I'm currently having asymmetric routing issue on my network. We are taking over few departments of a company. Currently the users access our servers via public Internet which are Nated back to our private addresses on our network. This company for some wired reason is using public IP addressing internally. We have installed a LES point to point link with this company so that the users can access the network resources directly. I have installed a firewall between us and them. Company's current networks team doesn't want to use our private addressing over their network hence I had to Nat few of our server IPs to public IP addresses to be available on their network.
The issue is when the users need to connect to any of the other servers then come through our public facing firewall and then to our core. In order to forward the traffic to the LES link firewall I had to route the traffic to it which automatically routes the traffic coming from the company's network via our public firewall hence creating a asymmetric route on the way back.
Ideally the traffic coming from public firewall should go back to the source same way and the traffic coming from LES firewall should go back to the source same way. Can someone advise how can I route the traffic for company's network (10.134.x.x) back out the same way as it came, either via public firewall or the LES link firewall?
Many thanks in advance.
Solved! Go to Solution.
Thank you for your reply.
The company users are base on 10.146.0.0/16 range hence will it be possible to route the entire traffic for both these server groups?
You asked if you could route tracffic received by each firewall back to their respective firewalls, not for the whole subnet.
My assumptions are you have an SVI shared across both cores running HSRP, hence you will need to do the following on both core's. Levae the default route alone on both core's also.
Create an acl;
ip access-list extended PBR
permit ip host 10.134.117.19 10.146.0.0 255.255.0.0
permit ip host 10.134.117.20 10.146.0.0 255.255.0.0
permit ip host 10.134.117.21 10.146.0.0 255.255.0.0
Create a route-map
route-map PBR permit 10
match ip address PBR
set ip next-hop x.x.x.x (where x is the inside IP of public firewall)
On the servers SVI;
interface vlan 134
ip policy route-map PBR
That should do it.
I have setup the below access list for the company's network on our core switch 1
ip access-list extended ACL-Servers
permit ip host 192.168.55.114 10.146.0.0 0.0.255.255
permit ip host 192.168.55.12 10.146.0.0 0.0.255.255
permit ip host 192.168.55.129 10.146.0.0 0.0.255.255
permit ip host 192.168.50.209 10.146.0.0 0.0.255.255
permit ip host 192.168.50.170 10.146.0.0 0.0.255.255
permit ip host 192.168.50.175 10.146.0.0 0.0.255.255
permit ip host 192.168.50.178 10.146.0.0 0.0.255.255
permit ip host 192.168.50.179 10.146.0.0 0.0.255.255
permit ip host 192.168.50.181 10.146.0.0 0.0.255.255
permit ip host 192.168.37.254 10.146.0.0 0.0.255.255
route-map RM-Servers permit 10
match ip address ACL-Servers-Barnet
set ip next-hop 172.20.109.1 (IP address of the Company facing firewall)
route-map RM-Servers permit 20
CSW1(config)# do sh run int vlan 50
Current configuration : 236 bytes
ip address 192.168.50.1 255.255.255.0
ip helper-address 192.168.55.114
ip policy route-map RM-Servers
CSW1(config)# do sh run int vlan 55
Current configuration : 199 bytes
ip address 192.168.55.1 255.255.255.0
ip helper-address 192.168.50.2
ip policy route-map RM-Servers
But still am unable to route the traffic for the above servers to 172.20.109.1.
I am getting packets matches but i can't see it hitting our firewall.
route-map RM-Servers, permit, sequence 10
ip address (access-lists): ACL-Servers-Barnet
ip next-hop 172.20.109.1
Policy routing matches: 4109 packets, 427523 bytes
route-map RM-Servers, permit, sequence 20
Policy routing matches: 155487 packets, 17976974 bytes
CSW1#sh ip route 172.20.109.1
Routing entry for 172.20.109.0/30
Known via "static", distance 1, metric 0
Redistributing via eigrp 200, ospf 1
Advertised by eigrp 200
ospf 1 subnets
Routing Descriptor Blocks:
Route metric is 0, traffic share count is 1
Yes the fiewall has a route outside 0.0.0.0 0.0.0.0 10.146.120.201 1
No the firewall isn't on the same subnet but there is a route from the core switch to this firewall.
Sent from Cisco Technical Support iPad App