VLANS and Pixs

[mlabuguen]

Hi guys,

Here is the situation...

The inside interface on our 515 FW ver 6.3(1) has IP address of 172.20.20.2. We have also a catalyst switch configured for two vlans, 172.20.20.x (vlan20) & 172.20.21.x (vlan21). The inside interface of the PIX is connected to a port on the switch configured for vlan 20. Question is... do I have to configure that catalys switch port, connecting the inside intf of the pix, as a trunk port with encapsulation dot1q for the pix to accept both vlan 20 and 21 data?

Do i configure anything on the PIX end?

Thanks!

Marvin

[l.mourits]

Hi Marvin,

You have not provided us with the type of catalyst switch. If this is a layer-3 type switch and you are allready routing on this layer-3 switch, you have to do nothing else then what you allready connect (okay, besides setting the default route on your layer-3 switch, pointing to the PIX)

What I´m curious about is where did your routing took place for traffic between this two vlan´s before the PIX was installed? The answer to that question answers also your own question I´ll guess.

If you have no routing between the two vlan´s in the old situation, and you want both vlan´s to communicate trough the pix, you indeed have to connect both vlan´s to the PIX. From version 6.3.1 I believe it is possible to use 802.1q trunk to a PIX, but I´ll have to check this.

Hope this helps, otherwise please provide more detail about your setup, and what you try to achieve, cause this will hep answer your question.

Kind Regards,

Leo

[r.crist]

Hey Marvin:

Not exactly sure the other fella that answered your question was talking about, but in my opinion the answer to both of your questions is "yes". You need to configure the switch port as a dot1q trunk and trunk vlans 20 and 21. Use a vlan other than 20 or 21 as the native vlan for this switch port - use vlan 1 - and then don't trunk the native vlan. Packets on the native vlan are untagged and could possibly present some security vulnerabilities. Switch config:

set vlan 1

clear trunk 1-1005

set trunk on dot1q 20,21

set port channel mode off

set spantree portfast enable

set port speed 100

set port duplex full

You also need to configure vlans on your PIX. (Which is an awesome feature. Now all cisco needs to do is enable the PIX to do QoS..) Here's the config for your PIX (i'm assuming that ethernet1 is your inside intf):

interface ethernet1 100full

interface ethernet1 vlan20 physical

interface ethernet1 vlan21 logical

nameif ethernet1 inside security50

nameif vlan21 OtherVLAN security50

ip address inside 172.20.20.ddd 255.255.255.0

ip address OtherVLAN 172.20.21.ddd 255.255.255.0

That should be all you need to get the PIX to forward traffic from both vlans. Hope this helps!

Rich