Integrating ISR, FTD and Nexus

[TheGoob]

Hello, so I am waiting to purchase CML but in the meantime curious about a possible scenario I want to implement. I am hoping the spacing and intentions come across, more so the spacing so the “hierarchy” makes sense, but we can work on that. 

[TheGoob]

Apparently it does not want to allow me to input code… Coming later. 

[TheGoob]

Not sure how to get the spacing right, It seems to look correct at full screen

DSL MODEM
   Bridge Mode

|
|
|

ISR1100 [PPPoE]
   NAT DYNAMIC x.x.x.177 - 192.168.6.0
   NAT DYNAMIC x.x.x.178 - 192.168.2.0
   NAT DYNAMIC x.x.x.179 - 192.168.3.0
   NAT DYNAMIC x.x.x.180 - 192.168.4.0
   NAT DYNAMIC x.x.x.181 - 192.168.5.0
   NAT DYNAMIC x.x.x.182 - 192.168.1.0 [Also default ISR WAN IP]
       NAT's For ISR to know which LAN Subnets resolve to which WAN Static IP
   ACL's
       Setting the ACL's for Networks 1,2 and 6
       FPR will handle ACL's for it's Networks [3-5]
   STATIC ROUTE; x.x.x.3.0 - x.x.x.5.0 [Network] 0.0.0.0 192.168.7.2
       For ISR1100 to know where to find Subnet 3-5 [Which are on Nexus, through the FPR]
   STATIC ROUTE; x.x.x.1.0 - x.x.x.2.0, x.x.x.6.0 [NETWORK] 0.0.0.0 192.168.8.2
       For ISR1100 to know where to find Subnet 1-2,6
   GE 1/1 - WAN IP from ISP obtained by PPPoE
   GE 1/2 192.168.7.1 255.255.255.0 
       ISR Interface and IP which is connected to FPR GE 1/1 [IP 192.168.7.2] for routing between ISR and FPR.
   GE 1/3 192.168.8.1 255.255.255.0
       ISR Interface and IP which is connected to Nexus GE 1/1 [IP 192.168.8.2] for routing between ISR and Nexus.
|                                       |
|                                       |
|                                       |
|                                       |
|                                       FPR1010
|                                           GE 1/1 192.168.7.2 255.255.255.0
|                                               FPR Interface and IP which is connected to ISR1100 GE 1/2                                     
|                                           GE 1/8 192.168.9.1 255.255.255.0
|                                               Interface/IP connects to Nexus 1/49 [IP 192.168.9.2] for routing from FPR and Nexus.
|                                           NAT
|                                               NAT was done on ISR [Or should NAT be done for these WAN to LAN Networks on here?]
|                                           ACL's
|                                               Setting the ACL's for the 3-5 Subnets
|                                           STATIC ROUTE; 192.168.3.0 - 192.168.5.0 0.0.0.0 192.168.9.2
|                                               For FPR to know where to find Subnet 3-5 [Which are on Nexus]
|                                            |
|                                            |
|                                            |
|                                            |
                  NEXUS 9K

GE 1/1  192.168.8.2 255.255.255.0
   Nexus Interface and IP which is connected to ISR1100 GE 1/3
GE 1/49 192.168.9.2 255.255.255.0
   Nexus Interface and IP which is connected to FPR1010 GE 1/8
VLAN 1-6
   192.168.1.0
   192.168.2.0
   192.168.3.0
   192.168.4.0
   192.168.5.0
   192.168.6.0
DHCP Server
   Each Network has it's own DHCP Server
DNS
   I will be hosting my own DNS Server and all DHCP Servers will grab that, I will have 8.8.8.8 as Secondary.
PBR
   vlan 1-2,6 will use GE 1/1 192.168.8.2 for it's Internet 
   vlan 3-5 will use GE 1/49 192.168.9.2 for it's Internet
       In this instance because I am using PBR's, will these be their "default routes' back towards Internet?

Access-- EVERYTHING will now be hosted on the same Nexus and can be routed all through Nexus. 

[TheGoob]

My main question is, with a Block of 8 [6 Usable] Static WAN IP's, could I split them across the ISR and FPR? For example, I assume the ISR, being first to touch the DSL Modem, would have to do all LAN-to-WAN NAT's [WAN IP to LAN Network]. Through a L3 link, some of the Networks will be on the FPR for more secure Firewall capabilities [like my email servers and web servers and ssh etc] and another L3 Link, some will continue on to the Nexus. There will be 2 L3 Interfaces for routing [and return route Internet links]. The FPR will then connect to the Nexus along with the other Networks that came straight from ISR to Nexus.

So, Nexus has 6 Networks; 3 directly from ISR [No FTD] and 3 from FPR1010 [FTD]. After the NAT on ISR [Or being that the FTD will have it's own 3 IP's to process, do I do the 3 NAT on there?] they will all come together on 6 DHCP Servers of their own, 6 networks, and can all communicate through the Nexus but their Internet IP's will be correctly routed to their WAN IP's.

At this stage I assume I will need PBR's to let each DHCP Server/Network know how to route back to the Internet.

Sorry, have not slept in 2 days [pneumonia] so I hope this makes some sense?

[balaji.bandi]

This can be achieved high level of your thinking  - the the information not clear for us how these are connected.

Can you make a small diagram where physcally each other corrected.

You have public IP you use for NAt inside to outside and outside to inside static or dynamic on your ISR router)

[TheGoob]

Hopefully this looks somewhat what I was describing... If not I am just gonna put CML on credit card and do this.

[balaji.bandi]

Hope you have trunk between ISR and nexus and suggest to only allowed required vlan in that trunk.

as i understand all the subnet have gateways located in nexus switch right ?

1 2 6 networks  ok,  3 5 required some static routing towards FW and FW to nexus  (taking that FW is route mode).

i take NAT is taking place all in ISR ? 

all should be ok and working as expected, any issue post the challange you have where not working for us to assits better.

[TheGoob]

Hello, thanks for the response.

Correct me if I am wrong but there will be no networks or vlans on the ISR, so I was not going to do a trunk. The ISR was simply going to do 6 NAT’s; 1 for each WAN IP to LAN Network.

My thoughts was to have GE 1/2 be like 192.168.8.1 and (in example) Nexus GE 1/1 be 192.168.8.2 and then on ISR do a static route 192.168.1.0 0.0.0.0 192.168.8.2, 192.168.2.0 0.0.0.0 192.168.8.2 and so on. So no Trunk. 
The ISR was for NAT only.

[balaji.bandi]

Sure that works - as long as you have routing.

you have not mentioned what device doing DHCP  for all subnets ?

[TheGoob]

I have successfully created 3 DHCP Servers for the 6 subnets on the Nexus via the guestshell.

[balaji.bandi]

Good hear you able to progress - you are in right track.

[liviu.gheorghe]

You can reserve a CML lab for 8 hours on https://devnetsandbox.cisco.com/DevNet/catalog/cml-sandbox

The version in the Devnet sandbox is older than what's available now for the CML Personal, but I think it's worth a try. And it's free.

[TheGoob]

Roger that. I will take a look at that this evening, thank you.

[TheGoob]

Wanting to reaffirm this;

Being that on the Nexus there will be vlan 1-6 [with their own subnets] and both vlans are connected to either A. FPR [network 3-5] and B. ISR [network 1-2,6] I will need (2) PBR Rules.

For example on Nexus GE 1/1 will be 192.168.8.2 [going to ISR] and GE 1/49 will be 192.168.9.2 [going to FPR]. I need to make a PBR vlan 1-2,6 to route out [for internet] on 192.168.1.2 GE 1/1 and vlan 3-5 to route out [for internet] on 192.168.9.2 GE 1/49.

Assuming so far this is accurate [because each vlan [6 of them] will indeed have their own WAN IP]] they obviously need to know how to route out to the Internet.

OR, because this is outbound and the Dynamic NAT [WAN to LAN NETWORK] is already established on the ISR, will all of the 6 vlans be able to route out on the GE 1/1 192.168.8.2 for Internet, and will translate accordingly on the ISR with a 0.0.0.0 0.0.0.0 192.168.8.1 static route on the Nexus?

I was looking at https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/unicast/configuration/guide/b-cisco-nexus-9000-series-nx-os-unicast-routing-configuration-guide-93x/b-cisco-nexus-9000-series-nx-os-unicast-routing-configuration-guide-93x_cha...

And then started to wonder how the specific vlans would know how to utilize the PBR's. I suppose after I created the PBR on the Interface and created the ACL, I would apply that same ACL to the corresponding vlan.

[balaji.bandi]

Assuming so far this is accurate [because each vlan [6 of them] will indeed have their own WAN IP]] they obviously need to know how to route out to the Internet.

This you need to match the ACL and NAT with Correct Correspondent IP as per your diagram.

You only Route IP ranges  back to nexus not the default route on ISR - that default route need to towards Internet side.

yes PBR need to apply where the Traffic originating going to destination use to next Hop. (You can also use static routes if you like )

Other thread  if you change the topology and like to  PPPoE with FP as  you mentioned  - suggest to open a new thread so there is no confusion here.