Internet for VLAN

[frederick.mercado]

We are running a 9300 switch that is doing L3 inter vlan/ip routing. I have tried multiple configurations but cannot seem to get clients to get out to the internet. We would like to get our internet only VLAN xxx to allow users in VLAN xxx to go out.

Essentially NATing (masquerading?) their internal IPs of 10.74.xxx.x (Gw .250 and .0 sub) to a single external IP (207.xx.xx.x /.248 sub) to get out to the internet. I connected a cable from our ISP switch to our L3 switch and need a good example port configuration. Clients are connecting via MOBILE SSID and getting DHCP and RADIUS successfully internally, but we want their internet traffic to use the ISP. 

[Jon Marshall]

What do you mean by ISP traffic ie. source and destination subnets would be good. 

Are you trying to restrict what traffic is allowed from vlan 126 or from the the ISP (is the ISP directly connected to switch ie. no firewall ?). 

The main point I was making is that you may need acls on all interfaces but it won't be the same acl and an acl applied in one direction isn't going to work applied in the other on the same interface. 

You could just write one big acl for all interfaces but to me that is just confusing and I would write an acl per interface per direction (assuming you need direction ie. in is usually the one you need). 

Jon

[frederick.mercado]

We need an ACL for VLAN xxx traffic to not touch the internal network, as its for mobile phones, and likewise an ACL for ISP traffic to not reach any other VLAN than xxx. Correct. We do not have a PIX or firewall at the moment to use.

[Jon Marshall]

Based on your current acl it looks like the 10.74.126.0/24 subnet does not need to talk to anything internally except for maybe DHCP ? so - 

permit DHCP traffic (if needed)
deny ip 10.74.126.0/24 to any other internal subnets
permit ip 10.74.126.0/24 to any (for internet)

for the deny line you may need multiple lines or you may be able to summarise all internal subnets.

Then apply it inbound to the vlan 126 interface.

That said if this is internet traffic then you really need a firewall and shouldn't be connecting directly to your switch. 

Jon

[Jon Marshall]

Should also say that the acl for vlan 127 would stop any other internet working on that link but you did say you wanted to block everything except traffic to vlan 126. 

Jon

[Jon Marshall]

Ignore the ISP acl on vlan 127 because it will not be private IPs. 

Basically that acl will be - 

permit ip any host 207.91.252.xx

deny ip any any 

Jon

[Jon Marshall]

I can't stress enough that you really need a firewall for this as then you would not need an acl on vlan 127 because a firewall would allow the return traffic back in, it's what they are designed to do. 

You are relying purely on NAT for your security here ie. you can only send traffic from the internet if there is a corresponding NAT entry for traffic from vlan 126. 

NAT is not and never was a security feature. 

Jon 

[frederick.mercado]

Some progress...after adding:

access-list 100 permit ip 10.74.xxx.0 0.0.0.255 any

ip nat inside source list 100 interface Vlanxxx overload

and removing ACLs I get:

Pro Inside global Inside local Outside local Outside global
icmp 207.x.x.x:1024 10.x.x.x:30840 207.x.x.x:30840 207.x.x.x:1024

So I can now get to the GW, but nothing further?

[Jon Marshall]

If there are no acls and you cannot get past the gateway then looks like an issue with the ISP. 

So you can ping the ISP gateway but cannot ping any further ? 

What does a traceroute to an internet IP look like ? 

Jon

[Jon Marshall]

Do you have a default route pointing to the ISP gateway ? 

Jon

[frederick.mercado]

To belay fears we will be getting a FW soon, just need to get it up.

I do not have a route. I figured between inter VLAN routing it would cover it. 

[Jon Marshall]

Okay then it's not going to work because you need a default route pointing to the ISP gateway but you already have a default route pointing somewhere else. 

You may be able to use VRFs if they are supported on your switch but it would then also need to support VRF NAT as well. 

If you can use a VRF then if it is only vlan 126 that uses the ISP on vlan 127 you would not really need acls as traffic would be contained within that VRF. 

Jon

[frederick.mercado]

I guess a PBR or route map would not work. 

I see that our 9300s support inter-VRF routing any ideas on how one would configure such?

[Jon Marshall]

PBR should work as you could then set the next hop IP as the ISP gateway so if it was temporary until you got a firewall it may be the easiest thing to try. 

Not configured VRFs on 9300s but the documentation should have an example although again you then need NAT to work with it. 

May be worth trying the PBR first. 

Jon

[frederick.mercado]

hmm I took a laptop to ensure I could get out. I plugged in IP: 207.x.x.x with proper sub and GW and it works. So it has to be configuration wise.... I added the route map and wont get out. No ACLs on it. Clients can ping each other, can ping other internal VLAN clients, and I can ping GW of .25 and the VLAN IP of .28.... but it wont get out past the GW. 

[Jon Marshall]

Change this - 

set ip default next-hop 207.91.252.25

to - 

set ip next-hop 207.91.252.25

The set ip default next-hop says look in the IP routing table first then use that next hop which is not what you want, you want it to just use the next hop IP in your PBR configuration. 

Jon