Provide internet from core infrastructure

robert.parsons · ‎04-18-2009

We are preparing to lease office space and would like to provide internet access via our production infrastructure and would like some recommendations as how to proceed.

Our current infrastructure is as follows:

Cisco 6509 Layer 3 switch with a route to an ASA 5520 as its default gateway. .

When we lease teneant space, we'd like to provide internet access but with abosultely no way of getting to our internal network.

What is the best way to segregate their traffic not only from us but other tennants?

I do understand VLAN's will provide the segregation but won't the router just route and allow access to the other VLAN's?

lamav · ‎04-18-2009

Hi:

You can create a new vlans(s) to support the new tenants and even create a routed interface for them on your 6500. You are right that the L3 switch will see those vlans as directly conencted routes and route between them, but you can create extended access lists segregate that vlan's traffic.

Example:

Assume the new subnet you create is 10.10.1.0/24

And assume also that subnets 10.10.2.0/24 and 10.10.3.0/24 are part of your existing production environment.

You can do the following:

ip access-list extended SEGREGATE_VLAN

deny ip 10.10.1.0 0.0.0.255 10.10.2.0 0.0.0.255

deny ip 10.10.1.0 0.0.0.255 10.10.3.0 0.0.0.255

permit ip 10.10.1.0 0.0.0.255 any

interface vlan

ip address 10.10.1.0 255.255.255.0

ip access-group SEGREGATE_VLAN out

Note:

An access-list applied outbound to a vlan interface is traffic going TO machines on that vlan.

An access-list applied inbound to a vlan is traffic coming FROM machines on that vlan.

robert.parsons · ‎04-18-2009

Sweet. I figured an access list would work but was not sure how to make it happen. Thanks a lot!

lamav · ‎04-18-2009

Hi:

Glad I could help. :-)

Please rate all helpful posts.

Thanks

Victor

Giuseppe Larosa · ‎04-19-2009

Hello Robert,

I would consider VRF lite that provides built-in segregation.

You need an additional interface on the ASA but this is more secure and doesn't need to be updated if you change addressing in internal network.

The idea is to put the tenants' ip subnets SVI Vlans in the VRF and also the additional link towards the ASA.

in this way they are separated end-to-end from the internal network that is the global routing table.

see

http://www.cisco.com/en/US/products/hw/routers/ps259/prod_bulletin09186a00800921d7.html#wp30356

Hope to help

Giuseppe