Here is the network topology:
Router (2811)-----Switch (3560)-----Switch (3560)-----Firewall (5505)
There are clients connected to both switches. Ideally, I would like to see the firewall connected to the same core switch as the router, but that isn't an option at this exact time (as this is a remote site). A new circuit was just cut over and the new router installed. The goal is to get all voice traffic routed over the router and back to the corporate WAN, while all the data traffic is routed through the local firewall and then back to the corporate firewall. Both switches are Layer 3. The router is running BGP, but it is only advertising the voice network. However, when you do a "sh bgp", you can see routes for the voice and the data vlans/subnets. This was causing all traffic to be routed over the router. At first, we tried static routes such as 10.10.0.0 and 192.168.0.0, but that wasn't specific enough. After we tightened it down to 10.10.1.0, 10.10.2.0, etc. and 192.168.1.0, 192.168.2.0, etc., we got the traffic to route correctly. However, this is more like a band-aid than an actual fix, because everytime we want to route a new subnet through the firewall (from anywhere on the WAN), we have to add the static route to the local router. I would like an opinion on the best practice for this scenario. Is there some way to exclude the data traffic from BGP? Perhaps with an ACL or some other means? Any suggestions would be greatly appreciated. Thanks.
