Router/Switch after Firewall

[ISSM]

Hello,

My current setup that's working is ISP > Firewall (DHCP Server/NAT/ACL) > Switch > Computers.

I want to put a Router between the Firewall and Switch even though I know it's not needed, but we paid for it.

Firewall "Inside" > Router's G0/0/0 and G0/0/1 to Switch.  Router and Switch are open with no configuration.

All computers gets an IP address, but no access to the internet.  On router, I did an ip route 0.0.0.0 0.0.0.0 192.160.0.1 (Firewall Gateway IP).

What am I doing wrong?

[M02@rt37]

Hello @ISSM,

Do you have filtering rule on your Firewall? PCs have DNS server configured ?

With dump on your Firewall do you see flow from your LAN towards "Internet" going throught the interface in front of the ISP? Perhaps you have implicit drop from your Firewall also.

[ISSM]

PCs have DNS server configured correctly.  ACL is currently opened to all from inside_zone to outside_zone.

[M02@rt37]

OK @ISSM 

Is it possible to dump from the firewall? 

Interfaces on Router are they UP/UP?

Do the PC ping their Gateway?

[ISSM]

Hello,

I did a /ipconfig renew and was not able to get an ip address from the Firewall, which is the DHCP server.

Interfaces on Router are up/up.

[MHM Cisco World]

you need IP helper in router point to FW interface 
NOTE:- again check the reachability 

[M02@rt37]

OK @ISSM 

The dhcp request is a broadcast and the routeur drop the broadcast.

You need to configure dhcp relay on the router or if you can on the Switch.

[MHM Cisco World]

check the topology I share

[MHM Cisco World]

[MHM Cisco World]

check the topology I share

[M02@rt37]

@MHM Cisco World 

@ISSM wants "to put a Router between the Firewall and Switch".

[Kasun Bandara]

@ISSM  hi, my first thought was why you need router between switch and FW, if there is no specific need to do or any inter vlan routing or any other purpose. yu can configure that as a backup devices for firewall (for routing) incase of firewall failure. you are adding unnecessary complexity and hop between your PCs and internet. 

[M02@rt37]

Hello @ISSM,

what about your problem?

If you absolutly need to install the router between the Firewall and the Switch, yoo need ton consider now that you have a "new" L3 equipement between your LAN and the Firewall. 

ISP <Outside Firewall Inside<0/0/0 Router 0/0/1< Switch < LAN

Considering that the LAN subnet is [192.160.0.0/24] and the VLAN ID is 20.

[ROUTER]

interface gig 0/0/1
description --Sub-Int_To_Switch-LAN
no shut
!
interface gig 0/0/1.20
description --SVI-LAN
ip address 192.160.0.1 255.255.255.0
encapsulation dot1q 20
ip heper-adress <IP DHCP SERVER>
no shut
!
interface gig 0/0/0
description --To-Firewall
ip add 10.0.0.1 255.255.255.252
no shut
!
ip route 0.0.0.0 0.0.0.0 10.0.0.2 name Default_To_Firewall::INSIDE

=> New interco. between Router and Firewall need /30 subnet [10.0.0.0/30]. Then, <IP DHCP SERVER> is 10.0.0.2.

[FIREWALL]

Inside interface: 10.0.0.2 255.255.255.252
Route to LAN: 192.160.0.0 255.255.255.0 10.0.0.1
DHCP server/NAT/Filtering/WAN Interface already configured

As concerned the DHCP Server:

network 192.160.0.0/24
default-router 192.160.0.1 (Gateway of the LAN)
DNS .... etc

[SWITCH]

Interface in front of the Router is a traditionnal Trunk 

[Rich R]

The others have already highlighted the issue but let me add some explanation.
DHCP requires layer 2 broadcast in the simplest case - the server and clients in the same subnet/broadcast domain- that's what you had when directly connected to the firewall.
Now you've added the router between them, there's no way for the client DHCP broadcasts to reach the server on the firewall.  Presume you moved the client subnet from firewall to router client facing interface? The easiest way to get the DHCP to the server (firewall) is using DHCP relay which unicasts the client request to the server on behalf of the client.  That's easily done with "ip helper-address <dhcp server ip>" on the client interface of the router and your server (the firewall) must support that too.

If that's too complicated for you to get working you might want to move the DHCP server function to the router itself then no relay required. Example (adjust IP to your local IP subnet and DNS - example uses Google DNS):
ip dhcp bootp ignore
no ip dhcp conflict logging
ip dhcp excluded-address 172.16.0.0 172.16.0.2
ip dhcp pool direct-internet
network 172.16.0.0 255.255.255.0
default-router 172.16.0.1
dns-server 8.8.8.8 8.8.4.4

The excluded address range will be your router interface IP and any other static allocated IP addresses which you don't want DHCP handing out.

[ISSM]

Good morning,

So I followed your advice and moved the DHCP server to the router.  I configured all commands just you posted per our local subnet.  However, the switch is still not showing any ip addresses assigned to the clients on the switch.  The switch is currently connected to int G0/0/1.  Do I need to run any commands on this port?