Solved

Routing VLANs to different firewalls on a catalyst 3750

Posted on 2008-10-15
4
1,360 Views
Last Modified: 2012-05-05
My network core is a Catalyst 3750 (SMI) using a series of VLANs.  We have a pair of firewalls going to two different ISPs.  Right now, the 3750 is the default route for all hosts and then the primary PIX is the default route for the 3750.  I'd like to set one VLAN to use the secondary firewall as its default route instead of the PIX, but without having to change the local routes on the hosts.  

Here is my network:
VLAN1  - 192.168.1.0
VLAN2 - 192.168.2.0
VLAN3 - 192.168.3.0

Core Switch - 192.168.1.254
Primary PIX - 192.168.1.253  (primary ISP)
Secondary firewall - 192.168.1.252

I'd like 192.168.1.253 to still be the primary default route, but allow some VLANs to point to 192.168.1.252

I tried this so far:

ip access-list extended failovert1
permit tcp 192.168.2.0 0.0.0.255 any

route-map verizont1 permit 10
match ip address failovert1
set ip next-hop 192.168.1.252

interface vlan 2
 ip policy route-map verizont1


But, it doesn't work, all VLAN2 traffic still goes out the primary link.  What did I miss?
0
Comment
Question by:mlederman
  • 2
4 Comments
 
LVL 43

Expert Comment

by:JFrederick29
Comment Utility
Did you change the SDM template to "desktop routing".  Use "show sdm prefer" to see what template is in use.  PBR requires the routing template.

conf t
sdm prefer routing  <--requires a reboot

Also, the set command should be "set ip default next-hop 192.168.1.252".
0
 

Author Comment

by:mlederman
Comment Utility
SDM template is "desktop default".  Is that the same thing?
If its not, how will that affect the rest of the switch operations, including VOIP?

I fixed the line to be "set ip default next-hop 192.168.1.252" and no luck.  I did notice that the VLAN config on a sh run doesn't indicate the route-map policy at all.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
Comment Utility
I think you have to have EMI to enable PBR per-vlan
EMI has been renamed "ipservices"
SMI has been renamed "ipbase"

From the 3750 documentation:
>To use PBR, you must have the IP services image installed on the stack master.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_44_se/configuration/guide/swiprout.html#wp1228588

0
 
LVL 43

Expert Comment

by:JFrederick29
Comment Utility
Pretty sure the SDM template also needs to be "desktop routing".  At least it does for a 3560 switch.

conf t
sdm prefer routing   <--reload after chaning this setting

The SDM template simply allocates more memory to routing so it shouldn't negatively affect your VoIP.  Worst case, change it back to "desktop default" if you experience any issues (sdm prefer desktop).
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

New Server 172.16.200.2  was moved from behind Router R2 f0/1 to behind router R1 int f/01 and has now address 172.16.100.2. But we want users still to be able to connected to it by old IP. How to do it ? We can used destination NAT (DNAT).  In DNAT…
We've been using the Cisco/Linksys RV042 for years as: - an internet Gateway - a site-to-site VPN device - a leased line site-to-site subnet-to-subnet interface (And, here I'm assuming that any RV0xx behaves the same way as an RV042.  So that's …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now