How to route public IP traffic through layer 3 switch to a specific gateway

Posted on 2011-10-02
Medium Priority
Last Modified: 2012-05-12

I have a Cisco 3550 that we are using for routing and switching. The switch has a default gateway to the 192.168.5.x network and is also connected to a PIX and an ASA as shown below in my diagram.

                                      PIX 515          ASA

                                                |               |

                                                |               |

                                                |               |

Default G/W                                                                                vlan 172.16.32.x
[Internet] ---------------------------[Cisco3550]-----------------------------------------[App Server]

I have an application server on the 172.16.32.x subnet that sets up a VPN tunnel for remote users. Remote users will use their air card to connect through the ASA and the traffic will reach the switch through the vlan set up for the 172.16.32.x subnet. Incoming traffic gets to the app server from the ASA without any issues. However once the traffic attempts to return to the user to complete the VPN tunnel, the traffic will get routed out the default gateway of the switch instead of going back out the ASA.

 I have set up a route on the 3550 that would route all 172.16.32.x traffic through the vlan however since the return traffic from the application server is based on the destination IP and is a public IP the 3550 is sending the traffic out the default gateway. I know this from analyzing a packet capture of the traffic. The remote users use different air card providers like ATT, Verizon etc and the public IP address of each air card is bound to change over time, so I cannot put a route in the 3550 to route the public IP address nor do I think that is a secure option. The 3550 is a SMI image so policy based routing is not available on this switch.

How can I solve this issue the best and most secure way?  I would be grateful for any help on this one.

Question by:wayy2be
  • 3
  • 2
LVL 18

Expert Comment

ID: 36900784
What it seems you're looking for is policy-based routing.  The 3550 should be able to do it but I can't say for certain.  PBR is source-based routing, as opposed to normal destination-based routing.  The configuration looks something like this, but without knowing what code you're running I can't say for certain.  It is configurable on a 3750 running 12,2(25)SEE3.

access-list 100 permit ip <source ip> <subnet mask> any

route-map PBR permit 10
match ip address 100
set ip next-hop <ASA IP address>

interface vlan x  (incoming VLAN on switch)
ip policy route-map PBR

Author Comment

ID: 36900831
Yes I tried that but I cannot bind the ip policy route-map to the vlan. I read online that pbr is only available on the EMI image of the switch, we have SMI.

Expert Comment

ID: 36903103
can u combine ASA port & Application in same vlan IP address ..
so that application server will have default gateway to ASA ..
Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.


Author Comment

ID: 36904276
Ho would this be setup?  The server will need access to resources on the internal LAN.
LVL 18

Accepted Solution

jmeggers earned 2000 total points
ID: 36924494
Yes, it makes sense that PBR would require the EMI image.

Is the switch capable of doing actual routing, or does it just rely on the default gateway?  If it's only running an SMI image, it may not be.  Second (related) question, is the VPN address pool distinct, or does it overlap with LAN addresses?  If the switch can be configured with a route, and the pool is distinct, you should be able to configure the switch with a static route pointing to the ASA to get to the address pool.

Author Comment

ID: 37035616
The switch does not support pbr, smi image. Thanks for the help.

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question