Link to home
Start Free TrialLog in
Avatar of wayy2be
wayy2be

asked on

How to route public IP traffic through layer 3 switch to a specific gateway


I have a Cisco 3550 that we are using for routing and switching. The switch has a default gateway to the 192.168.5.x network and is also connected to a PIX and an ASA as shown below in my diagram.

 
                                      PIX 515          ASA

                                                |               |

                                                |               |

                                                |               |

Default G/W                                                                                vlan 172.16.32.x
[Internet] ---------------------------[Cisco3550]-----------------------------------------[App Server]


I have an application server on the 172.16.32.x subnet that sets up a VPN tunnel for remote users. Remote users will use their air card to connect through the ASA and the traffic will reach the switch through the vlan set up for the 172.16.32.x subnet. Incoming traffic gets to the app server from the ASA without any issues. However once the traffic attempts to return to the user to complete the VPN tunnel, the traffic will get routed out the default gateway of the switch instead of going back out the ASA.

 I have set up a route on the 3550 that would route all 172.16.32.x traffic through the vlan however since the return traffic from the application server is based on the destination IP and is a public IP the 3550 is sending the traffic out the default gateway. I know this from analyzing a packet capture of the traffic. The remote users use different air card providers like ATT, Verizon etc and the public IP address of each air card is bound to change over time, so I cannot put a route in the 3550 to route the public IP address nor do I think that is a secure option. The 3550 is a SMI image so policy based routing is not available on this switch.

 
How can I solve this issue the best and most secure way?  I would be grateful for any help on this one.

 
Thanks
Avatar of John Meggers
John Meggers
Flag of United States of America image

What it seems you're looking for is policy-based routing.  The 3550 should be able to do it but I can't say for certain.  PBR is source-based routing, as opposed to normal destination-based routing.  The configuration looks something like this, but without knowing what code you're running I can't say for certain.  It is configurable on a 3750 running 12,2(25)SEE3.

access-list 100 permit ip <source ip> <subnet mask> any

route-map PBR permit 10
match ip address 100
set ip next-hop <ASA IP address>

interface vlan x  (incoming VLAN on switch)
ip policy route-map PBR
Avatar of wayy2be
wayy2be

ASKER

Yes I tried that but I cannot bind the ip policy route-map to the vlan. I read online that pbr is only available on the EMI image of the switch, we have SMI.
can u combine ASA port & Application in same vlan IP address ..
so that application server will have default gateway to ASA ..
Avatar of wayy2be

ASKER

Ho would this be setup?  The server will need access to resources on the internal LAN.
ASKER CERTIFIED SOLUTION
Avatar of John Meggers
John Meggers
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of wayy2be

ASKER

The switch does not support pbr, smi image. Thanks for the help.