Router/Switch after Firewall
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:18 AM
Hello,
My current setup that's working is ISP > Firewall (DHCP Server/NAT/ACL) > Switch > Computers.
I want to put a Router between the Firewall and Switch even though I know it's not needed, but we paid for it.
Firewall "Inside" > Router's G0/0/0 and G0/0/1 to Switch. Router and Switch are open with no configuration.
All computers gets an IP address, but no access to the internet. On router, I did an ip route 0.0.0.0 0.0.0.0 192.160.0.1 (Firewall Gateway IP).
What am I doing wrong?
- Labels:
-
Other Routers
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:23 AM
Hello @ISSM,
Do you have filtering rule on your Firewall? PCs have DNS server configured ?
With dump on your Firewall do you see flow from your LAN towards "Internet" going throught the interface in front of the ISP? Perhaps you have implicit drop from your Firewall also.
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:58 AM
PCs have DNS server configured correctly. ACL is currently opened to all from inside_zone to outside_zone.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 07:01 AM - edited 05-19-2023 07:03 AM
OK @ISSM
Is it possible to dump from the firewall?
Interfaces on Router are they UP/UP?
Do the PC ping their Gateway?
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 08:00 AM
Hello,
I did a /ipconfig renew and was not able to get an ip address from the Firewall, which is the DHCP server.
Interfaces on Router are up/up.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 08:05 AM
you need IP helper in router point to FW interface
NOTE:- again check the reachability
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 08:06 AM
OK @ISSM
The dhcp request is a broadcast and the routeur drop the broadcast.
You need to configure dhcp relay on the router or if you can on the Switch.
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:25 AM - edited 05-19-2023 07:04 AM
check the topology I share
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 07:03 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:48 AM - edited 05-19-2023 07:04 AM
check the topology I share
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 06:51 AM
@ISSM wants "to put a Router between the Firewall and Switch".
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-19-2023 11:46 PM
@ISSM hi, my first thought was why you need router between switch and FW, if there is no specific need to do or any inter vlan routing or any other purpose. yu can configure that as a backup devices for firewall (for routing) incase of firewall failure. you are adding unnecessary complexity and hop between your PCs and internet.
Good luck
KB
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-20-2023 06:15 AM - edited 05-20-2023 06:24 AM
Hello @ISSM,
what about your problem?
If you absolutly need to install the router between the Firewall and the Switch, yoo need ton consider now that you have a "new" L3 equipement between your LAN and the Firewall.
ISP <Outside Firewall Inside<0/0/0 Router 0/0/1< Switch < LAN
Considering that the LAN subnet is [192.160.0.0/24] and the VLAN ID is 20.
[ROUTER]
interface gig 0/0/1
description --Sub-Int_To_Switch-LAN
no shut
!
interface gig 0/0/1.20
description --SVI-LAN
ip address 192.160.0.1 255.255.255.0
encapsulation dot1q 20
ip heper-adress <IP DHCP SERVER>
no shut
!
interface gig 0/0/0
description --To-Firewall
ip add 10.0.0.1 255.255.255.252
no shut
!
ip route 0.0.0.0 0.0.0.0 10.0.0.2 name Default_To_Firewall::INSIDE
=> New interco. between Router and Firewall need /30 subnet [10.0.0.0/30]. Then, <IP DHCP SERVER> is 10.0.0.2.
[FIREWALL]
Inside interface: 10.0.0.2 255.255.255.252
Route to LAN: 192.160.0.0 255.255.255.0 10.0.0.1
DHCP server/NAT/Filtering/WAN Interface already configured
As concerned the DHCP Server:
network 192.160.0.0/24
default-router 192.160.0.1 (Gateway of the LAN)
DNS .... etc
[SWITCH]
Interface in front of the Router is a traditionnal Trunk
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-20-2023 06:22 AM - edited 05-20-2023 06:23 AM
The others have already highlighted the issue but let me add some explanation.
DHCP requires layer 2 broadcast in the simplest case - the server and clients in the same subnet/broadcast domain- that's what you had when directly connected to the firewall.
Now you've added the router between them, there's no way for the client DHCP broadcasts to reach the server on the firewall. Presume you moved the client subnet from firewall to router client facing interface? The easiest way to get the DHCP to the server (firewall) is using DHCP relay which unicasts the client request to the server on behalf of the client. That's easily done with "ip helper-address <dhcp server ip>" on the client interface of the router and your server (the firewall) must support that too.
If that's too complicated for you to get working you might want to move the DHCP server function to the router itself then no relay required. Example (adjust IP to your local IP subnet and DNS - example uses Google DNS):
ip dhcp bootp ignore
no ip dhcp conflict logging
ip dhcp excluded-address 172.16.0.0 172.16.0.2
ip dhcp pool direct-internet
network 172.16.0.0 255.255.255.0
default-router 172.16.0.1
dns-server 8.8.8.8 8.8.4.4
The excluded address range will be your router interface IP and any other static allocated IP addresses which you don't want DHCP handing out.
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-22-2023 08:17 AM
Good morning,
So I followed your advice and moved the DHCP server to the router. I configured all commands just you posted per our local subnet. However, the switch is still not showing any ip addresses assigned to the clients on the switch. The switch is currently connected to int G0/0/1. Do I need to run any commands on this port?
