VLANs and ASA5515-X

[Rizwan]

Hi, 

I have created multiple VLANs on Cisco 3750 switch and configured inter-VLAN routing. Cisco ASA 5515-X is internet gateway, should I also create VLANs on ASA and should I made trunk port between firewall and Cisco 3750?

[Marius Gunnerud · Accepted solution]

If you have configured inter-VLAN routing on the 3750 switch then there really is no point in creating VLANs on the ASA as you already have no security between the VLANs.  If you remove the inter-VLAN routing and have the ASA do the routing between VLANs then, yes you would need to configure VLANs on the ASA as well as ACLs permitting and denying traffic...as well as NAT for that matter.

So, all you need to do is configure a Layer3 port on the switch and connect it to the ASA and set the default route on the switch to point to the ASA, and you are done.  Well, you will still need to configure NAT on the ASA if you haven't done so already.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

Do I need to configure NAT for each VLAN subnet on ASA ? and IP address of inside interface of ASA can be from some VLAN subnet or should be from different subnet? 

If I have two internet gateways then how I will handle default routes on Cisco 3750 switch? 

[Marius Gunnerud]

Each subnet requires a NAT statement that it can be matched to so it can be translated and sent to the internet.  So, depending on your company's security policy you could either do the simple way of matching all traffic on any inside interface and translate it to the outside interface or create more specific statements which can be considered to be a little more secure.

Here is an example of allowing all subnets from any interface and translate it to the outside interface IP.

object network ALL-SUBNETS
  subnet 0.0.0.0 0.0.0.0
  nat (any,outside) dynamic interface

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I have made L3 port with no switch port command and connect it with ASA inside interface but both directly connected interfaces are unable to ping each other. Is there anything else I need to do either side?

[Rizwan]

Its working now..no need to reply

But I have another issue, I am using two internet gateways, Can I use multiple default route on Cisco 3750 switch and Policy based routing?

[Marius Gunnerud]

Not exactly sure what you are getting at here.  But I will answer what I think you mean.

You could connect the two ISP gateways to the 3750 and place them in a seperate VLAN (so traffic is seperate from other Local traffic) and have them go directly to the ASA.  Then based on the source IP of traffic leaving the ASA towards the ISP gateways you can configure PBR on the 3750 as you see fit.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

I think you did not get my question. I have two different internet gateways one from Cisco ASA and one from Router. I have attached diagram for explanation. 

I am having two default routes on Cisco 3750 switch, one go through ASA and one from Router and my question is I want some VLANs go to internet from ASA and some from Router, What configuration is required for it?

[Marius Gunnerud]

In this case you would want to configure policy based routing (PBR) on the 3750 switch.

access-list 101 permit ip 10.10.10.0 0.0.0.255 any

route-map TRAFFIC-A permit 10
 match ip address 101
 set ip next-hop 1.1.1.2

interface FastEthernet0/0
 ip address 1.1.1.1 255.255.255.0
 ip policy route-map TRAFFIC-A

This should be applied to the ingress interface where the source traffic is entering the 3750 switch.

--

Please remember to select a correct answer and rate helpful posts

[Marius Gunnerud]

Oops, just noticed you provided IPs in your diagram.  Anyway, you just need to change the IPs as needed.

[Rizwan]

I am not getting this command at interface level

ip policy route-map

I am using following IOS image 

c3750-ipbase-mz.122-35.SE5

Do I need to upgrade IOS, Can I upgrade it to IP Services image? My switch model is 

WS-C3750G-24T-S

[Marius Gunnerud]

Is the port you are configuring it on a L2 port / trunk port?  Then that is why you do not see the command. it is ment for L3 routed ports. Do you have SVIs configured on the switch?  I personally have never tried to configure a PBR on a VLAN interface but you could give it a try and see if traffic is routed as you want.

--

Please remember to select a correct answer and rate helpful posts

[Rizwan]

It was limitation in IOS, I am having IPbase IOS image whereas this command is available in IP services base image only. 

[Rizwan]

Its working but after applying route-maps internet has become very slow. 

I have two default routes, when I omit one default route it works fine for one gateway but with two default routes response is very slow. How to cater this problem? is there any alternative of default routes? 

[Marius Gunnerud]

Well, theoretically if you remove the default route to the second ISP, the route-map should route route the specified subnet in the matched ACL to the ISP interface.  You could remove the default route that points to the router and then test to see if things are still working as expected.

--

Please remember to select a correct answer and rate helpful posts