Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
You may experience some slow load times, errors, and slight inconsistencies. We ask for your patience as we finalize the launch. Thank you.

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Basic Question about Routing between L3 Switch and FW

Ok, this is my setup.

I have a Layer 3 switch running 4 L2/L3 VLANs, each one has its own L3 interface on the switch. There is an "inside" trunk to the ASA FW that also has a L3 sub interface for each of these VLANs. I want to apply ACL's to both the te interfaces on the FW and the switch so the traffic is filtered in both places. However, when I set the clients gateway as the switch L3 interface, traffic doesnt work, when its the FW L3 interface as the gateway, it does work (talking icmp here). I get dest net unreachable when the gw is the switch.

How do I get the L3 interface of the switch to forward the traffic to the relevant interface on the FW? For example, VLAN 10 on the switch 10.11.120.1 to forward traffic to the L3 interface of the FW 10.11.120.2?

Thanks in advance,

Dan

  • LAN Switching and Routing
8 REPLIES

Basic Question about Routing between L3 Switch and FW

Hello,

Use Policy Based Routing (PBR) on the Switch.

Regards,

Moahmed

New Member

Basic Question about Routing between L3 Switch and FW

thanks Mohamed, but its only a 3560 and doesnt support it.

Dan

New Member

Basic Question about Routing between L3 Switch and FW

my mistake, it is supported. I think I just create an ACL for the traffic I want the rm to apply to, create the route map and define the next hop as being the L3 int of the FW?

Dan

New Member

Basic Question about Routing between L3 Switch and FW

even when applying PBR, the traffic still doesnt seem to go to the FW, as it has a VLAN interface that is directly connected.

Any way around this?

Dan

New Member

Basic Question about Routing between L3 Switch and FW

sorry.. I could not understand the following statement.

Daniel Bowen wrote:

. I want to apply ACL's to both the te interfaces on the FW and the switch so the traffic is filtered in both places.

not sure why the filter is applied on both the places?

also, can you pls share your PBR configs?

-Vijay

New Member

Basic Question about Routing between L3 Switch and FW

Dan,

Sounds like it might be a routing issue. For example, how does VLAN 10 know the route to the firewall? You said "when its the FW L3 interface as the gateway, it does work". So it does work? I might have missed something there.

I dealt with this by getting rid of the virtual interfaces on the ASA and just having the single interface that I connected to my L3 switch and then routed the traffic to it from there.

For example ge0/1 on the L3 switch would connect to the ASA with the below info added to your config:

interface GigabitEthernet0/1

no switchport

ip address 10.11.120.1 255.255.255.0

ip route 0.0.0.0 0.0.0.0 10.11.120.2

I might be barking up the wrong tree, but hope that helps.

Ted

New Member

Basic Question about Routing between L3 Switch and FW

Im a little confused myself. Yes, if I set the FW sub int as the default gateway, the traffic works fine, it hits the ACL on the FW interface and works. What I want to do is have the default gateway for each VLAN as the L3 switch interface, then route this traffic to the FW to be filtered.

For example:

VLAN 1 - Switch IP 10.10.10.1 - FW IP 10.10.10.2

default gateway 10.1

so I thought Id set up PBR to amend the next hop based on the traffic flow, as a single default route will not allow me to do this.

Dan

Basic Question about Routing between L3 Switch and FW

Isn't it just easier to just have a router-on-a-stick on the FW (if that is possible), than have routing done on the switch and on the FW, becuase it is going to the FW anyway...

367
Views
0
Helpful
8
Replies