03-26-2017 08:45 PM - edited 03-08-2019 09:55 AM
Dear Cisco Expert,
I unable to perform static routing inside ASA interface.
If I perform command "ip routing" on my L3 Switch, I've trouble to control the L3 switch InterVLAN.
(I don't want VLAN 100(OLEO) and VLAN 101(ESTER) talk each other, Only VLAN 102(PHD) can talk to Outside, VLAN 100(OLEO) and VLAN 101(ESTER)
My question is, this network design can be work ?.Or I need re-design and add another VLAN for Link to ASA?
Please help me on this.
Thanks.
Hanif
Solved! Go to Solution.
03-27-2017 04:18 AM
Hanif,
in that case do not put any SVI's on your switch with IP addresses (so under your interface vlan 100, 101 and 102 dont configure an ip address). Just run a trunk between the switch and the firewall and put each VLAN;s default gateway IP address on the inside interface of the ASA and apply your access lists on those interfaces.
so the only IP address on your switch is on so you can telnet to it, thats it.
Please rate if helpful
03-27-2017 05:24 AM
Hi
As Dennis mentioned, you could use one only link between the Firewall an L3 switch, the gateways will be created on the firewall, it is also called intervlan routing, similar to routing in a stick scenario, this is an example:
Scenario
SWITCH -----trunk ---- Firewall
FIREWALL
interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/0.100
vlan 100
nameif OLEO-VLAN
security-level 100
ip address 10.0.1.1 255.255.255.0
!
interface GigabitEthernet0/0.101
vlan 101
nameif ESTER-VLAN
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/0.102
vlan 102
nameif PHD
security-level 100
ip address 10.2.1.1 255.255.255.0
SWITCH
vlan 100
vlan 101
vlan 102
interface g1/1
switchport trunk encapsulation dot1q
switchport mode trunk
no shutdown
* You will only create the vlans on the switch, no SVIs there.
Every internal network with security level 100 in order to communicate only if you are allowing the access.
Please rate the comment if it is useful
:-)
03-27-2017 04:18 AM
Hanif,
in that case do not put any SVI's on your switch with IP addresses (so under your interface vlan 100, 101 and 102 dont configure an ip address). Just run a trunk between the switch and the firewall and put each VLAN;s default gateway IP address on the inside interface of the ASA and apply your access lists on those interfaces.
so the only IP address on your switch is on so you can telnet to it, thats it.
Please rate if helpful
03-27-2017 05:24 AM
Hi
As Dennis mentioned, you could use one only link between the Firewall an L3 switch, the gateways will be created on the firewall, it is also called intervlan routing, similar to routing in a stick scenario, this is an example:
Scenario
SWITCH -----trunk ---- Firewall
FIREWALL
interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/0.100
vlan 100
nameif OLEO-VLAN
security-level 100
ip address 10.0.1.1 255.255.255.0
!
interface GigabitEthernet0/0.101
vlan 101
nameif ESTER-VLAN
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface GigabitEthernet0/0.102
vlan 102
nameif PHD
security-level 100
ip address 10.2.1.1 255.255.255.0
SWITCH
vlan 100
vlan 101
vlan 102
interface g1/1
switchport trunk encapsulation dot1q
switchport mode trunk
no shutdown
* You will only create the vlans on the switch, no SVIs there.
Every internal network with security level 100 in order to communicate only if you are allowing the access.
Please rate the comment if it is useful
:-)
03-30-2017 12:07 AM
Dear Julio,
Thanks a lot for your details explanations.
Now we
Easy understand your explanations. =)
Thanks,
Hanif
03-30-2017 04:23 AM
It was a pleasure my friend.
Have a great day!
:-)
03-30-2017 12:09 AM
Dear Dennis,
Thanks for your suggestions.
Now understand the link from switch to ASA.
Thanks again =))
Regards,
Hanif
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide