Hello everyone! Currently, I put a new DMZ into place on our Sonicwall. I have a web server that resides with that DMZ and it needs to communicate to a SQL box within our production network. Gravvy, I have all that setup and working this far.

 

My problem: I don't want ANY other VLANS to be able to communicate with the VLAN the SQL box sits on.  It's VLAN is 10.10.60.0 /24.

 

Our topology goes as follows;

 

We have our Sonicwall NSA 2400, from there it goes to our first floor Dell Stack of 6224's.. and then thats connected to our DataCenter Stack of 6224s.

The 1st floor stack is setup as the default GW for everything, and every vlan has an "interface" on it.  The stacks mgmt address is 10.10.100.1.  The mgmt address for the stack downstairs is .3, and the firewall is .2.

 

I create the following ACL and put it on the DC stack,

access-list DMZTraffic permit ip 10.10.50.0 0.0.0.255 10.10.60.0 0.0.0.255
access-list DMZTraffic permit ip 10.10.60.0 0.0.0.255 10.10.60.0 0.0.0.255

I assigned it to VLAN 60, and it did not work. It just stopped all communication.. nothing was able to ping VLAN 60 or access any part of it. Whats odd is I changed the source to any, and communication was still down. As soon as I remove the ACL from the interface VLAN 60, I could ping from my DMZ to my 60.0 /24 network.

 

 

 

 

Here is the 1st Floor CFG:

!Current Configuration:
!System Description "PowerConnect 6224F, 3.3.1.10, VxWorks 6.5"
!System Software Version 3.3.1.10
!Cut-through mode is configured as disabled
!
configure
vlan database
vlan 2,10,15,60,90,100-103,221
vlan routing 90 1
vlan routing 101 2
vlan routing 102 3
vlan routing 103 4
vlan routing 100 5
vlan routing 15 6
vlan routing 2 7
vlan routing 221 8
vlan routing 60 9
exit
hostname "1Floor-Rack3-Switch1"
sntp unicast client enable
sntp server 10.10.100.9

sntp server 10.10.100.10 priority 2
clock timezone -5 minutes 0
stack
member 1 3
member 2 2
exit
ip address 10.10.130.2 255.255.255.0
ip default-gateway 10.10.130.1
logging file debug
ip routing
ip route 0.0.0.0 0.0.0.0 10.10.100.2
ip route 172.30.10.0 255.255.255.0 10.10.100.3
ip route 172.30.30.0 255.255.255.0 10.10.100.3
ip route 172.40.10.0 255.255.255.0 10.10.100.3
ip route 172.40.30.0 255.255.255.0 10.10.100.3
ip route 172.30.150.0 255.255.255.0 10.10.100.3
ip route 192.168.0.0 255.255.254.0 10.10.100.2
ip route 10.10.0.0 255.255.255.0 10.10.100.2
ip route 10.10.3.0 255.255.255.0 10.10.100.2
ip route 10.10.4.0 255.255.255.0 10.10.100.2
ip route 10.10.5.0 255.255.255.0 10.10.100.2

ip route 10.10.96.0 255.255.255.0 10.10.100.2
ip route 172.30.151.0 255.255.255.0 10.10.100.3
ip route 10.10.98.0 255.255.255.0 10.10.100.3
ip route 10.10.6.0 255.255.255.0 10.10.100.2
router rip
no enable
redistribute connected metric 1
redistribute static metric 1
exit
interface vlan 2
name "OW Prod Wifi"
routing
ip address 10.10.2.1 255.255.255.0
bandwidth 10000
ip helper-address 10.10.100.9 dhcp
ip mtu 1500
exit
interface vlan 15
name "HOPE"
routing
ip address 192.168.15.252 255.255.255.0

exit
interface vlan 60
name "OWHosting"
routing
ip address 10.10.60.1 255.255.255.0
exit
interface vlan 90
name "Phone System VLAN"
routing
bandwidth 10000
ip mtu 1500
exit
interface vlan 100
name "Datacenter VLAN"
routing
ip address 10.10.100.1 255.255.255.0
exit
interface vlan 101
name "OneWorld 1st Floor"
routing
ip address 10.10.101.1 255.255.255.0

ip helper-address 10.10.100.9 dhcp
exit
interface vlan 102
name "OneWorld 2nd Floor"
routing
ip address 10.10.102.1 255.255.255.0
ip helper-address 10.10.100.9 dhcp
exit
interface vlan 103
name "OneWorld 3rd Floor"
routing
ip address 10.10.103.1 255.255.255.0
ip helper-address 10.10.100.9 dhcp
exit
interface vlan 221
name "OW-Guest Wifi"
routing
ip address 10.20.2.1 255.255.255.0
exit

 

 

 

 

And here is the DC Stack:

 

!Current Configuration:
!System Description "PowerConnect 6248, 3.3.1.10, VxWorks 6.5"
!System Software Version 3.3.1.10
!Cut-through mode is configured as disabled
!
configure
vlan database
vlan 15,60,98,100,120,160,170,180
vlan routing 98 1
vlan routing 100 3
exit
snmp-server location "Datacenter Rack A6"
snmp-server contact "Steve Elgan"
hostname "Datacenter-Dell-Stack"
sntp unicast client enable
sntp server 10.10.100.9
clock timezone -5 minutes 0
stack
member 1 2
member 2 2
exit

switch 2 priority 11
ip address 10.10.130.3 255.255.255.0
ip default-gateway 10.10.130.1
logging file warning
ip routing
ip route 172.30.10.0 255.255.255.0 10.10.98.254
ip route 0.0.0.0 0.0.0.0 10.10.100.1
ip route 10.10.101.0 255.255.255.0 10.10.100.1
ip route 10.10.102.0 255.255.255.0 10.10.100.1
ip route 10.10.103.0 255.255.255.0 10.10.100.1
ip route 172.30.30.0 255.255.255.0 10.10.98.254
ip route 172.40.10.0 255.255.255.0 10.10.98.254
ip route 172.40.30.0 255.255.255.0 10.10.98.254
ip route 172.30.150.0 255.255.255.0 10.10.98.254
ip route 10.10.2.0 255.255.255.0 10.10.100.1
ip route 192.168.0.0 255.255.254.0 10.10.100.1
ip route 10.10.0.0 255.255.255.0 10.10.100.1
ip route 10.10.3.0 255.255.255.0 10.10.100.1
ip route 10.10.4.0 255.255.255.0 10.10.100.1
ip route 10.10.5.0 255.255.255.0 10.10.100.1
ip route 10.10.96.0 255.255.255.0 10.10.100.1

ip route 172.30.151.0 255.255.255.0 10.10.98.254
ip route 10.10.6.0 255.255.255.0 10.10.100.2
router rip
no enable
redistribute connected metric 1
redistribute static metric 1
exit
interface vlan 15
name "HOPE"
exit
interface vlan 60
name "OWHosting"
exit
interface vlan 98
name "TO-HN"
routing
ip address 10.10.98.1 255.255.255.0
bandwidth 10000
ip mtu 1500
exit
interface vlan 100

name "OW Datacenter"
routing
ip address 10.10.100.3 255.255.255.0
bandwidth 10000
ip mtu 1500
exit
interface vlan 120
name "Replication"
exit
interface vlan 160
name "VMotion"
exit
interface vlan 170
name "NFS"
exit
interface vlan 180
name "iSCSI"
exit

 

 

 

 

Any help would be appreciated! Would it have to do with the fact that I dont have routes put in for that network in specific? Im using the default routes to get traffic down stairs.  Once I put the acls in place, and I do a tracert.. it stops at 100.1. Thanks!