VLANs and ASA5515-X

[Rizwan]

Hi, 

I have created multiple VLANs on Cisco 3750 switch and configured inter-VLAN routing. Cisco ASA 5515-X is internet gateway, should I also create VLANs on ASA and should I made trunk port between firewall and Cisco 3750?

[Rizwan]

It works only with one default route, with two default routes of same metric traffic does not find the right path and two default routes of different metrics only one default route is appeared. Its not possible to implement PBR on Cisco3750 switch. 

[Marius Gunnerud]

and two default routes of different metrics only one default route is appeared.

This is expected, as when you set default routes with different metrics it is usually that the one with the higher metric will be the backup default route. If you have two default routes with the same metric, traffic will be loadbalanced over the two interfaces.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I think I need two Cisco 3750 switches one with each gateway. PBR will not be required in this case. 

[Marius Gunnerud]

Do you mean to have the seperate networks connected to its own switch?

Before you do that, I would suggest looking into the price of the IP Services license and compair that with purchasing a 3750X switch...it might be more financially viable getting the license.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

Yes, separate networks on its own switch and I will make trunk between both switches for Vlans communication, Inter-vlan routing will be distributed on both switches and vlans will go to internet from separate internet gateways. One default route on each switch. Is it possible? I am not implementing policy based routing therefore IP services is not required nor 3750x.

[Marius Gunnerud]

As long as the networks are on separate switches you will be fine with what you have described.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I want to filter inter-vlans routing between different vlans using access-lists on Cisco 3750 switch. Please let me know where to apply this access-list? in vlan interface?

[Marius Gunnerud]

What access-lists are you talking about?

As long as the networks are physically connected to seperate switches and each switch has its own (different) default gateway, the switch that the traffic first enters will determine the default gateway that traffic uses.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I want to filter inter-vlan routing traffic for example I have following Vlans

Vlan 3, Vlan 5, Vlan 10 

Vlan 3:   172.16.5.0/24

Vlan 5:    192.168.50.0/24

Vlan 10:  192.168.100.0/24

Now I want to apply ACL to block vlan 5 and vlan 10 traffic to vlan 3

access-list 101 deny ip 192.168.50.0 0.0.0.255 172.16.5.0 0.0.0.255

access-list 101 deny ip 192.168.100.0 0.0.0.255 172.16.5.0 0.0.0.255

access-list 101 permit ip any any 

interface vlan3 

ip add 172.16.5.1 255.255.255.0 

ip access-group 101 in 

Is the above configuration correct?

[Marius Gunnerud]

Your configuration should work on routed packets. Keep in mind that it will only have affect on routed packets and not on bridged frames.

If your configuration does not give you the desired result try using VLAN ACLs (VACLs)

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swacl.html

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I have a question related to management VLAN, is it necessary to configure management vlan as native vlan?

[Marius Gunnerud]

The ASA tags VLANs individually and therefore does not use the concept of native VLANs.  whichever VLAN you configure as native VLAN on the switch has no effect on how the ASA acts.

--

Please remember to select a correct answer and rate helpful posts