchport mode access
!
interface FastEthernet0/4
 switchport mode access
!


!
interface Vlan1
 ip address 10.x.40.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface Vlan2
 ip address 10.x.24.254 255.255.255.0
 ip helper-address 10.x.24.101
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface Vlan8
 ip address 10.x.30.254 255.255.255.0
 ip helper-address 10.x.30.5
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
interface Vlan9
 ip address 10.x.50.254 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.x.50.2
ip http server
!

!

!
!
control-plane
!
!
!
end




So basically interface 0/1 on the switch is plugged into internal port of the iprism. The iprism external port is plugged into a port on the fortigate (Firewall). All of these ports are on the same subnet (10.x.50.0).

When I plugged back into my network everything seemed to work fine. I could ping my DCs. I could ping my gateway. I could ping fe 0/1, but I couldnt ping the Iprism or the fortigate. I also couldnt ping anything on VLAN 8 or visa versa depending on witch VLAN I was plugged into. I tried using ACLs to permit all traffic into the interfaces for testing purposes and still nothing. But when consoled into the Cisco switch I could ping everyone. Servers on both VLANs, the Iprism and the fortigate.

Sorry if I left anything out. I appreciate any help and feedback.  Thanks in advance!!
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 3 Answers and 9 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 3 Answers and 9 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros