Solved

Routing VLANs to different firewalls on a catalyst 3750

Posted on 2008-10-15
4
1,365 Views
Last Modified: 2012-05-05
My network core is a Catalyst 3750 (SMI) using a series of VLANs.  We have a pair of firewalls going to two different ISPs.  Right now, the 3750 is the default route for all hosts and then the primary PIX is the default route for the 3750.  I'd like to set one VLAN to use the secondary firewall as its default route instead of the PIX, but without having to change the local routes on the hosts.  

Here is my network:
VLAN1  - 192.168.1.0
VLAN2 - 192.168.2.0
VLAN3 - 192.168.3.0

Core Switch - 192.168.1.254
Primary PIX - 192.168.1.253  (primary ISP)
Secondary firewall - 192.168.1.252

I'd like 192.168.1.253 to still be the primary default route, but allow some VLANs to point to 192.168.1.252

I tried this so far:

ip access-list extended failovert1
permit tcp 192.168.2.0 0.0.0.255 any

route-map verizont1 permit 10
match ip address failovert1
set ip next-hop 192.168.1.252

interface vlan 2
 ip policy route-map verizont1


But, it doesn't work, all VLAN2 traffic still goes out the primary link.  What did I miss?
0
Comment
Question by:mlederman
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 22724981
Did you change the SDM template to "desktop routing".  Use "show sdm prefer" to see what template is in use.  PBR requires the routing template.

conf t
sdm prefer routing  <--requires a reboot

Also, the set command should be "set ip default next-hop 192.168.1.252".
0
 

Author Comment

by:mlederman
ID: 22725460
SDM template is "desktop default".  Is that the same thing?
If its not, how will that affect the rest of the switch operations, including VOIP?

I fixed the line to be "set ip default next-hop 192.168.1.252" and no luck.  I did notice that the VLAN config on a sh run doesn't indicate the route-map policy at all.
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 22726101
I think you have to have EMI to enable PBR per-vlan
EMI has been renamed "ipservices"
SMI has been renamed "ipbase"

From the 3750 documentation:
>To use PBR, you must have the IP services image installed on the stack master.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_44_se/configuration/guide/swiprout.html#wp1228588

0
 
LVL 43

Expert Comment

by:JFrederick29
ID: 22726985
Pretty sure the SDM template also needs to be "desktop routing".  At least it does for a 3560 switch.

conf t
sdm prefer routing   <--reload after chaning this setting

The SDM template simply allocates more memory to routing so it shouldn't negatively affect your VoIP.  Worst case, change it back to "desktop default" if you experience any issues (sdm prefer desktop).
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question