Migrating to new management VLAN.

[forman102]

Hello,

The network I'm working with is using VLAN 1 for management and user traffic...to add to it, it is also using public IP address (128.x.x.x) as private, creating lots of issues. I'm trying to clean this mess up and so far I managed to move a lot of end users to new VLANs with real private IP addresses (10.x.x.x/24). The network consist of 2 core 4506 switches and 25x 2960S connected to both cores for redundancy (using HSRP). All of the switches have interfaces VLAN 1 configured with IP addresses from 128.x.x.x range. My question is:

1.Can I create VLAN 100 (10.6.100.x/24), then create interface vlan 100 on each switch and use it instead of the current VLAN 1?

2.Currently I have ASA inside interface connected to one of the 2960s ports in VLAN 1, with default routes on both cores pointing to that inside int. I'm actually migrating to the new ISP, so I have additional ASA and would like to know the proper way of connecting ASA inside interface to my network. Could I use new VLAN 100 to accomplish that? I'm still learning and trying to clean up after the previous admin.

thanks,

forman 

[Reza Sharifi]

Hi,

1.Can I create VLAN 100 (10.6.100.x/24), then create interface vlan 100 on each switch and use it instead of the current VLAN 1?

Yes, you can.  For security reasons, it is actually recommended not to use vlan 1 at all, and use a different vlan.

for your second question, can you draw a diagram showing where physically the ASA connects to your network?

HTH

[forman102]

[forman102]

Sorry about that caveman-style diagram... Each of my access switches has dual connection to both core switches. Each VLAN is configured with HSRP for redundancy, so layer 3 interfaces are configured on both cores. Ofcoures VLAN routing is done on cores as well. Right now the inside interface is in connected to the port in VLAN 1 on 2960s, but I'm thinking about connecting it to the port on 3750X, because they're redundand. My question is about the proper way of doing this. I don't want to use VLAN 1 for reasons listed above, so should I create another VLAN, let's say 101 with IP subnet : 10.10.101.x/24 and use it to connect ASA inside interface? Will this work?

[forman102]

I think, I need to refraze myself (English is not my primary language). Should I connect the ASA to one of the distribution (core) switches or to access switches (3750s)? And should the ASA be in VLAN other than VLAN1?

thank you very much

forman

[Richard Burts]

forman

My first thought was that I like to have essential services such as the ASA connected to the core since they are providing a core type of service and it simplifies their connectivity. Then I thought that if you connect the ASA to one of the access switches you could trunk that VLAN to both of the cores and configure HSRP so that there could be some redundancy in the connection to the core. Based on this I am somewhat inclined to suggest connection of the ASA to the access switch.

HTH

Rick

[forman102]

Thank you for your suggestion Rick.This is actually exactly what I was planning:

- connecting ASA inside int to 3750X stack, which is connected to both cores; and yes, we use HSRP on our cores for each VLAN, so even if one of the cores goes down, the other will still do inter-VLAN routing.

How do you think I should configure physical swich-port on 3750X to accomodate ASA inside int? Is there any standards for that? Right now ASA is just connected to the port in VLAN 1, which I don't want to use.

I was thinking about creating separate VLAN with HSRP just for ASA, such as:

VLAN 101

Core1:

interface Vlan101

ip address 10.6.101.2 255.255.255.0

standby 101 ip 10.6.101.1

standby 101 priority 105

standby 101 preempt

Core2:

interface Vlan101

ip address 10.6.101.3 255.255.255.0

standby 101 ip 10.6.101.1

standby 101 preempt

and assigning IP address from that subnet to ASA. Let's assume 10.6.101.101/24. Once completed, I will change default routes on both cores to 10.6.101.101. What do you think?

thanks

[Richard Burts]

forman

I like what you suggest and believe that it would work nicely. The port where the ASA connects would be an access port in VLAN 101, and you need to be sure that VLAN 101 is trunked between the switches so that both VLAN interfaces can communicate with each other.

HTH

Rick

[Reza Sharifi]

I agree with Rick.  The ASAs should be connecting to your core. They way you have it right now, when a PC connected to one of the 2960s or 3750s need to connect to the Internet, the packet is forwarded to the default gateway which is the set of 4506 switches.  From there, since the 4500s are not connected to the ASA, it goes back to the 2960 (at the top) and then gets forwarded to the ASA. Are you sure this is how eveything is conneced, because I am not sure how actually this network works today as the access switches are only layer-2??

HTH

[forman102]

Reza,

I realize that the packets from end users in switch 2960 take that weird route. It works and that's how it was implemented by the vendor during the last network upgrade. Now, I do agree it's a little strange. That's why I will move it to 3750 stack, which doesn't service end users at all, just servers exlusivly.

As for your question how it works, we use HSRP for each VLAN, so the routing is done on both cores. Then the default route on the cores is pointing to ASA.

thanks

[Richard Burts]

forman

The good news in this is that the important thing that the 2960s are doing is layer 2 forwarding/switching. And that should not be impacted if you change the management VLAN interface on the switch. What will potentially be impacted is your ability to connect to the switch to manage it (and for it to communicate with SNMP servers, syslog servers, and any other management functions that the switches may be doing). So the first switch or two I would want to be pretty close so that I could get to their console ports if something does not work as expected as you make the transition.

I would suggest this as an approach to the transition:

- make sure that VLAN 100 is working on the 4506s.

- configure VLAN 100 on some 2960s (the VLAN not the VLAN interface).

- make sure that VLAN 100 is working on the 2960 and that it is included on a trunk connecting to the 4506s.

- configure interface VLAN 100 on the 2960 and configure its IP address.

- when you do that it is likely that the existing interface VLAN 1 will become shutdown. And that would terminate your telnet (if you are connected to the switch via telnet). Hopefully you can establish a new session to the switch using its new address in VLAN 100.

HTH

Rick