Unsolved
This post is more than 5 years old
16 Posts
0
14585
July 19th, 2005 19:00
6024 Disable routing between VLANS, and multiple default routes..
I have 2 networks, lets call them 10.1.2.0/27 (.0-.30) and 10.1.2.128/25 (.128-.254). These networks are seperate due to our firewall needs. (they are really routable IP's, but changed for privacy) The /27 is our DMZ, the /25 is our Admin network. The DMZ of course, has its own firewall port, and the Admin network does too. I want to use the 6024 as the "router" behind our PIX, but am having difficulty putting them both on the system. The problems seem to bee with our VLANS. I give VLAN DMZ (10) the address of 10.1.2.29 and VLAN (ADM) 20 the address of 10.1.2.253. I setup a default route of 10.1.2.254. I need to then setup VLAN DMZ to have a default route of 10.1.2.30. then, I need to make the VLANS not ever, ever talk to each other. If they route between each other, (wich seems to be the case) then I ruin the security of having a seperate DMZ. I want all traffic from each network to have to walk across our firewall to reach the other "side." I guess the simple way to describe it is that I want to break the 6024 into two seperate routing switches. 1 doing ports 1-12, and one doing ports 13-24. Is it possible to setup default routes per VLAN, and force them to not route between each other? Any suggestions would be more than appreciated.
No Events found!
QRiff
16 Posts
0
July 19th, 2005 19:00
Brian
DELL-Randy
132 Posts
0
July 21st, 2005 16:00
ACL [DMZ]
console(config-ip-al)# permit any 10.1.2.0 0.0.0.31 10.1.2.0 0.0.0.31
ACL [ADM]
console(config-ip-al)# permit any 10.1.2.128 0.0.0.127 10.1.2.128 0.0.0.127
Hope this helps.
QRiff
16 Posts
0
August 2nd, 2005 16:00
Thanks,
Brian
DELL-Randy
132 Posts
0
August 2nd, 2005 17:00
Two Default Routes (0.0.0.0 /0) will certainly have an adverse effect. This is easily achievable via the same method as the ACL, with the exception you use a standard subnet mask as opposed to an inverse subnet mask and you may also utilize CIDR notation. You will need (2) static routes for the desired results. From Global Configuration Mode --
QRiff
16 Posts
0
August 3rd, 2005 01:00
console(config)# ip route 10.2.1.0 /27 10.2.1.30
[ADM] (VLAN 20)
console(config)# ip route 10.2.1.128 /25 10.2.1.254
I am trying to implement this, however, It is not having the effect i need. I need all traffic on VLAN (or subnet) DMZ=10.2.1.0 /27 to go out through one IP address, and the other VLAN ADM(or subnet) to go out through another.
Basically, i need:
ADM or Subnet 10.2.1.128 /25 to have
0.0.0.0 0.0.0.0 10.2.1.254
and DMZ or subnet 10.2.1.1 /27 to have something similar to:
0.0.0.0 0.0.0.0 10.2.1.30
So basically, I am really trying to split this router up into 2 seperate routers, with they're own default gateways for each "virtual router" Whether I do this with VLAN's, subnets, or ports is no matter to me, so long as we have our seperate subnets kept seperate. I am using the 6024 as the "inside router" behind our PIX. Pixen have this nasty feature where I cannot use their interfaces as gateways on my network, because I cannot go in and back out the same interface on them. So i point all my ADM workstations to use the 6024 as their gateway (vlan 20 or ADM ip 10.2.1.253), and forward all traffic to the PIX firewall (10.2.1.254) that is not on the local subnet.(currently done by a default route of 0.0.0.0 ..) I would like to use the 6024 (using VLAN 30 or DMZ ip 10.2.1.29) to do the same thing for my server subnet, and forward non local traffic to the DMZ port on the pix (10.2.1.30) I can setup access lists to prevent the subnets from talking,, but the default routes are throwing me off.