Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VLAN + HSRP + External FW

ok, here is ,y scenerio...

I have 2 6513's 12.2(18)SXF8 with SUP720's and MSFC3

Theses are interconnected via 10Gb trunks. This is working fine.

I also have 6 different VLANS witch are adentical on each switch, SW1's VLAN IP ends with .11 and SW2's IP ends with .12

I have setup HSRP between theses 2 switches for each VLAN. The setup for that looks like this (example of VLAN100)


int vlan 100

ip address

standby 100 ip

standby 100 priority 200 preempt

standby 100 track tengig 13/1 50


int vlan 100

ip address

standby 100 ip

standby 100 priority 100

So far this seems correct right? The puzzling issue I have is my firewall (fortigate) has 1 phusical interface for each VLAN.

The FW interface IP to the VLAN 100 is

Now... how do I send the traffic to the firewall so we can do the routing and ACL's on the firewall?


Re: VLAN + HSRP + External FW

Put a route MAP on the L3 interfaces on both Switches with the Next Hop pointing to the Firewall IP

New Member

Re: VLAN + HSRP + External FW

can you explain how to do this exactly?

Re: VLAN + HSRP + External FW

Why do you want to do routing on the Firewall ?

I prefer it this way. Put 1 static default route on the switch to point towards the Firewall IP.

Internal traffic goes via the L3 switch. INternet traffic goes through the PIX.

If you have a DMZ inside, then your point is valid, all traffic has to go throught the DMZ interface

Anyway - This is how it goes

access-list 111 permit ip any

route-map to-firewall permit 10

match ip address 111

set ip default next-hop

int vlan 100

ip policy route-map to-firewall

New Member

Re: VLAN + HSRP + External FW

ok, I will explain. The FW is a Fortinet box. Each VLAN is physicaly connected to the Fortinet. basicaly we have 6 VLANS, there is 6 cat5e going from the switch to the fortinet FW. This allows us to do ZONE ACL's on the Fortinet, for all VLANS instead of doing VACL's on the switch (basicaly easier to manage on the Fortinet). And also the fact that one of the vlan's is the DMZ like you mentioned.

ok, so I did this but in a litle different way...

route-map CORP permit 10

set next-hop

int vlan 104

ip policy route-map CORP

So I don't use ACL's.

What is the difference between :

"set ip default next-hop" and "set ip next-hop" ???

I want ALL traffic from the VLAN 104 going to the without exceptions, unless it's destined to a host within VLAN 104...

Am I doing this correctly? If so, how can I visualy see the traffic going to the fortinet, then comming back ?