Raj,

I'm running c3560-ipservicesk9-mz.122-53.SE.  As far as the ACL goes, since the policy route gets applied before the static route, wouldn't the "access-list 1 permit xxxx" route ALL traffic from that subnet to 192.168.17.2?

And yes - vlan 20 is 192.168.17.0/24, 192.168.17.1 is the SVI on the switch, and 192.168.17.2 is the SVI on the ASA.

The 5505 won't do interVLAN routing, so it must be done on the switch.  I'm not terribly experienced in this stuff, so please bear with me

Well ASAs can forward traffic from one vlan to another... just like switches, but you would need to define appropriate security levels, rules,

nats or no-nats etc, which could add lots of other configurations on ASA.. if you want to do layer 3 on the switch, then you need to look at PBR.. if you are comfortable forwarding traffic to ASA (for layer3) then you can make that work too.. it depends..

btw, why have you put this in parallel to ASA ? Are you planning any kind of migration in future ? What are your plans ?

Raj

I'm not sure what you mean by "in parallel".  The idea was that the ASA does its firewall duties, and the 3560 handles internal routing.  I had no idea that I'd have to get into this PBR stuff, I'm still not quite sure why each L3 interface on the switch couldn't have its own routing table (i.e. each vlan has its own default route).

"in parallel" means running both the switch & ASA on the same subnet ? normally if you need to have ASA doing firewall, and switch doing L3, you will have a setup similar to this:

ASA 5505

|

switch L3

|

VLAN SVI on switch

|

PCs

so the PCs wouild have a default gateway towarsd the swtich and the swich would be connected on a different layer 3 segment to the ASA to make routing feasible.. but in your case you have ASA along side the switch... the layer 3 switch will just be having a single routing table to isolate routing loops .. if you need to have different routing policies for different vlans, you can still use policy based routing as described in my first post..

Raj

So this is what you'd recommend Mohamed?

http://www.cisco-tips.com/how-to-configure-a-cisco-layer-3-switch-intervlan-routing/

Hi Nathan

Since you already have a 3560, I would still go for a Layer 3 termination on the switch rather than trunking on the ASA... you will have better control and direct switching if you have layer 3 on the switch. Incase your switch does not have an EMI image (not to support PBR), you can have the ASA's terminating the layer 3 interface as given by the URL... im just thinking in terms of scalability.. Suppose you have 10 or 20 more vlans in future, it will be good to terminate the SVi's locally on the switch, rather than configuring 10 VLANs on the ASA, which would complicate things..

Raj

sequoyatech wrote:
So this is what you'd recommend Mohamed?
http://www.cisco-tips.com/how-to-configure-a-cisco-layer-3-switch-intervlan-routing/

Apologies for jumping in but why do you need to NAT the 2 internal vlans to different public addresses ?

Personally given the choice i would do as Raj says and use the 3560G for inter-vlan routing because put simply that's what it was designed for and it's good at it. The ASA is not designed to be responsible for inter-vlan routing. It can do it but the config gets quite complex and to be honest it's best left to get on with what it was designed to do ie. firewall.

Plus if you route off the ASA and the ASA crashes you have lost internal and external connectivity which may be a little difficult to explain when you have a perfectly good L3 switch to use internally.

Jon

Jon, are you asking why I have

nat (blue) 1 192.168.16.0 255.255.255.0

nat (blue) 2 192.168.16.6 255.255.255.255

?

The answer is that the server at .6 is required to have its own dedicated WAN IP.

I'm going to try with Raj's method, as it seems the most robust (not that I don't appreciate Mohamed's advice - it's always nice to see different ways of doing things).  As you might have suspected, I have a question regarding the ACL for the route-map. In plain terms, I want to policy-route any traffic to destinations that do not live on the switch (in my case, you can assume this means the internet). Can someone give an example of what the correct ACL would look like?

sequoyatech wrote:
Jon, are you asking why I have
nat (blue) 1 192.168.16.0 255.255.255.0
nat (blue) 2 192.168.16.6 255.255.255.255
?
The answer is that the server at .6 is required to have its own dedicated WAN IP.
I'm going to try with Raj's method, as it seems the most robust (not that I don't appreciate Mohamed's advice - it's always nice to see different ways of doing things).  As you might have suspected, I have a question regarding the ACL for the route-map. In plain terms, I want to policy-route any traffic to destinations that do not live on the switch (in my case, you can assume this means the internet). Can someone give an example of what the correct ACL would look like?

Nathan

No. i'm asking why you have to NAT 192.168.16.0/24 and 192.168.17.0/24 to different public IPs ?

It's actually quite an important question because if you don't need to then you don't need PBR.

Jon

Ah - in actuality, I don't have to for the 192.168.17.0/24 network.  It could use global 1.

edit - just saw your edit.  Can you elaborate?  As I said before, I appreciate everyone's patience. I'm doing my damndest to learn this stuff!