Configure VLAN for test network

I have a 3560 Switch connected to a Cisco 2621 router, that router in turn is connected to a PIX-501 on the edge. The current LAN is a 10.0.0.0 subnet and I want to create a test VLAN that is completely seperate (192.168.0.0) from the production LAN. However I want the VLAN to have access to the internet. I was hoping someone could maybe list the commands per device to achieve this?
Bill WarrenIT ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JFrederick29Commented:
Where does the 10.0.0.0 router interface reside? On the 3560 or on the 2621?
0
Bill WarrenIT ManagerAuthor Commented:
See the graphic for the current config
Drawing1.gif
0
JFrederick29Commented:
If you want physical VLAN separation, you can create a second VLAN on the 3560 and enable routing on the 3560.  The 10.10.10.0/24 hosts would have the 3560 as their default gateway and same with the 192.168.0.0/24 subnet.  You can then use access-lists on the 3560 VLAN interfaces to restrict traffic between subnets.  The inside IP of the 2621 would need to be re-addressed and put in a separate VLAN on the 3560.  In fact, if the 2621 isn't taking in any T1's or non-ethernet connections, you could take it completely out of the picture and just use the 3560 and PIX.   The alternative is, trunking between the 3560 and 2621 and having the 2621 route between subnets using subinterfaces.  Which direction do you want to go?
0
Become an IT Security Management Expert

In today’s fast-paced, digitally transformed world of business, the need to protect network data and ensure cloud privacy has never been greater. With a B.S. in Network Operations and Security, you can get the credentials it takes to become an IT security management expert.

Bill WarrenIT ManagerAuthor Commented:
I have to keep the 2621 for netflow on the 10.10.10.0/24 LAN. I could however take a port from the 3560 and plug it directly into the pix bypassing the 2621 for the test vlan only. I definitely want to keep complete seperation. BTW the test VLAN machines wil be coming from a VMWARE esx server if that matters at all in this equation. I have another thread connected to this project on the VMWARE side as well.
http://www.experts-exchange.com/Software/VMWare/Q_23895911.html
0
JFrederick29Commented:
Unfortunately you can't connect into the PIX as the 501 only supports two logical interfaces (inside and outside).

Okay, so what I would do is create a VLAN for the test LAN and enable routing on the 3560.  The 3560 VLAN interface for the Prod and Test VLAN would become the LAN hosts default gateway.  The 3560 would simply need a default route via the 2621 and the 2621 would need 2 routes (default via PIX, and one for the Test LAN).  The PIX needs two routes via the 2621 to the Prod and Test LAN and perhaps NAT config changes.

On the 3560 (I'm assuming you are using VLAN1 for the production LAN):

conf t
vlan 2
name Test
exit

int vlan1
ip add 10.10.10.2 255.255.255.0   <--should already exist
no shut

int vlan2
ip add 192.168.0.1 255.255.255.0
ip access-group test-access in
no shut
exit

ip routing
ip route 0.0.0.0 0.0.0.0 10.10.10.254

ip access-list extended test-access
deny ip any 10.10.10.0 0.0.0.255      <--denies traffic from the Test hosts to the Prod hosts
permti ip any any                               <--allows traffic to the Internet

On the 2621:

ip route 0.0.0.0 0.0.0.0 10.10.9.254  <--should already exist
ip route 192.168.0.0 255.255.255.0 10.10.10.2


On the PIX:

route inside 10.10.10.0 255.255.255.0 10.10.9.230   <--should already exist
route inside 192.168.0.0 255.255.255.0 10.10.9.230
nat (inside) 1 192.168.0.0 255.255.255.0    <--add this if nat (inside) 1 0.0.0.0 0.0.0.0 doesn't exist

Set the Prod hosts default gateway to 10.10.10.2 (the 3560 Prod VLAN interface) and the Test hosts default gateway to 192.168.0.1 (the 3560 Test VLAN Interface).
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
JFrederick29Commented:
Typo in the access-list (permit):

Should be:

ip access-list extended test-access
deny ip any 10.10.10.0 0.0.0.255      <--denies traffic from the Test hosts to the Prod hosts
permit ip any any                               <--allows traffic to the Internet
0
Bill WarrenIT ManagerAuthor Commented:
You Rule man!
0
Bill WarrenIT ManagerAuthor Commented:
Can I start a new question and have you help.... it is related to this one?
0
JFrederick29Commented:
Sure thing.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.