I am working with an ASA 5525 and Cisco 6509-E Switch. I am unable to RDP to servers on different Subnets and get to the internet when the DFGW is set to the SVI.
Outside Interface- 172.16.100.254- Connected to FATPipe Loadbalancers/Internet
WebDMZ interface- 192.168.10.254 Set up for 1 to 1 NAT to Web Servers load balanced by FatPipe
Server Interface -192.168.40.254
VLAN SVI- 10
VLAN SVI 40
1) I am unable to RDP to servers on the 10 VLAN from Servers on the 40 VLAN or visa versa, Ping and trace work from all devices, firewall shows RDP port open. What am I missing here?
2) I have set the DFGW to the SVI and am unable to get to the internet unless the switch's DFGW is on the same Subnet.
If I set the DFGW to the corresponding port on the firewall I am able to get out to the internet. Wouldn't routing be taking care of this?
The scenario- PC -192.168.40.40 DFGW 192.168.40.1 Switch = no default route No internet access. However can ping the firewall port of 192.168.40.254
Scenario B PC 192.168.40.40 DFGW 192.168.40.254 Switch = no default route/ Internet access but no vlan to vlan communication besides ping and trace.
Scenario C PC 192.168.40.40 DFGW 192.168.40.1 Switch route 0.0.0.0 0.0.0.0 192.168.40.254= Internet access is good.
I am missing something but I thought on the 6509 routing was on and that routing would be taking place on the SVI's.
What I want is a core switch with L3 routed VLAN's I want all of the VLAN's to get to the firewall and out to the internet.
I want the DMZ shut down to anything that is not specified (RDP, Management etc.)
Maybe I want too much. :)