Cisco Layer 3 Switch - Routing

prlit
prlit used Ask the Experts™
on
Objects:
Network 1: 192.168.1.x/24
Router 1: 192.168.1.11

Network 2: 10.3.0.0/16
Router 2: 10.3.0.1

So we have these two networks both with internet connections and both with an ASA. We've been juggling static routes for so long due to the two LANS in house so I bought a small layer 3 switch to help us route.

I was hoping to trasition everyone to Network 2 over time.

I assigned fa0/1 with the ip 10.3.0.3 and fa0/2 192.168.1.40
I added static routes and everything seems to play nice except the internet. When I set a default gateway to go out either of the internet connections we have one side of the network that can't get to the internet. I think it's a NAT issue but I'm not sure. Any ideas? Thanks!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Head of IT Security Division
Top Expert 2010
Commented:
Hi,


you need to enable routing oh L3 switch:

conf t
ip routing
ip route 0.0.0.0 0.0.0.0 x.xx.x.x

x.x.x.x the asa leg


ASA:
you need to enable nat
nat (inside) 0.0.0.0 0.0.0.0
route inside y.y.y.y 255.255.255.0

Author

Commented:
Those are all enabled.

It's def a NAT issue. Routing is enabled however on the ASA that's doing the nat - it's only doing it for one of the networks, not both.

If I add another dynaic NAT policy it seems to mess up the internet altogether.
What does your current nat statment look like, that may help us see the problem.
Top Expert 2010
Commented:
IS there 1 ASA or 2,  I didn't quite understand from the description.  

If there is 1, then can I assume that the network looks like this:


ASA
|
subnet for asa to switch comm>
|
Switch
 |
---------------
|                |
fa1               fa2
10.3.0.x        192.168.40.x



The ASA and switch would normally share a single subnet (i.e. 10.10.10.0, where asa is 10.10.10.1 and sw is 10.10.10.2)    then the sw would have a catchall set to "iproute 0.0.0.0 0.0.0.0 10.10.10.1"       The Asa would then send all to 10.10.10.2.  


Author

Commented:
I actually got this working. It was a NAT issue. I needed to allow the other networks to be NAT'ed out as well. I will split points.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial