Currently we have a fairly simple setup conencting to our ISP. Our ISP has given us the following L3 info:
Default gateway: 53.141.130.241
Router/Firewall Outside interface: 53.141.130.244
Subnet: 255.255.255.248
Available IPs: 53.141.130.245-246
Internal IPs: 53.141.120.128/28
The ISP connects to our external switch that our external firewall also connects to, both ports are part of the same L2 vlan.
Our firewall has the IP 53.141.130.244/29 with a default gw of 53.141.130.241. On the firewall the extrernal IPs used (for mips, vips, etc)
are in the 53.141.120.128/28 block.
This setup works, but it forces me to use the firewall for everything since it is essentially our edge router, as all traffic from the ISP goes to
53.141.130.244. I'd like to move that IP (53.141.130.244) to a VLAN interface and let that VLAN handle the routing, but not sure how to do that. The goal is to have other devices parallel to our firewall (vpn, dmz, etc.) devices that would have to use an IP from the "available IPs" from our ISP I guess, 53.141.130.245-246.
I know I could assign 53.141.130.244 to a vlan and define a default route pointing to 53.141.130.241. But how do I handle the 53.141.120.128/28
subnet? The ISP doesn't do any vlan tagging.
Potential config on switch:
interface vlan2
description connection to isp
ip address 53.141.130.244 255.255.255.248
!
ip route 0.0.0.0 0.0.0.0 53.141.130.241
ip route 53.141.120.128 255.255.255.240 53.141.130.245 (The external firewall interface)
Other external devices:
All other external devices will be sitting in the same VLAN and should be able to ARP out and figure out where to go. WIth the internal gateway address now defined on the vlan (.244) and the firewall using one of the "available IPs (.245)", that only leaves one more IP in that range to use (.246). So I should be able to assign that to my vpn/dmz device, right?
This seems feasible, but I'm not sure about the internal IP block (53.141.120.128/28), is there any way for a device with one of these IPs to be dropped in to the external vlan? Since the vlan is a different subnet I have no idea how that would work.
Clear as mud? I'm just trying to move more of our devices to the edge, it's just something that would work better for us currently. I *know* most DMZs and other gear hang off of the firewall, this is a different case that would take a much larger post to describe :/ It involves politics and too many managers!
So, any ideas?
