Solved

Help me understand this network configuration.

Posted on 2012-03-20
15
513 Views
Last Modified: 2012-03-21
While I have knowledge and experience, I'm no networking expert. I'm having trouble wrapping my head around this configuration, as it seems to be looping.

Two pieces of hardware, a Cisco 3750, and an ASA5520. I'd rather not post the full configs. The 3750 is handling all of the internal VLAN routing. Here are what I believe to be the relevant commands:

3750:
interface GigabitEthernet1/0/12
  no switchport
  ip address 10.1.101.2 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 10.1.101.1
====================
ASA:
interface GigabitEthernet0/0
  nameif outside
  ip address 72.x.x.x 255.255.255.224
!
interface GigabitEthernet0/1
  nameif inside
  ip address 10.1.101.1 255.255.255.0
!
global (outside) 72.x.x.x netmask 0.0.0.0
nat (inside) 101 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 72.x.x.x 1
route inside 10.1.1.0 255.255.255.0 10.1.101.2 1
route inside 10.1.20.0 255.255.255.0 10.1.101.2 1
route inside 10.1.21.0 255.255.255.0 10.1.101.2 1
etc.
=====================

There is a cable connecting Gi0/1/12 to Gi0/1, passing through a passive web filter. It seems like the 3750 is sending everything to the ASA, which is sending everything back to port 12 on the 3750?

No, no, I'm wrong. I thought the 3750 was doing the routing, but really it's the ASA. Right? Either way, this seems very inefficient. If that's the case, it seems like all our internal traffic is passing through the web filter twice! Surely that's exponentially increasing the load on the filter!

Anyhow, any insight anyone can offer is appreciated. If I need to provide further info, just let me know.

Thanks.
0
Comment
Question by:LSDIT
  • 5
  • 4
  • 4
  • +2
15 Comments
 
LVL 6

Expert Comment

by:vmagan
Comment Utility
what are you asking here?
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
I'm not sure what you mean by the webfilter. To me it looks like the ASA is the default gateway for the 3750.
So what exactly do you mean when saying  it seems like all our internal traffic is passing through the web filter twice ?
0
 
LVL 10

Expert Comment

by:pclinuxguru
Comment Utility
what it say in your 3750 config for gi0/12 which is what I am assuming your speaking of when you say it is sending it back.

my other question would be...
1) can you ping  10.1.101.2 from your different networks.
2) Can you ping 10.1.101.1 from the various networks as well as from the 3750
3) Can you ping from your asa to various addresses in your network?
0
 

Author Comment

by:LSDIT
Comment Utility
There's a passive web filter inline between the devices. The IP is actually 10.1.101.3. The cable goes from Gi0/1/12 on the 3750 to the LAN port on the filter, and from the WAN port on the filter to Gi0/1 on the ASA. I'm calling it a passive filter because it's not specifically addressed in the routing, it works by being plugged inline.

As for what I'm asking, I suppose whether the config makes sense and if it's as inefficient as it seems to me.
0
 

Author Comment

by:LSDIT
Comment Utility
I'm sorry.

I should have been clear from the start that EVERYTHING WORKS FINE. There are no problems, I was just looking into replacing the web filter, so I was looking through the configs to see what would be involved.
0
 
LVL 6

Accepted Solution

by:
vmagan earned 500 total points
Comment Utility
The 3750 switch is sending traffic to the ASA which is your DEFAULT GATEWAY.


3750:
interface GigabitEthernet1/0/12
  no switchport
  ip address 10.1.101.2 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 10.1.101.1  (this line indicates that the switch sends everything to the ASA which is 10.1.101.2)

everything looks fine here and nothing is being duplicated or being routed twice.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
Well I don't see anything inefficient (yet ;).
The ASA is the default gateway for the 3750. There is a (seemingly transparent) web filter in between. All traffic that is not destined for your network goes out the default gateway (ASA) on to the internet and gets back through the ASA (and the webfilter) to your network: the 3750.
Makes perfect sense to me. But of course that could be because I (we) have limited information.
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 6

Expert Comment

by:vmagan
Comment Utility
lol, yes we do Erniebeek. very limited info.

But if you want to add a webfilter nothing here would be replaced. You would just add this web filter as a proxy server depending on what you get. The toplogy that you have now will not change except for the addition of adding the web filter.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
@vmagan: can't be too carefull :)

But seriously. As I understand, LSDIT wants to replace the webfilter. As it is transparent (or as far as we can see it is), there would be no impact on the configs of the switch or the ASA as long as it is replaced with another transparent webfilter.
0
 
LVL 6

Expert Comment

by:vmagan
Comment Utility
yup, everything should remain the same.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
Glad we agree ;)
0
 

Author Comment

by:LSDIT
Comment Utility
Ok, when I started the question, it seemed like traffic was looping. Then I realized that only traffic bound for another internal ip would be routed to 10.1.101.2. But I figured I'd still ask, since it still seems like having all our internal inter-vlan traffic pass through the web filter, to the firewall, back through the filter, back to the 3750 just seems very inefficient.

Also, the filter I want to move to is already in place in another network, and I will have to route the traffic over to it, and configure it to route the traffic back. But that's a whole different issue that I'm not looking for help with (yet).
0
 
LVL 6

Expert Comment

by:vmagan
Comment Utility
We can get started with the new question whenever you're ready. Is this question completed?
0
 
LVL 8

Expert Comment

by:gsmartin
Comment Utility
FYI...  The Cisco 3750 is still doing your VLAN routing.  The route on the 3750 is your gateway of last resort for all Internet bound traffic.  The internal routes on your ASA tells the firewall where to where to go for different subnets/VLANs to your internal network.
0
 

Author Comment

by:LSDIT
Comment Utility
THANK YOU. Exactly the clarification I was looking for.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

As companies replace their old PBX phone systems with Unified IP Communications, many are finding out that legacy applications such as fax do not work well with VoIP. Fortunately, Cloud Faxing provides a cost-effective alternative that works over an…
David Varnum recently wrote up his impressions of PRTG, based on a presentation by my colleague Christian at Tech Field Day at VMworld in Barcelona. Thanks David, for your detailed and honest evaluation!
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now