Solved

Sonicwall Config and CIsco 3560

Posted on 2013-11-19
11
553 Views
Last Modified: 2013-11-22
So here's the network:

Lots of local users, 192.168.12.x.  Users are given an IP thru DHCP, and their default GW is 192.168.12.254.  The 254 addy is a Cisco 3560G switch.  In the configs of the 3560, we have a line that says

ip route 0.0.0.0 0.0.0.0 192.168.12.253

The 253 is our Cisco ASA 5505.

Now I have setup a Sonicwall to replace the ASA, and am just doing some testing.  I assigned an internal IP to the Sonicwall of 192.168.12.252.  If I set up PCs with a def gw of 12.252, everything is fine, they can surf and all that.  If I reconfigure the Cisco 3560G to say

ip route 0.0.0.0 0.0.0.0 192.168.12.252

No one can go anywhere.

What excatly am I missing here??
0
Comment
Question by:dougp23
  • 5
  • 4
  • 2
11 Comments
 
LVL 20

Expert Comment

by:masnrock
ID: 39660778
When you get that issue, are the PCs set with that default GW? Also, how many VLANs are on your network? Also, did you make sure to update the default GW programmed into the switch itself?
0
 
LVL 1

Author Comment

by:dougp23
ID: 39660818
The PCs are using the IP of the 3560G as their def gw.
Four VLANs on the net, the ASA and Sonicwall are both configured to reside in the 12 subnet.
I will have to check on the def gw on the switch.  That might be it!
0
 
LVL 20

Expert Comment

by:masnrock
ID: 39660846
Go ahead and double check, then just let us know!
0
 
LVL 6

Expert Comment

by:penguinjas
ID: 39660979
If you are settings the PC's to a default gateway of 12.252 then you are using PC's on the same vlan as the sonicwall right?

Have you created routes for the other vlans on your network on the sonicwall to point back to the 3560G switch?
0
 
LVL 1

Author Comment

by:dougp23
ID: 39661069
Hmm, the only info I see on the 3560 is

VLAN 12
Ip address 192.168.12.254 255.255.255.0

So it appears that there is no def gw for the switch?  Probably that iproute statement takes it from there.

Yes, both the SW and ASA are on the same VLAN as the PCs.  
I suppose I could just change DHCP to hand out the SW as the def gw, but can't figure out why it works with the ASA and not the SW.  Both are NATing, etc.

The other VLANs are for phones so no real need to set any routes in the SW for them.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 6

Expert Comment

by:penguinjas
ID: 39664004
Do you have a route on the sonicwall directing routing requests from the 192.168.12.x network to the core switch?

On the sonicwall create a static route.  

Source = Any
Destination = 192.168.12.0 255.255.255.0 (Assuming this is your internal network)
Service = Any
TOS/Mask = Any
Gateway = (Your core switch IP address)
Interface = x0
Metric= 1
0
 
LVL 1

Author Comment

by:dougp23
ID: 39668770
Penguinjas,

it is starting to look like you are right.  I have a "pro" coming in this AM to solve the issue, but I *do* see routes on the ASA like this

route inside 192.168.16.0 255.255.255.0 192.168.12.254 1
route inside 192.168.19.0 255.255.255.0 192.168.12.254 1
route inside 192.168.20.0 255.255.255.0 192.168.12.254 1

So, I guess I am "network stupid".  Why would I assign my PCs with a def gw of 192.168.12.254, and when they hit that and want to go somewhere, we push them to the 3560G which then pushes them ASA, which pushes them BACK to the 3560G???
And I *REALLY* thought the statement

ip route 0.0.0.0 0.0.0.0 192.168.12.253

was TOTALLY INCLUSIVE (i.e. I don't care where your from or where you're going, you're going to 192.168.12.253).

If I could understand this, it would be great, lol!
I will award you the points if my "pro" says that is the issue, but in comparing the configs, I do see all those routes in the ASA.
0
 
LVL 6

Accepted Solution

by:
penguinjas earned 500 total points
ID: 39669418
Think of it like this.  Pretend the 3560G and the Firewall are traffic cops.  They direct the traffic around the network.  When a packet reaches the 3560G it uses the DG info you configured to direct all traffic (0.0.0.0 - 0.0.0.0) to the firewall.

The firewall then uses it's routes to decide where to send packets (0.0.0.0 - 0.0.0.0 -> upstream ISP).  Now in order for the response from the upstream ISP to return to the computer that sent the packet you have to have routes defined to get back.

 So the firewall receives the packet from the ISP and then looks for a route back to the host computer.  If there isn't one routing fails.  If you have a route that says to reach the 192.168.254.x network send packet to 3560G ip address then the packet is forwarded on and once the 3560G receives it it will deliver the packet back to the host computer.
0
 
LVL 1

Author Closing Comment

by:dougp23
ID: 39669728
I guess I need to re-take Routing 101....
Pretty embarassing
0
 
LVL 6

Expert Comment

by:penguinjas
ID: 39669967
That wasn't my intent and we all tend to overlook things at times. it's a forest, trees scenario so don't beat yourself up. It's why Experts Exchange is here, to provide help for  everyday IT.
0
 
LVL 1

Author Comment

by:dougp23
ID: 39670526
I am fine with it, and thanks so much for the help.
Sonic wall support was totally useless.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now