Solved

InterVLAN routing not Happening to Firewall Interface

Posted on 2009-05-16
14
689 Views
Last Modified: 2012-06-27
Hi ,
My management has asked to add upcountry locations to the firewall thru Cisco 3560.
I have created two VLAN's with each assigned pool of IP address. All the restrictions are handled at firewall, Hence I need to route the traffic from Loc A & B to firewall.

I am able to reach from the default VLAN, but from the created VLAN, it is not reaching the destination.

The results are
NEWVENDSW#ping 172.30.100.100

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.30.100.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
NEWVENDSW#ping 172.30.100.100 source vlan 25

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 195.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 172.26.179.62
.....
Success rate is 0 percent (0/5)
NEWVENDSW#


REquest Help
version 12.2

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname NEWVENDSW

!

enable password ********

!

no aaa new-model

ip subnet-zero

ip routing

!

!

!

!

no file verify auto

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface GigabitEthernet0/1

 switchport access vlan 21

!

interface GigabitEthernet0/2

 switchport access vlan 21

!

interface GigabitEthernet0/3

switchport access vlan 25

!

interface GigabitEthernet0/4

switchport access vlan 25

!

interface GigabitEthernet0/5

switchport access vlan 26

!

interface GigabitEthernet0/6

switchport access vlan 26

!

interface GigabitEthernet0/7

!

.

.

.

.

.

.

.

interface GigabitEthernet0/23

!

interface GigabitEthernet0/24

!

interface Vlan1

 no ip address

!

interface Vlan21

 ip address 172.30.100.102 255.255.255.248

!

interface Vlan25

 description VENDOR-A-LOCATION

 ip address 10.0.0.10 255.255.255.192

!

interface Vlan26

 description VENDOR-B-LOCATION 

 ip address 10.0.0.20 255.255.255.192

!

!

ip classless

ip route 0.0.0.0 0.0.0.0 172.30.100.100
 

ip http server

!

!

control-plane

Open in new window

Network-Proposed.jpg
0
Comment
Question by:vkraaman
  • 4
  • 3
  • 3
  • +2
14 Comments
 

Author Comment

by:vkraaman
ID: 24402640
I am getting the interface for Firewall whether it is trunk or in access. It is Fortigate 200A.
0
 

Author Comment

by:vkraaman
ID: 24402645
Pls Help
0
 
LVL 4

Expert Comment

by:nasirsh
ID: 24402701
Your ping from vlan25 is not working because it isnt in the same network ID. and you have connected via L2 Switch. L2 switch do not support routing. Either connect all the Networks to the 3560 including the OLD one and then try to communicate with each other.
0
 
LVL 4

Expert Comment

by:nasirsh
ID: 24402718
Configure it for access port.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24402836
You have a couple things going on here:

interface Vlan25   ip address 10.0.0.10 255.255.255.192
interface Vlan26   ip address 10.0.0.20 255.255.255.192

Both of these layer 3 interfaces are in the same network. This will cause all sorts of weird behavior.

With a /26 mask, your valid IP addresses for the first subnet would be 10.0.0.1-62. The second subnet would have addresses 10.0.0.65-126.

I suggest fixing your IP addresses first.

Then you can move to the second problem. You're using a static default route on the 3560 to get to the firewall. The firewall, in turn, needs a route to the two new subnets that point to the 3560.
0
 
LVL 7

Expert Comment

by:diepes
ID: 24405608
It looks workable.

FW -> connects to Gig 0/1 or 0/2  vlan 21 ?

Q2"I am getting the interface for Firewall whether it is trunk or in access. It is Fortigate 200A."
for 802.1Q trunk this would be correct, as vlan1 would be native vlan, connected to access port on 3650 vlan21.

Problem number one, your subnets overlap on vlan 25 and 26
These are in the same subnet 10.0.0.0 255.255.255.192
ip address 10.0.0.10 255.255.255.192
ip address 10.0.0.20 255.255.255.192

I would suggest you keep it simple put each customer in it's own Class C (255.255.255.0)
e.g
vlan25  10.0.25.1 255.255.255.0   -> Client use 10.0.25.10 -> 254 mask 255.255.255.0  
vlan26  10.0.26.1 255.255.255.0   -> Client use 10.0.26.10 -> 254 mask 255.255.255.0

Ensure you have routes on the FW pointing to the 3650 GW(172.30.100.102) for the client subent's
0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24405776
vlan 2 and 3 in same subnet
chek the return route in frewall,]
add ip routing commmand in switch.
also check the trun k port
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:vkraaman
ID: 24409181
Thanks for your comments
As per suggestion
Vlan 25 10.0.0.10/26     Ip range from 10.0.0.1 to 10.0.0.62
Vlan 26 10.0.0.200/26   ip range from 10.0.0.193 to 10.0.0.254

Interface Vlan 25 Ip : 10.0.0.62 255.255.255.192
Interface Vlan 26 Ip ; 10.0.0.254 255.255.255.192

!

New configuration


version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname NEWVENDSW
!
enable password ********
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface GigabitEthernet0/1
 switchport access vlan 21
!
interface GigabitEthernet0/2
 switchport access vlan 21
!
interface GigabitEthernet0/3
switchport access vlan 25
!
interface GigabitEthernet0/4
switchport access vlan 25
!
interface GigabitEthernet0/5
switchport access vlan 26
!
interface GigabitEthernet0/6
switchport access vlan 26
!
interface GigabitEthernet0/7
!
.
.
.
.
.
.
.
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface Vlan1
 no ip address
!
interface Vlan21
 ip address 172.30.100.102 255.255.255.248
!
interface Vlan25
 description VENDOR-A-LOCATION
 ip address 10.0.0.62 255.255.255.192
!
interface Vlan26
 description VENDOR-B-LOCATION
 ip address 10.0.0.254 255.255.255.192
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.30.100.100

ip http server
!
!
control-plane
!
!
!



Network-Proposed.jpg
0
 
LVL 7

Accepted Solution

by:
diepes earned 500 total points
ID: 24409312

Ok, next step is to ensure the FW knows it should route these subnets back to the 3560-L3-Switch.
You need routes for the 2 subnets or a route for all of 10.0.0.0/24 to the 3560.

On FW add routes
ip route 10.0.0.10/26 via 172.30.100.102
ip route  10.0.0.200/26 via 172.30.100.102

Now your pings from the switch should work to the FW for both interfaces.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24410770
I still don't see a trunk from the 3560 to the Layer 2 switch.

On the 3560 use the "show int trunk" command to verify a trunk exists.

You'll also need a trunk between the Layer 2 switch and the Firewall.
0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24410798
interface Vlan25
 description VENDOR-A-LOCATION
 ip address 10.0.0.62 255.255.255.192
!
interface Vlan26
 description VENDOR-B-LOCATION
 ip address 10.0.0.254 255.255.255.192

again subnet is same

0
 
LVL 5

Expert Comment

by:devangshroff
ID: 24410803
plx enter IP routing command in switch
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 24410833
>again subnet is same

10.0.0.62 and 10.0.0.254 are NOT in the same subnet.

These are both valid IP addresses for two different networks.
0
 

Author Closing Comment

by:vkraaman
ID: 31582222
Thanks, after adding the routes it started working fine.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

The worst thing when starting a new job is when the previous Network Administrator left behind no documentation. How do you get into the devices? If you've been in this situation or just accidently mistyped your password, this article will hopefully…
This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now