Vlans and Firewall (internal QA)

[smitty0375]

Hello world!

I have a virtual machine environment setup for QA purposes. It has 3 vlans that need to be separated by firewall.

2 3560's 1 asa 5510.

The vlans are on Switch A & B with the ESX boxes plugged into A and the firewall into B. The 3 interfaces on the firewall are in their respective vlans.

All servers ping each other and totally ignore that the firewall is even there, even with explicit rules.

Thoughts? I put the switchports that the firewall are plugged into as trunks but that didn't help either.

[Jon Marshall]

Do you have L3 vlan interfaces on the 3560 for these vlans ? If so you would need to remove them and only route off the ASA for the firewall to come into effect.

Jon

[smitty0375]

I am using these switches for routing too so I cannot turn off IP routing. When I do a traceroute from one vm on a subnet to another on a different subnet it simply hits the default gateway, in this case the vlan ip, then straight to the destination. The connected routes of the vlans are bypassing the firewall.

[Jon Marshall · Accepted solution]

Jerry

You don't need to turn off ip routing but you cannot have L3 vlan interfaces for the vlans you want to firewall. If these vlans contain other servers as well then you can either use acls on the L3 SVIs or you need to move the server(s) you want to firewall between into new vlans.

As long as L3 vlan interface exists on the 3560 you will route around the firewall.

You could in theory use PBR i guess to send the specific server traffic to the firewall interfaces and allow the rest of the servers in the same vlan to use their L3 vlan interface on the 3560 but -

1) you need IP Services on your switch

2) if you really require firewalling then standard acls or PBR are not really sufficient.

Jon