• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 760
  • Last Modified:

Configure VLAN for test network

I have a 3560 Switch connected to a Cisco 2621 router, that router in turn is connected to a PIX-501 on the edge. The current LAN is a 10.0.0.0 subnet and I want to create a test VLAN that is completely seperate (192.168.0.0) from the production LAN. However I want the VLAN to have access to the internet. I was hoping someone could maybe list the commands per device to achieve this?
0
Bill Warren
Asked:
Bill Warren
  • 5
  • 5
1 Solution
 
JFrederick29Commented:
Where does the 10.0.0.0 router interface reside? On the 3560 or on the 2621?
0
 
Bill WarrenIT ManagerAuthor Commented:
See the graphic for the current config
Drawing1.gif
0
 
JFrederick29Commented:
If you want physical VLAN separation, you can create a second VLAN on the 3560 and enable routing on the 3560.  The 10.10.10.0/24 hosts would have the 3560 as their default gateway and same with the 192.168.0.0/24 subnet.  You can then use access-lists on the 3560 VLAN interfaces to restrict traffic between subnets.  The inside IP of the 2621 would need to be re-addressed and put in a separate VLAN on the 3560.  In fact, if the 2621 isn't taking in any T1's or non-ethernet connections, you could take it completely out of the picture and just use the 3560 and PIX.   The alternative is, trunking between the 3560 and 2621 and having the 2621 route between subnets using subinterfaces.  Which direction do you want to go?
0
Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

 
Bill WarrenIT ManagerAuthor Commented:
I have to keep the 2621 for netflow on the 10.10.10.0/24 LAN. I could however take a port from the 3560 and plug it directly into the pix bypassing the 2621 for the test vlan only. I definitely want to keep complete seperation. BTW the test VLAN machines wil be coming from a VMWARE esx server if that matters at all in this equation. I have another thread connected to this project on the VMWARE side as well.
http://www.experts-exchange.com/Software/VMWare/Q_23895911.html
0
 
JFrederick29Commented:
Unfortunately you can't connect into the PIX as the 501 only supports two logical interfaces (inside and outside).

Okay, so what I would do is create a VLAN for the test LAN and enable routing on the 3560.  The 3560 VLAN interface for the Prod and Test VLAN would become the LAN hosts default gateway.  The 3560 would simply need a default route via the 2621 and the 2621 would need 2 routes (default via PIX, and one for the Test LAN).  The PIX needs two routes via the 2621 to the Prod and Test LAN and perhaps NAT config changes.

On the 3560 (I'm assuming you are using VLAN1 for the production LAN):

conf t
vlan 2
name Test
exit

int vlan1
ip add 10.10.10.2 255.255.255.0   <--should already exist
no shut

int vlan2
ip add 192.168.0.1 255.255.255.0
ip access-group test-access in
no shut
exit

ip routing
ip route 0.0.0.0 0.0.0.0 10.10.10.254

ip access-list extended test-access
deny ip any 10.10.10.0 0.0.0.255      <--denies traffic from the Test hosts to the Prod hosts
permti ip any any                               <--allows traffic to the Internet

On the 2621:

ip route 0.0.0.0 0.0.0.0 10.10.9.254  <--should already exist
ip route 192.168.0.0 255.255.255.0 10.10.10.2


On the PIX:

route inside 10.10.10.0 255.255.255.0 10.10.9.230   <--should already exist
route inside 192.168.0.0 255.255.255.0 10.10.9.230
nat (inside) 1 192.168.0.0 255.255.255.0    <--add this if nat (inside) 1 0.0.0.0 0.0.0.0 doesn't exist

Set the Prod hosts default gateway to 10.10.10.2 (the 3560 Prod VLAN interface) and the Test hosts default gateway to 192.168.0.1 (the 3560 Test VLAN Interface).
0
 
JFrederick29Commented:
Typo in the access-list (permit):

Should be:

ip access-list extended test-access
deny ip any 10.10.10.0 0.0.0.255      <--denies traffic from the Test hosts to the Prod hosts
permit ip any any                               <--allows traffic to the Internet
0
 
Bill WarrenIT ManagerAuthor Commented:
You Rule man!
0
 
Bill WarrenIT ManagerAuthor Commented:
Can I start a new question and have you help.... it is related to this one?
0
 
JFrederick29Commented:
Sure thing.
0

Featured Post

NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

  • 5
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now