rogue028
asked on
VLAN Routing
I have a Cisco 3550 router that is connected to a pix 515e that provides internet access.
Pix 515e 10.39.128.1 inside interface connects to fastethernet0/17on my cisco 3550 switch. II can ping the internet from a console cable attached to my switch throuh the pix but when I connect a PC to fastethernet0/17 of vlan 10 I cannot ping anything with my default gateway set to 10.39.129.9. If I plug into a port in vlan1 I can ping all over the 10.39.127.x .
Here is the topology, the customer ran out of ip addresses so we had to bring in another dsl connection. I have two firewalls and am trying to tie the two networks together using the 3550 using vlans.
pix 506e (10.39.127.1) pix515e (10.39.128.1)
| |
catalyst 2950 (10.39.127.8) catalyst 3550 vlan1 10.39.127.6
vlan 10 10.39.129.8
fe 0/1 goes to Catalyst 2950 port fe0/22
fe 0/17 goes to inside int pix515e
I' ve set my default gateway to the devices I want to access the internet via pix515e to 10.39.129.8 but I can't get outside. The config for the Catalyst 2950 is as follows:
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/18
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/19
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/21
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface Vlan1
ip address 10.39.127.8 255.255.255.0
no ip route-cache
!
interface Vlan10
no ip address
no ip route-cache
shutdown
!
ip http server
The config for the Cisco 3550 is as follows:
ip subnet-zero
ip routing
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
description to 2950 switch
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/2
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/3
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/4
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/5
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/6
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/7
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/8
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/9
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/10
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/11
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/12
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/13
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/14
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/15
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/16
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/17
no switchport
ip address 10.39.128.8 255.255.255.0
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/18
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/19
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/21
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/22
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/23
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/24
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10
switchport mode trunk
no ip address
!
interface GigabitEthernet0/1
switchport mode dynamic desirable
no ip address
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
no ip address
!
interface Vlan1
ip address 10.39.127.6 255.255.255.0
no ip route-cache
no ip mroute-cache
!
interface Vlan10
ip address 10.39.129.8 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.39.128.1
ip http server
!
I'm way over my head on this one and not sure what I need to do to go forward. The goal is to communicate to the internet via the pix515e and allow specific traffic from the 10.39.127.x network access through that device
Pix 515e 10.39.128.1 inside interface connects to fastethernet0/17on my cisco 3550 switch. II can ping the internet from a console cable attached to my switch throuh the pix but when I connect a PC to fastethernet0/17 of vlan 10 I cannot ping anything with my default gateway set to 10.39.129.9. If I plug into a port in vlan1 I can ping all over the 10.39.127.x .
Here is the topology, the customer ran out of ip addresses so we had to bring in another dsl connection. I have two firewalls and am trying to tie the two networks together using the 3550 using vlans.
pix 506e (10.39.127.1) pix515e (10.39.128.1)
| |
catalyst 2950 (10.39.127.8) catalyst 3550 vlan1 10.39.127.6
vlan 10 10.39.129.8
fe 0/1 goes to Catalyst 2950 port fe0/22
fe 0/17 goes to inside int pix515e
I' ve set my default gateway to the devices I want to access the internet via pix515e to 10.39.129.8 but I can't get outside. The config for the Catalyst 2950 is as follows:
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/18
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/19
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/21
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface Vlan1
ip address 10.39.127.8 255.255.255.0
no ip route-cache
!
interface Vlan10
no ip address
no ip route-cache
shutdown
!
ip http server
The config for the Cisco 3550 is as follows:
ip subnet-zero
ip routing
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
interface FastEthernet0/1
description to 2950 switch
switchport trunk encapsulation dot1q
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/2
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/3
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/4
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/5
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/6
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/7
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/8
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/9
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/10
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/11
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/12
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/13
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/14
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/15
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/16
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/17
no switchport
ip address 10.39.128.8 255.255.255.0
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/18
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/19
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/20
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/21
switchport access vlan 10
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
no ip address
mls qos cos override
macro description cisco-desktop
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/22
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/23
switchport mode dynamic desirable
no ip address
!
interface FastEthernet0/24
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10
switchport mode trunk
no ip address
!
interface GigabitEthernet0/1
switchport mode dynamic desirable
no ip address
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
no ip address
!
interface Vlan1
ip address 10.39.127.6 255.255.255.0
no ip route-cache
no ip mroute-cache
!
interface Vlan10
ip address 10.39.129.8 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.39.128.1
ip http server
!
I'm way over my head on this one and not sure what I need to do to go forward. The goal is to communicate to the internet via the pix515e and allow specific traffic from the 10.39.127.x network access through that device
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The pix 506e provides internet access to the network . I'm trying to get some devices to access the internet via the internet connection on the pix 515e.
ASKER
found the issue. I needed a route on my 515e back to my internal nework.
set up a new vlan, say vlan 11
and assign fe 0/17 to vlan 11
assign IP 10.39.128.2 to interface vlan 11
about two ASA, do you have 3550 connected to 2950? I did not see such connection on your topology. Please confirm
sincerely
and assign fe 0/17 to vlan 11
assign IP 10.39.128.2 to interface vlan 11
about two ASA, do you have 3550 connected to 2950? I did not see such connection on your topology. Please confirm
sincerely
ASKER