Hi there. I am trying to test out a new firewall in our environment and I would like to direct my PC only through the test firewall.
Here is the current LAN structure:
My PC: 10.1.25.253 on Vlan 25 (this is the only PC on this VLAN)
New firewall: 10.1.2.8 on Vlan 2
Current firewall: 10.1.2.10 on Vlan 2
The Cisco 4506/Supervisor IV serving as the gateway: 10.1.2.254 on Vlan 2; 10.1.25.254 on Vlan 25
Here is my current config (edited for privacy/brevity). Can anyone tell me why my route-map "testfirewall" is not working?
Current configuration : 23482 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service compress-config
service sequence-numbers
!
hostname RSC-Core
!
boot system flash bootflash:cat4000-i9k91s-mz.122-20.EWA.bin
no logging buffered
aaa new-model
clock timezone EST -5
ip subnet-zero
ip name-server 10.1.2.4
ip name-server 10.1.2.5
ip name-server 10.1.2.9
!
ip dhcp snooping vlan 2
ip dhcp snooping
ip ssh time-out 100
ip address-pool local
ipx routing 0012.80c6.7080
ipx internal-network ACE00002
!
no file verify auto
errdisable recovery cause dhcp-rate-limit
errdisable recovery interval 30
spanning-tree mode pvst
spanning-tree extend system-id
power redundancy-mode redundant
!
!
!
!
vlan access-map core 10
action forward
vlan internal allocation policy ascending
vlan dot1q tag native
!-----This is the port my computer is on
interface GigabitEthernet4/18
description ADMIN_PORT
switchport access vlan 25
switchport mode access
!-----This is the port that the new firewall is on
interface GigabitEthernet4/46
switchport access vlan 2
switchport mode access
interface Vlan1
no ip address
!
interface Vlan2
ip address 10.1.2.254 255.255.252.0
ip directed-broadcast
!
interface Vlan5
ip address 10.1.5.1 255.255.255.0
ip helper-address 10.1.2.4
ip helper-address 10.1.2.5
ip directed-broadcast
!
interface Vlan10
ip address 10.10.1.254 255.255.255.0
ip policy route-map 10
!
interface Vlan25
ip address 10.1.25.254 255.255.255.0
ip policy route-map testfirewall
!
interface Vlan128
no ip address
shutdown
!
interface Vlan193
ip address 10.1.10.254 255.255.255.0
ip helper-address 10.1.2.4
shutdown
!
interface Vlan196
ip address 192.168.255.253 255.255.255.0
!
ip default-gateway 10.1.2.10
ip route 0.0.0.0 0.0.0.0 10.1.2.10
ip route 30.16.18.0 255.255.255.0 10.1.2.191
ip route 172.16.205.0 255.255.255.0 10.1.2.10
ip route 172.18.0.0 255.255.255.0 10.1.2.252
ip http server
ip http authentication local
!
!
!
access-list 10 permit any
access-list 10 deny 10.1.0.0 0.0.255.255
access-list 100 deny ip any 10.1.0.0 0.0.255.255
access-list 100 permit ip any any
access-list 101 permit ip any host 10.1.2.10
access-list 125 permit ip any any
!
route-map 10 permit 10
match ip address 100
set ip next-hop 10.10.1.252
!
route-map testfirewall permit 125
match ip address 125
set ip next-hop 10.1.2.8
!
route-map pbr permit 10
match ip address 10
set ip next-hop 10.10.1.252
!
!
!
!
!
line con 0
stopbits 1
line vty 0 4
exec-timeout 90 0
!
end
