wayy2be
asked on
How to route public IP traffic through layer 3 switch to a specific gateway
I have a Cisco 3550 that we are using for routing and switching. The switch has a default gateway to the 192.168.5.x network and is also connected to a PIX and an ASA as shown below in my diagram.
PIX 515 ASA
| |
| |
| |
Default G/W vlan 172.16.32.x
[Internet] --------------------------
I have an application server on the 172.16.32.x subnet that sets up a VPN tunnel for remote users. Remote users will use their air card to connect through the ASA and the traffic will reach the switch through the vlan set up for the 172.16.32.x subnet. Incoming traffic gets to the app server from the ASA without any issues. However once the traffic attempts to return to the user to complete the VPN tunnel, the traffic will get routed out the default gateway of the switch instead of going back out the ASA.
I have set up a route on the 3550 that would route all 172.16.32.x traffic through the vlan however since the return traffic from the application server is based on the destination IP and is a public IP the 3550 is sending the traffic out the default gateway. I know this from analyzing a packet capture of the traffic. The remote users use different air card providers like ATT, Verizon etc and the public IP address of each air card is bound to change over time, so I cannot put a route in the 3550 to route the public IP address nor do I think that is a secure option. The 3550 is a SMI image so policy based routing is not available on this switch.
How can I solve this issue the best and most secure way? I would be grateful for any help on this one.
Thanks
ASKER
Yes I tried that but I cannot bind the ip policy route-map to the vlan. I read online that pbr is only available on the EMI image of the switch, we have SMI.
can u combine ASA port & Application in same vlan IP address ..
so that application server will have default gateway to ASA ..
so that application server will have default gateway to ASA ..
ASKER
Ho would this be setup? The server will need access to resources on the internal LAN.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The switch does not support pbr, smi image. Thanks for the help.
access-list 100 permit ip <source ip> <subnet mask> any
route-map PBR permit 10
match ip address 100
set ip next-hop <ASA IP address>
interface vlan x (incoming VLAN on switch)
ip policy route-map PBR