Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1375
  • Last Modified:

Routing VLANs to different firewalls on a catalyst 3750

My network core is a Catalyst 3750 (SMI) using a series of VLANs.  We have a pair of firewalls going to two different ISPs.  Right now, the 3750 is the default route for all hosts and then the primary PIX is the default route for the 3750.  I'd like to set one VLAN to use the secondary firewall as its default route instead of the PIX, but without having to change the local routes on the hosts.  

Here is my network:
VLAN1  - 192.168.1.0
VLAN2 - 192.168.2.0
VLAN3 - 192.168.3.0

Core Switch - 192.168.1.254
Primary PIX - 192.168.1.253  (primary ISP)
Secondary firewall - 192.168.1.252

I'd like 192.168.1.253 to still be the primary default route, but allow some VLANs to point to 192.168.1.252

I tried this so far:

ip access-list extended failovert1
permit tcp 192.168.2.0 0.0.0.255 any

route-map verizont1 permit 10
match ip address failovert1
set ip next-hop 192.168.1.252

interface vlan 2
 ip policy route-map verizont1


But, it doesn't work, all VLAN2 traffic still goes out the primary link.  What did I miss?
0
mlederman
Asked:
mlederman
  • 2
1 Solution
 
JFrederick29Commented:
Did you change the SDM template to "desktop routing".  Use "show sdm prefer" to see what template is in use.  PBR requires the routing template.

conf t
sdm prefer routing  <--requires a reboot

Also, the set command should be "set ip default next-hop 192.168.1.252".
0
 
mledermanAuthor Commented:
SDM template is "desktop default".  Is that the same thing?
If its not, how will that affect the rest of the switch operations, including VOIP?

I fixed the line to be "set ip default next-hop 192.168.1.252" and no luck.  I did notice that the VLAN config on a sh run doesn't indicate the route-map policy at all.
0
 
lrmooreCommented:
I think you have to have EMI to enable PBR per-vlan
EMI has been renamed "ipservices"
SMI has been renamed "ipbase"

From the 3750 documentation:
>To use PBR, you must have the IP services image installed on the stack master.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_44_se/configuration/guide/swiprout.html#wp1228588

0
 
JFrederick29Commented:
Pretty sure the SDM template also needs to be "desktop routing".  At least it does for a 3560 switch.

conf t
sdm prefer routing   <--reload after chaning this setting

The SDM template simply allocates more memory to routing so it shouldn't negatively affect your VoIP.  Worst case, change it back to "desktop default" if you experience any issues (sdm prefer desktop).
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now