Routing issue: SVI vs Firewall interface

[LANnister]

Greetings

I have several switches interconnected in my network and multiple VLANs configured with SVI assigned to each. InterVLAN routing works just fine. The switchport connected to corporate firewall is the first port on the main switch (interface GigabitEthernet1/0/1 I recon).

The firewall is VLAN unaware and it is managed by third party; I do not have access to it. The firewall is configured to route below two ranges only, and that is fine:

155.111.215.254/25 (servers)

10.15.245.254/24 (end users)

In my network, these ranges are broken down to sub-ranges and assigned VLAN ip address. Other ranges that I have in my network (192.168.x.x) are used by peripheral devices within LAN only and do not need to reach the firewall (neither internet).

So here is the problem I have:

If I point end user machines and servers to corresponding firewall interfaces (assign default gateway accordingly), they can reach each other and have access to internet. But they would not be able to reach peripheral devices in 192.168.x.x range which are pointed to respective VLAN IP address (SVI).

If I point end user machines and servers to respective VLAN IP address, they would reach peripheral devices, but there would be no connection to the internet. So what I need is access to internet for computers with ip address within firewall configured range, but with SVI as the default gateway rather than the firewall interfaces.  

My request to add each VLAN to the firewall was rejected because it would cost money.

For a workaround, I wonder whether there is something to do with the switchport connected to the firewall, or it is adding some rules on the firewall I need (like NAT). If it is the latter, then how to make a proper request to the firewall management team.

I would appreciate a suggestion on how to deal with this.  Many thanks.

PS: Attaching main switch config file just in case.

[Karsten Iwen]

If you don't need firewalling between the VLANs, then just add them as SVIs on your L3-switch. The only thing that has to be done on the firewall is to add these networks into the routing and allow the needed traffic to the internet.

For each network you add, typically two to four lines of new firewall config is needed. Putting all this into your documentation is probably more expensive then doing the firewall-changes ...

[nkarthikeyan]

Hi,

You can tweak something in the firewall to make this work... you can have the firewall has the gateway for all VLAN's.... you can do NAT exemption in the firewall to reach those pheripheral devices.... and you should have the route from the firewall to reach that and access-list should allow that......

same-security-traffic permit intra interface - to permit access to flow through same interface......

Make sure you are able to reach those pheripheral vlan from ASA 1st... then do setp by step.... acl's, NAT exemption, same-sec., route... route shouwld be pointed to core devices, since that has the direct connectviity from pheripheral devices VLAN...

Regards

Karthik

[zeuscyril]

hi

you have to do changes in the firewall only as explained by other people. no other go