Routing issue - VPN 3002 , PIX 515E , 2621 , 3750 Switch

[g.brown]

Okay I have a PIX 515E as my default gateway on the LAN side (172.22.0.1) . I have a Cisco VPN 3002 with the LAN side being 172.22.0.3 and the PIX its default gateway .

I have a Cisco 2621 router on a Sprint Clearline (Point to Point T-1) that has a LAN address of 172.22.0.4.

The 3750 Switch is 172.22.0.5 and is the backbone switch.

I have a LAN to LAN IPSEC VPN that the 3002 runs where it routes 192.168.10.0 to the DG of the WAN side of the VPN 3002 WAN interface .

Currently I have static routes on the 3750 as follows:

192.168.2.0 -> 172.22.0.4

192.168.10.0 -> 172.22.0.3

13.0.0.0 - > 172.22.0.17

I have to add route statements to any computer on my LAN side that needs to connect to any of those networks. I know that my verision of the PIX will not redirect routes on the LAN side. I plan on upgrading here shortly to ver 7 of the software.

Can the 3750 do the routing or what is the best solution??

[jlkeys]

What is the default gateway for your PC's on the network? It sounds like you may just have the routes in the wrong place.

If your default gateway is your PIX, you might just consider terminating your VPN tunnel there instead and save your 3002 HW client for a rainy day.

[g.brown]

I have the PIX as the DG. I use the VPN 3002 for VPN as it is on a seperate Public IP than the PIX and the 2811 router passes traffic to each of them on seperate T-1s.

I also have these static routes defined on the PIX. I can ping each of these gateways from the PIX but not from my workstation unless I define a static route at the CMD line.

[jlkeys]

You could also just change the default gateway for the LAN to be the 3750 and do your routing there (and make your default gateway for the 3750 be the PIX).

[g.brown]

If I did that then what impact would that have on the 3750??

Right now that 3750 has 5 switchs plugged into along with 17 servers and 2 SFP ports.

Is it going to handle the routing aspect fine??

[jlkeys]

It shouldn't have much effect on it. The 3750 will route/switch at wirespeed. It shouldn't add much load at all beause you really don't have alot of traffic to route.

[jlkeys · Accepted solution]

You could also look at the 4500 series for your core instead of a 3750. They are pretty affordable and might be well suited for your network.

[g.brown]

Okay. Tks. I have about $8000 budgeted for a new core switch in my 2007 so I will take a look at the 4500 series.

Tks for all the help.