Accepted Solutions
Hi Richard,
I've attached a screenshot of what it should look like, though its not complete (I didn't do all of the services, but enough so you get the gist). You need both to and from rules and diff source/dest rules:
Best,
David
Hi David,
Thanks for replying thought no one ever would.
Basically I need to create a secure area for the programmers in my company so they can access the company network but no one can access their systems.
So I wanted to create a secure VLAN using ACL's within the existing network which is made up of cisco layer two switches running on the default VLAN1 i.e no vlan configuration (I cannot easily change this as they have 4 switches running off VLAN1).
I have connected the sf 300 (layer 3 enabled) to the company network by removing the connection from my pc to the network and plugged that into port fa 0/1 and enabled it as a trunk port)
I then connected my computer (A) to port fa 0/2 of the sf 300 and enabled it as an access sport.
I then connected another computer (B) to port fa 0/16 of the sf 300 and enabled it as an access sport.
I created a second VLAN (VLAN2) ip address 192.168.2.1 and assigned it to fa 0/16 all other ports are assigned to VLAN1 (default).
I set my Computer A (IP 192.168.111.94) default gateway to the ip address of the sf 300 (192.168.111.218) and computer B (IP 192.168.2.2) default gateway to 192.168.2.1.
I set the default route to 0.0.0.0 0.0.0.0 192.168.11.254 (draytek router and default gateway for existing network) and added the DNS servers for my network to the sf 300.
Computer A still has access to the company drives, email etc but is unable to access the internet and can ping and RDP to computer B but cannot access the internet.
Computer B can ping and RDP to computer A but cannot access the company network or internet i.e I cannot ping the domain controller.
I have tried tagging VLAN2 to fa 0/1 trunk port but still no sucess and adding entries on the domains controllers DNS for computer B.
My main issue is that I cannot get VLAN2 to access the company network.
I have created a digram of the setup below to hopfully give you a better idea
Many Thanks
Richard
Hi David,
I have telnet into the draytek and I see the following ( I thought I added a default route but apparently you can only do this by telnet not through the web interface).
If I add a second default route will it nock out the route shown above as I dont want to down the internet connection as I am doing this remotely from home and dont want to kill the router.
I have 4 ethernet ports in the draytek. ethernet port 1 is plugged into the network (which I think is IF0) and the adsl cable is plugged into the ADSL port IF3 (I think) .
The syntax for the draytek is as follows:
Do I need to patch a cable from the draytek (ethernet port 2) into the network and setup a default route on that interface or can I add one to the existing interface (ethernet port 1)?
The show ip route for the switch is as follow (I dont have anything plugged into it though):
switch7c0a71#show ip route
Maximum Parallel Paths: 1 (1 after reset)
IP Forwarding: enabled
Codes: C - connected, S - static, D - DHCP
S 0.0.0.0/0 [1/1] via 192.168.111.254 118:22:47 vlan 1
C 192.168.111.0/24 is directly connected vlan 1
switch7c0a71#
Hope this makes sense.
Kind Regards
Richard
Hi David,
I have added the route to the draytek as shown below:
I think VLAN2 is not saying directly connected because Computer B which belongs to VLAN2 is not currently connected.
At present VLAN4 ip addresses are being statically assigned but I have added a new DHCP range to the domain controller for 192.168.2.0 so I presume I could dish out IP addresses via DHCP when it is all working?
I will get back to you on Monday once I have plugged it all in and tested, again many thanks for your help David have a great weekend.
Kind Regards
Richard
Hi David,
I have tried to ping google's IP address but 173.194.67.94 but it times out. I am not sure what you mean by 4.2.2.2 but I tried to ping it without sucess. I have attached a grab of the route print command from 192.168.2.2:
I can also ping the network DNS servers (192.168.111.82 & 192.168.111.212) from 192.168.2.2
Kind Regards
Richard
