Hi @Richard Burts , thank you.   We hope to use routed ports on the links between the switches. With this in mind, do you have any idea how to configure the VRF to use the routed links on the global switch? Is there routing leak involved? ... View more

Hi @Richard Burts & @Jon Marshall , I have to re-visit this as this came to haunt me again. I have a task to exhaust all options before scrapping this idea completely. Let me repaint the context of this requirement: 1. As seen in the picture (sample.jpeg) 2. Switches are now layer 3 instead of layer 2. 3. Hosts from various subnets are having their gateway on the L3 switch. 4. Firewall A and firewall A1 are both standalone firewalls. 5. If hosts from subnet A wants to communicate to subnet A1 (which are completely different subnets), the traffic do not have to go through the firewalls. 6. If hosts from subnet A wants to communicate to subnet B or B1, traffic has to be forced to the nearest firewall for routing. 7. If the nearest firewall fails, the other firewall takes over the routing. 8. Left network (subnet A and B with firewall A) and right networks (subnet A1 and B1 with Firewall A1) are located in 2 different locations.   Now, we are trying with VRF-lite on the L3 switch, with each VRF is a subnet (or VLAN). We are thinking: a. Creating VRF A, VRF B, VRF A1 and VRF B1 on both sides of the network. b. Having a trunk across the 2 L3 switches to carry all VRFs (or VLANs) across each site. Is this possible? c. To have point 5 fulfilled, we will have a static route for VRF A1 in VRF A (and vice versa). d. To have point 6 and 7 fulfilled, we forced all other traffic to the nearest firewall and have a floating static to the other firewall. Is this possible?   Problems we faced so far are: i. We are not able to trunk all the VRFs (or SVIs) across each site. Are we to do a L2 or L3 trunk? ii. Is point d above even possible?   To be detailed in the equipment we are using: aa. We are using Cisco Catalyst 9300 with Network advantage for the L3 switch bb. We are using a firepower 2130 (with FTD) as the Firewall A and Firewall A1 without FMC.   I know this is going against norms with this network. Thanks for your help. ... View more

Hi Rick, the requirements that are passed to us are: 1. 2 active standalone (not A/S) firewalls to perform inter-VLAN routing, if 1 goes down, the other firewall can take over the routing. 2. The 2 core switches (L2/L3) are configured with HSRP. 3. All servers from various VLANs/subnets are connected to the core switches. To achieve the above, do you have a better solution? I believe the design that is passed to us is already not common and according to best practice but the solution is also there to meet the limitations that the environment presents. ... View more

Hi Rick, thanks for your reply. We will give your suggestion a try and will post back any results.   The reason why we want the firewall to route is because we want full visibility and control of the routed traffic, in terms of security. ... View more

Hi Rick, agreed on your point, the gateway should be the device that routes. Now we are changing the switch to a layer 3 switch. Gateway is at the layer 3 switch now and will now point to the firewall via static routes for inter-vlan traffic. Now, there is another firewall on a stick, as depicted in the diagram, which is also a stand-alone firewall. To achieve HA, do i need IP SLA? ... View more

Hi Richard, thanks for your reply. I do understand that putting the switch as layer 2 and the gateway is the firewalls are akin to the router-on-a-stick methods. If lets say the switches are layer 3, any possibility to allow this as gateway and and still the firewall do the inter-vlan routing? ... View more

Hi Richard, thanks for looking into this to assist me. I have attached the eventual network diagram. There are 2 sites, 1 on the left and 1 on the right with identical network equipment and devices. 1. The 2 firewalls are stand-alone and not deployed in a high availability mode. 2. These 2 firewalls will have the same routing and policy tables. 3. The switches can be layer 3 and the link between the switches are configured with HSRP for the VLANs. 4. In this example, there are 2 VLANs. Laptop 1 and laptop 3 are in VLAN 10, Laptop 2 and Laptop0 are in VLAN 20. 5. Inter-vlan traffic must be routed via the firewalls. (Most important requirement) 6. If firewall 0 fails, firewall 1 will continue to provide inter-vlan routing capabilities. 7. If laptop 1 and laptop 3 wants to communicate, the traffic need not go to the firewall but within the same layer 2 domain and VLAN.   The requirements above are a must. Let me know. Thank you! ... View more

Hi Seb, thanks for pointing me in some direction. I'll give your suggestions a try and will post shortly of any results. Regarding your suggestion on: "If so, experimenting with the HSRP config is still valid as you could configure the ASAs in Active/ passive using a shared IP for each VLAN.",   Our implementation will have 2 active stand-alone firewalls, not A/P firewalls. ... View more

Hi Seb, thanks for your reply. Maybe I forgot to let you know the requirement. All traffic have to go through the router and the router have to be the only layer 3 devices that does inter-vlan routing. Eventually the router will be replaced with an ASA firewall. So with ASA firewall, HSRP will not be possible. ... View more

H, thanks for replying, the topology is as attached. Router's subinterfaces as the gateways for the laptops are not possible as there is 1 more similiar router-on-a-stick (this is used as a redundant router-on-a-stick) on the switch.   ROUTER: interface GigabitEthernet0/0 no ip address duplex auto speed auto ! interface GigabitEthernet0/0.10 encapsulation dot1Q 10 ip address 192.168.10.1 255.255.255.0 ! interface GigabitEthernet0/0.20 encapsulation dot1Q 20 ip address 192.168.20.1 255.255.255.0 ! interface GigabitEthernet0/1 no ip address duplex auto speed auto shutdown ! interface GigabitEthernet0/2 no ip address duplex auto speed auto shutdown ! interface Vlan1 no ip address shutdown ! router ospf 1 log-adjacency-changes redistribute connected subnets network 192.168.0.0 0.0.255.255 area 0 default-information originate ! ip classless ! ip flow-export version 9   SWITCH: spanning-tree mode pvst ! <truncated> ! interface GigabitEthernet1/0/1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet1/0/2 switchport access vlan 10 switchport mode access switchport nonegotiate ! interface GigabitEthernet1/0/3 switchport access vlan 20 switchport mode access switchport nonegotiate ! ! interface Vlan1 no ip address ! interface Vlan10 mac-address 00e0.f700.5801 ip address 192.168.10.2 255.255.255.0 ! interface Vlan20 mac-address 00e0.f700.5802 ip address 192.168.20.2 255.255.255.0 ! ip default-gateway 192.168.10.1 ip classless ! ip flow-export version 9 ... View more