asked on Sonicwall Config and CIsco 3560
So here's the network:
Lots of local users, 192.168.12.x. Users are given an IP thru DHCP, and their default GW is 192.168.12.254. The 254 addy is a Cisco 3560G switch. In the configs of the 3560, we have a line that says
ip route 0.0.0.0 0.0.0.0 192.168.12.253
The 253 is our Cisco ASA 5505.
Now I have setup a Sonicwall to replace the ASA, and am just doing some testing. I assigned an internal IP to the Sonicwall of 192.168.12.252. If I set up PCs with a def gw of 12.252, everything is fine, they can surf and all that. If I reconfigure the Cisco 3560G to say
ip route 0.0.0.0 0.0.0.0 192.168.12.252
No one can go anywhere.
What excatly am I missing here??
Lots of local users, 192.168.12.x. Users are given an IP thru DHCP, and their default GW is 192.168.12.254. The 254 addy is a Cisco 3560G switch. In the configs of the 3560, we have a line that says
ip route 0.0.0.0 0.0.0.0 192.168.12.253
The 253 is our Cisco ASA 5505.
Now I have setup a Sonicwall to replace the ASA, and am just doing some testing. I assigned an internal IP to the Sonicwall of 192.168.12.252. If I set up PCs with a def gw of 12.252, everything is fine, they can surf and all that. If I reconfigure the Cisco 3560G to say
ip route 0.0.0.0 0.0.0.0 192.168.12.252
No one can go anywhere.
What excatly am I missing here??
NetworkingHardware Firewalls
Last Comment
dougp23
When you get that issue, are the PCs set with that default GW? Also, how many VLANs are on your network? Also, did you make sure to update the default GW programmed into the switch itself?
ASKER
The PCs are using the IP of the 3560G as their def gw.
Four VLANs on the net, the ASA and Sonicwall are both configured to reside in the 12 subnet.
I will have to check on the def gw on the switch. That might be it!
Four VLANs on the net, the ASA and Sonicwall are both configured to reside in the 12 subnet.
I will have to check on the def gw on the switch. That might be it!
Go ahead and double check, then just let us know!
If you are settings the PC's to a default gateway of 12.252 then you are using PC's on the same vlan as the sonicwall right?
Have you created routes for the other vlans on your network on the sonicwall to point back to the 3560G switch?
Have you created routes for the other vlans on your network on the sonicwall to point back to the 3560G switch?
ASKER
Hmm, the only info I see on the 3560 is
VLAN 12
Ip address 192.168.12.254 255.255.255.0
So it appears that there is no def gw for the switch? Probably that iproute statement takes it from there.
Yes, both the SW and ASA are on the same VLAN as the PCs.
I suppose I could just change DHCP to hand out the SW as the def gw, but can't figure out why it works with the ASA and not the SW. Both are NATing, etc.
The other VLANs are for phones so no real need to set any routes in the SW for them.
VLAN 12
Ip address 192.168.12.254 255.255.255.0
So it appears that there is no def gw for the switch? Probably that iproute statement takes it from there.
Yes, both the SW and ASA are on the same VLAN as the PCs.
I suppose I could just change DHCP to hand out the SW as the def gw, but can't figure out why it works with the ASA and not the SW. Both are NATing, etc.
The other VLANs are for phones so no real need to set any routes in the SW for them.
Do you have a route on the sonicwall directing routing requests from the 192.168.12.x network to the core switch?
On the sonicwall create a static route.
Source = Any
Destination = 192.168.12.0 255.255.255.0 (Assuming this is your internal network)
Service = Any
TOS/Mask = Any
Gateway = (Your core switch IP address)
Interface = x0
Metric= 1
On the sonicwall create a static route.
Source = Any
Destination = 192.168.12.0 255.255.255.0 (Assuming this is your internal network)
Service = Any
TOS/Mask = Any
Gateway = (Your core switch IP address)
Interface = x0
Metric= 1
ASKER
Penguinjas,
it is starting to look like you are right. I have a "pro" coming in this AM to solve the issue, but I *do* see routes on the ASA like this
route inside 192.168.16.0 255.255.255.0 192.168.12.254 1
route inside 192.168.19.0 255.255.255.0 192.168.12.254 1
route inside 192.168.20.0 255.255.255.0 192.168.12.254 1
So, I guess I am "network stupid". Why would I assign my PCs with a def gw of 192.168.12.254, and when they hit that and want to go somewhere, we push them to the 3560G which then pushes them ASA, which pushes them BACK to the 3560G???
And I *REALLY* thought the statement
ip route 0.0.0.0 0.0.0.0 192.168.12.253
was TOTALLY INCLUSIVE (i.e. I don't care where your from or where you're going, you're going to 192.168.12.253).
If I could understand this, it would be great, lol!
I will award you the points if my "pro" says that is the issue, but in comparing the configs, I do see all those routes in the ASA.
it is starting to look like you are right. I have a "pro" coming in this AM to solve the issue, but I *do* see routes on the ASA like this
route inside 192.168.16.0 255.255.255.0 192.168.12.254 1
route inside 192.168.19.0 255.255.255.0 192.168.12.254 1
route inside 192.168.20.0 255.255.255.0 192.168.12.254 1
So, I guess I am "network stupid". Why would I assign my PCs with a def gw of 192.168.12.254, and when they hit that and want to go somewhere, we push them to the 3560G which then pushes them ASA, which pushes them BACK to the 3560G???
And I *REALLY* thought the statement
ip route 0.0.0.0 0.0.0.0 192.168.12.253
was TOTALLY INCLUSIVE (i.e. I don't care where your from or where you're going, you're going to 192.168.12.253).
If I could understand this, it would be great, lol!
I will award you the points if my "pro" says that is the issue, but in comparing the configs, I do see all those routes in the ASA.
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
I guess I need to re-take Routing 101....
Pretty embarassing
Pretty embarassing
That wasn't my intent and we all tend to overlook things at times. it's a forest, trees scenario so don't beat yourself up. It's why Experts Exchange is here, to provide help for everyday IT.
ASKER
I am fine with it, and thanks so much for the help.
Sonic wall support was totally useless.
Sonic wall support was totally useless.