Solved

InterVLAN routing not Happening to Firewall Interface

Posted on 2009-05-16
14
710 Views
Last Modified: 2012-06-27
Hi ,
My management has asked to add upcountry locations to the firewall thru Cisco 3560.
I have created two VLAN's with each assigned pool of IP address. All the restrictions are handled at firewall, Hence I need to route the traffic from Loc A & B to firewall.

I am able to reach from the default VLAN, but from the created VLAN, it is not reaching the destination.

The results are
NEWVENDSW#ping 172.30.100.100

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.30.100.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
NEWVENDSW#ping 172.30.100.100 source vlan 25

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 195.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.26.179.62
.....
Success rate is 0 percent (0/5)
NEWVENDSW#


REquest Help
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname NEWVENDSW
!
enable password ********
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface GigabitEthernet0/1
 switchport access vlan 21
!
interface GigabitEthernet0/2
 switchport access vlan 21
!
interface GigabitEthernet0/3
switchport access vlan 25
!
interface GigabitEthernet0/4
switchport access vlan 25
!
interface GigabitEthernet0/5
switchport access vlan 26
!
interface GigabitEthernet0/6
switchport access vlan 26
!
interface GigabitEthernet0/7
!
.
.
.
.
.
.
.
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface Vlan1
 no ip address
!
interface Vlan21
 ip address 172.30.100.102 255.255.255.248
!
interface Vlan25
 description VENDOR-A-LOCATION
 ip address 10.0.0.10 255.255.255.192
!
interface Vlan26
 description VENDOR-B-LOCATION 
 ip address 10.0.0.20 255.255.255.192
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.30.100.100
 
ip http server
!
!
control-plane

Open in new window

Network-Proposed.jpg
0
Comment
Question by:vkraaman
  • 4
  • 3
  • 3
  • +2
14 Comments
 

Author Comment

by:vkraaman
ID: 24402640
I am getting the interface for Firewall whether it is trunk or in access. It is Fortigate 200A.
0
 

Author Comment

by:vkraaman
ID: 24402645
Pls Help
0
 
LVL 4

Expert Comment

by:nasirsh
ID: 24402701
Your ping from vlan25 is not working because it isnt in the same network ID. and you have connected via L2 Switch. L2 switch do not support routing. Either connect all the Networks to the 3560 including the OLD one and then try to communicate with each other.
0
How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

 
LVL 4

Expert Comment

by:nasirsh
ID: 24402718
Configure it for access port.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24402836
You have a couple things going on here:

interface Vlan25   ip address 10.0.0.10 255.255.255.192
interface Vlan26   ip address 10.0.0.20 255.255.255.192

Both of these layer 3 interfaces are in the same network. This will cause all sorts of weird behavior.

With a /26 mask, your valid IP addresses for the first subnet would be 10.0.0.1-62. The second subnet would have addresses 10.0.0.65-126.

I suggest fixing your IP addresses first.

Then you can move to the second problem. You're using a static default route on the 3560 to get to the firewall. The firewall, in turn, needs a route to the two new subnets that point to the 3560.
0
 
LVL 7

Expert Comment

by:diepes
ID: 24405608
It looks workable.

FW -> connects to Gig 0/1 or 0/2  vlan 21 ?

Q2"I am getting the interface for Firewall whether it is trunk or in access. It is Fortigate 200A."
for 802.1Q trunk this would be correct, as vlan1 would be native vlan, connected to access port on 3650 vlan21.

Problem number one, your subnets overlap on vlan 25 and 26
These are in the same subnet 10.0.0.0 255.255.255.192
ip address 10.0.0.10 255.255.255.192
ip address 10.0.0.20 255.255.255.192

I would suggest you keep it simple put each customer in it's own Class C (255.255.255.0)
e.g
vlan25  10.0.25.1 255.255.255.0   -> Client use 10.0.25.10 -> 254 mask 255.255.255.0  
vlan26  10.0.26.1 255.255.255.0   -> Client use 10.0.26.10 -> 254 mask 255.255.255.0

Ensure you have routes on the FW pointing to the 3650 GW(172.30.100.102) for the client subent's
0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24405776
vlan 2 and 3 in same subnet
chek the return route in frewall,]
add ip routing commmand in switch.
also check the trun k port
0
 

Author Comment

by:vkraaman
ID: 24409181
Thanks for your comments
As per suggestion
Vlan 25 10.0.0.10/26     Ip range from 10.0.0.1 to 10.0.0.62
Vlan 26 10.0.0.200/26   ip range from 10.0.0.193 to 10.0.0.254

Interface Vlan 25 Ip : 10.0.0.62 255.255.255.192
Interface Vlan 26 Ip ; 10.0.0.254 255.255.255.192

!

New configuration


version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname NEWVENDSW
!
enable password ********
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface GigabitEthernet0/1
 switchport access vlan 21
!
interface GigabitEthernet0/2
 switchport access vlan 21
!
interface GigabitEthernet0/3
switchport access vlan 25
!
interface GigabitEthernet0/4
switchport access vlan 25
!
interface GigabitEthernet0/5
switchport access vlan 26
!
interface GigabitEthernet0/6
switchport access vlan 26
!
interface GigabitEthernet0/7
!
.
.
.
.
.
.
.
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface Vlan1
 no ip address
!
interface Vlan21
 ip address 172.30.100.102 255.255.255.248
!
interface Vlan25
 description VENDOR-A-LOCATION
 ip address 10.0.0.62 255.255.255.192
!
interface Vlan26
 description VENDOR-B-LOCATION
 ip address 10.0.0.254 255.255.255.192
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.30.100.100

ip http server
!
!
control-plane
!
!
!



Network-Proposed.jpg
0
 
LVL 7

Accepted Solution

by:
diepes earned 500 total points
ID: 24409312

Ok, next step is to ensure the FW knows it should route these subnets back to the 3560-L3-Switch.
You need routes for the 2 subnets or a route for all of 10.0.0.0/24 to the 3560.

On FW add routes
ip route 10.0.0.10/26 via 172.30.100.102
ip route  10.0.0.200/26 via 172.30.100.102

Now your pings from the switch should work to the FW for both interfaces.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24410770
I still don't see a trunk from the 3560 to the Layer 2 switch.

On the 3560 use the "show int trunk" command to verify a trunk exists.

You'll also need a trunk between the Layer 2 switch and the Firewall.
0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24410798
interface Vlan25
 description VENDOR-A-LOCATION
 ip address 10.0.0.62 255.255.255.192
!
interface Vlan26
 description VENDOR-B-LOCATION
 ip address 10.0.0.254 255.255.255.192

again subnet is same

0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24410803
plx enter IP routing command in switch
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24410833
>again subnet is same

10.0.0.62 and 10.0.0.254 are NOT in the same subnet.

These are both valid IP addresses for two different networks.
0
 

Author Closing Comment

by:vkraaman
ID: 31582222
Thanks, after adding the routes it started working fine.
0

Featured Post

Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (http://en.wikipedia.org/wiki/Vir…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question