Link to home
Start Free TrialLog in
Avatar of thombie
thombie

asked on

How to convigure VRF

Hi All.

I  Have a cisco 6500 switch with Multible Layer 3 vlans.
Each VLAN has its own DHCP Scope.
I am having an  a 100mps Internet link will be terminated on this switch.
I have a ASA 5505  firewall which will protected the system.
My question is how do I configure the  firewall and switch to route traffic to to and from the internet.
Avatar of kevinhsieh
kevinhsieh
Flag of United States of America image

I don't see a need for VRF unless you need a router outside of your firewall. If you want to terminate the Internet connection on your 6500 instead of directly on your firewall, just create a new layer 2 VLAN on the 6500, and assign a port for the internet feed and another for your firewall's outside interface to that VLAN. As long as you do not create a matching VLAN interface, traffic on that VLAN should be isolated. The idea is to make sure that the only way for traffic to flow from that VLAN to the rest of your network is through the firewall. If you can plug your Internet feed directly into the firewall, that is the most secure.

I would put the inside interface of the firewall on a dedicated L2/L3 VLAN interface.
VRFs are configured when you need to have 2 separate routing tables that DO NOT interact in any way. It's like having 2 virtual Layer 3 devices in the same physical box. If you just want to make sure that the firewall is the router you can do this as Kevin suggested.

Perhaps you should explain why you think you need VRF configured, and we can see if Kevin's suggestion will suffice or not.
Avatar of thombie
thombie

ASKER

The reason for Lyer 3 is that the switch will be DHCP server for the  subnets
You still don't need VRF unless you are assigning DHCP to the segment OUTSIDE your firewall. All of your L3 VLANs should be inside your firewall. Your firewall inside interface goes on an L3 VLAN. The firewall outside interface to the internet feed and and DMZ interfaces all go on separate L2 VLANs.
Right, VRF has nothing directly to do with Layer 3. VRF basically creates 2 entrirely separate Layer 3 machines, each with its own independent and isolated routing tables. This NOT the same as 2 Layer 3 vlans or subnets sharing the same routing table, which is what you need.
Avatar of thombie

ASKER

so where sould the internet connection terminate. on the switch or the firewall ?
As I said in the first comment, terminate the connection directly on your firewall if you can.
And if you can't due to a media mismatch of some sort, simply create a layer 2 vlan on the switch specifically for this connection, and set up 2 ports in the vlan- one in and one out to the firewall.
Avatar of thombie

ASKER

I like this idead   " And if you can't due to a media mismatch of some sort, simply create a layer 2 vlan on the switch specifically for this connection, and set up 2 ports in the vlan- one in and one out to the firewall. " but I am not sure how to do it.
conf t
vlan 100
 name ISP_Link
exit
int g1/1
 description ISP
 switchport
 switchport mode access
 switchport access vlan 100
 no shutdown
int g1/2
 description ASA
 switchport
 switchport mode access
 switchport access vlan 100
 no shutdown

That's all you need!
Avatar of thombie

ASKER

so I do  this on the switch  ?
below is my current config
.........        .........
broadband-core#h . .. .
broadband-core#
broadband-core#sh run
Building configuration...

Current configuration : 5269 bytes
!
version 12.1
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service counters max age 10
!
hostname broadband-core
!
enable secret 5 $1$e.Bk$FPOof4GTex/N09A7Sa4tA0
!
vtp domain bb
vtp mode transparent
ip subnet-zero
!
!
ip dhcp excluded-address 172.16.3.1 172.16.3.2
ip dhcp excluded-address 172.16.4.1 172.16.4.2
!
ip dhcp pool 3NE
   network 172.16.3.0 255.255.255.0
  domain-name broadband.com
   dns-server 8.8.4.4
   default-router 172.16.3.1
!
ip dhcp pool 3SW
   network 172.16.4.0 255.255.255.0
   domain-name broadband.com
   dns-server 8.8.4.4
   default-router 172.16.4.1
!
!
ip vrf 3NE
!
ip vrf 3SW
!
ip vrf INTERNET
ip ssh time-out 120
ip ssh authentication-retries 3
mls flow ip destination
mls flow ipx destination
!
!
spanning-tree mode pvst
 --More-- .........        .........!
redundancy
 mode rpr-plus
 main-cpu
  auto-sync running-config
  auto-sync standard
!
!
vlan 2
 name 3NE
!
vlan 3
 name 3SW
!
vlan 4
 name INTERNET
!
!
interface GigabitEthernet1/1
 no ip address
 shutdown
!
interface GigabitEthernet1/2
 --More-- .........        ......... no ip address
 shutdown
!
interface GigabitEthernet2/1
 switchport
 switchport access vlan 2
 switchport mode access
!
interface GigabitEthernet2/2
 switchport
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet4/1
 no ip address
 shutdown
!
interface GigabitEthernet4/2
 no ip address
 shutdown
!
interface GigabitEthernet4/3
 no ip address
 --More-- .........        ......... shutdown
!
interface GigabitEthernet4/4
 no ip address
 shutdown
!
interface GigabitEthernet4/5
 no ip address
 shutdown
!
interface GigabitEthernet4/6
 no ip address
 shutdown
!
interface GigabitEthernet4/7
 no ip address
 shutdown
!
interface GigabitEthernet4/8
 no ip address
 shutdown
!
interface GigabitEthernet4/9
 --More-- .........        ......... no ip address
 shutdown
!
interface GigabitEthernet4/10
 no ip address
 shutdown
!
interface GigabitEthernet4/11
 no ip address
 shutdown
!
interface GigabitEthernet4/12
 no ip address
 shutdown
!
interface GigabitEthernet4/13
 no ip address
 shutdown
!
interface GigabitEthernet4/14
 no ip address
 shutdown
!
 --More-- .........        .........interface GigabitEthernet4/15
 no ip address
 shutdown
!
interface GigabitEthernet4/16
 no ip address
 shutdown
!
interface GigabitEthernet7/1
 switchport
 switchport access vlan 2
!
interface GigabitEthernet7/2
 switchport
 switchport access vlan 3
!
interface GigabitEthernet7/3
 no ip address
 shutdown
!
interface GigabitEthernet7/4
 no ip address
 shutdown
 --More-- .........        .........!
interface GigabitEthernet7/5
 no ip address
 shutdown
!
interface GigabitEthernet7/6
 no ip address
 shutdown
!
interface GigabitEthernet7/7
 no ip address
 shutdown
!
interface GigabitEthernet7/8
 no ip address
 shutdown
!
interface GigabitEthernet7/9
 no ip address
 shutdown
!
interface GigabitEthernet7/10
 no ip address
 --More--
ASKER CERTIFIED SOLUTION
Avatar of mikebernhardt
mikebernhardt
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of thombie

ASKER

this has worked
Avatar of thombie

ASKER

what about routing. ?
Your ASA just needs default route to your ISP.
1. ASA needs a default route to the ISP
2. ASA needs routes to the 6500 for any Layer 3 LANs that exist there.
3. 6500 needs a default route to the ASA.
Avatar of thombie

ASKER

Thanks
Avatar of thombie

ASKER

so how does the in and out ports work.
do plug both cables into the internal side of the firewall ?
For that vlan we were talking about before? One goes to the ISP, the other goes to the outside of the firewall.

The inside of the firewall goes to a different port. You only probably need a point-to-point link between the 6500 and the firewall, so you could just make a layer 3 port on the 6500 and share a small subnet with the inside interface of the firewall. It's simpler than making a vlan.

So, route #s 2 and 3 above would point between those 2 interfaces.
Avatar of thombie

ASKER

Thanks. So this my cable layout. is this.
6500 switch

port  7/47 Vlan 100 cabled to outside inferface of the ASA
port  7/48  VLAN 100 Cabled to ISP equipment
should have a 7/46  cabled to Internal interface  for the ASA ?
Yes, or your ASA won't be talking to anything on the inside. But it must be on a different VLAN than the outside stuff, and it has to have Layer 3 on the switch, not just Layer 2 like Vlan 100.
Avatar of thombie

ASKER

Ok So if I create a VLAN 30  with a small subnet it should work  ?
Yes, or you could just put an IP address on the switch port in that small subnet and skip the VLAN altogether. Your choice.