I have one client with the Public IP Address range for their WebServers:
They ask for more 16 ip's to the provider, and it was given the following range:
I had configured in the internet router, one vrf called internet, wich has Vlan5 associated and therefore logicaly attached to the firewall, trhougt a switch.
There is a NAT configured in the FireWall, translating the public ip address's, (webserver, mail, dns, etc..), into private one's.
This was working just fine with one network only.
Then the client was the need to implement another web services and ask for the provider another range of ip's.
** PROBLEM: **
The issue is that i configure the new network as a secondary in the same Vlan5, and i cant just access nothing in the Firewall.
The "show ip route vrf internet" see the new network in the vlan5, where i have the Firewall.
I have a Packteer between the Firewall and the router, and change the ip to the new range and works fine, but not reaching the new ip range, into the FireWall. (nothing reaches the FireWall log)
I think that i have to add a new network address in the Firewall, but i cant do it in the same NIC and have no more free NIC's.
If i buy another NIC card an configure the new address range, can i connect this in the same switch, i dont know if it will work fine in the same switch it is connected the existing one (2 networks ? in the same switch).
The G1/0/20, is configured with "switchport access vlan 5" command.
I tought to put it as a trunk , in both sides (router and swith) and make another vlan with the new range, but i think that have the same problem with the FireWall.
Do you have a drawing available in which you explain your issue?
As I understand now you configure two IP address ranges at the Router interface. This is from switching point of view no problem. You just have one broadcast domain VLAN5 with two IP subnets defined in it. Your firewall however only has an IP address in the first IP range so you have no ip connectivity at this stage. Creating a second interface at the Firewall and connecting that one into the VLAN5 is a possibility. However I would say that you try to configure a trunk for both the firewall AND the router and define a new VLAN so traffic is not mixed into the same broadcast domain.
After studying your drawing I found my previous reply still is ok. Another option could of course be to have a new separate interface configured at your Firewall into the new subnet. Also make sure you configure routing as needed if you do not use NAT in the same IP range.
We are pleased to announce availability of Beta software for 16.6.3.
16.6.3 will be the second rebuild on the 16.6 release train targeted
towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are
looking for early feedback from customers befor...
Introduction Featured Speakers Luis Espejel is the Telecommunications
Manager of IENova, an Oil & Gas company. Currently he works with Cisco
IOS® and Cisco IOS XE platforms, and NX to some extent. He has also
worked as a Senior Engineer with the Routing P...
In this session you can learn more about Layer 3 multicast and the best
practices to identify possible threats and take security measures. It
provides an overview of basic multicast, the best security practices for
use of this technology, and recommendati...