Cisco Switching/Routing :: DMZ Communication On ASA5510 To 3560?
May 11, 2012
I've recently segmented my network and part of the process was creating a DMZ VLAN. I'm running ESXi 5 and have created two new VM's to add to this DMZ to begin the process of moving everything public facing to the new VLAN. At this point they new hosts will not communicate with each other, their gateway, and of course not the public internet. To get the first out of the way, they are configured according to VMWare's VLAN guide: I have created a new vSwitch port group on the host and assigned them to the VLAN id 11 for the DMZ VLAN, and have the switchport on the switch (3560) setup as trunk in dot1q mode with all vlans tagged. The management VLAN is also NOT the default VLAN 1, so that is not causing any issues. My other server segment VLAN is working fine on the same ESXi host/s, so this does not seem to be the issue.
On the network side of things I have my ASA connecting to a 3560 with two interfaces, one for "inside", one for "dmz."Is this below correct? I feel like the static route should be route dmz with a gateway to 10.0.1.1..
_ASA_
interface Ethernet0/2
nameif dmz
security-level 50
ip address 10.0.1.1 255.255.255.0
route inside 10.0.1.0 255.255.255.0 192.168.201.2 1 <- (192.168.201.2 is my 3560)
[code]....
View 9 Replies
ADVERTISEMENT
Dec 27, 2011
In my lab setup i configured Cisco 3560 switch.
-VLAN 20 and VLAN 30 i configured.
-VLAN 20 interface IP : 192.168.20.1/24
-VLAN 30 interface IP : 192.168.30.1/24.
Inter-vlan communication is happening fine. For testing for purpose i configured extended ACLs.i want stop communication from VLAN 30 to VLAN 20 but not vice-versa. If i ping from one of the IP VLAN 20 to one of the ip of VLAN 30, i was gettng Requested time out. And if i ping from one of the IP VLAN 20 to VLAN 30 interface IP, i was able get pinging.From VLAN 30 to VLAN 20, i was getting destination host unreachable from VLAN 30 ip( Its fine as its my requirement)So, solution needed to communicate from VLAN 20 to VLAN 30.
View 1 Replies
View Related
Aug 29, 2012
We are trying to figure out how to configure this properly and so far we are stuck. We have a VMWare server with two different vmnics each on a different VLAN. We have each of these vmnics connected into their own switch port on a 3560G along with the appropriate VLAN membership for said ports. We have an additional port on this same switch in trunking mode connected to our firewall to a NIC that has an IP address in the respective VLAN networks. This port is also set for dot1q encapsulation. Each VLAN also has an IP set on the switch that is in the appropriate VLAN. We are having issues in this configuration getting the one VLAN to talk to another.
I know if we were in all Cisco mode then we would use ROAS to do this inter-vlan communication. How to make this happen short of changing hardware?
View 7 Replies
View Related
Oct 12, 2011
I have created a new DMZ and a LAN on my ASA5510.My Ethernet DMZ port is connected directly to a server (192.168.220.10) This server is able to get to the internet properly.Gateway ASA router: 192.168.220.222..My Ethernet LAN port is connected to a L3 switch, This L3 switch is connected to a server (192.168.210.11). This server is able to get to the internet properly.My issues is that I cannot communicate from my 192.168.210.11 server to my DMZ server 192.168.220.10. From my 192.168.210.11 server I can ping my gateway 192.168.210.1 and 192.168.210.222. But I cannot ping 192.168.220.222. [code]
View 7 Replies
View Related
Aug 10, 2012
I have a working environment but wondering if there is just a better way to accomplish what I am trying to do (without a layer 3 or 4 switch). Basically I have a few sub interfaces on my Cisco ASA5510.
Now what I do need is some of the VLANs to communicate with specific devices on the different VLANs. So for example I need computer 1 from VLAN 5 to communicate with 192.168.10.5 from VLAN 10 on ports 80 and 443.
What I am currently doing is settings the security level to 100 on each interface (including the DMZ).
Here is what I have:
interface Ethernet0/1.5
vlan 5
nameif Sub5
[Code].....
View 5 Replies
View Related
Dec 11, 2012
I wanted to know about EHWIC 8-Port configuration? We create Data and Voice VLANs and assign 8 ports to the VLANs. So how do VLANS communicate with each other? We cannot make Gi0/1 as sub interfaces and assign the same subnet IP’s as of VLAN IP’s , it wont accept. On 1921 router Assume Gi0/0 we connect to MPLS WAN. What happens to Gi0/1 where do we connect this?
View 1 Replies
View Related
Oct 16, 2012
I'm trying to dial a Cisco 1841 BRI from my Cisco 2811 PRI. I'm getting a few errors but not sure what else to do to correct the issue. Config & Logs below from 1841:
interface BRI0/0/0no ip addressencapsulation pppdialer pool-member 2isdn switch-type basic-niisdn point-to-point-setupno cdp enableppp authentication chap callin
00:26:44: ISDN BR0/0/0 Q931: RX <- SETUP pd = 8 callref = 0x46 Bearer Capability i = 0x8890 Standard = CCITT Transfer Capability = Unrestricted Digital Transfer Mode = Circuit Transfer Rate = 64 kbit/s Channel ID i = 0x89 Signal i = 0x40 - Alerting on - pattern 0 Called Party Number i = 0xC1, '452####' Plan:ISDN, Type:Subscriber(local) Locking Shift to Codeset 5 Codeset 5 IE 0x2A i = 0x808001039E05, 'From ', 0x8B0C, '214 ###-####', 0x8001, '<'00:26:44:
[Code]....
View 2 Replies
View Related
Apr 19, 2012
Cisco 3560 does not support "set ip next-hop verify-availabilty". I need this command in my config. "set ip next-hop" do not do the same job.
View 8 Replies
View Related
Dec 8, 2011
The last few days I've been exploring options in getting rid of some old routers accross a wan connections. I have a cat 3560 to play with and I thought I would try and use the no switchport command test out routing with switch. I've got some type of route issue and I tried a few things which I thought would fix the issue but had no effect. I'll post the config and a few commands so you can see what the basic setup is.
Here we can see in the arp that it knows about both 10.7.1.2 (PC unable to ping 10.3.3.254) as well as 10.3.3.254 (ASA).I tried adding in a ip route of 10.7.0.0 255.255.0.0 10.3.3.110 as well as 10.3.3.254. Neither produced the results I wanted allowing 10.7.1.2 (PC) to ping the ASA (10.3.3.254). [code]
View 4 Replies
View Related
May 8, 2012
I have an environment of 3 X 3560G of which I have 1st switch-CORE(f0/10) connecting to the VPN router(CE) interface-f0/0. Remaining 2 Cisco 3560's(Access) are connected to Gi0/1 and Gi0/2 on the 1st switch-CORE via gi0/1 . On all three switches I have created multiple VLANs and assigned ports to these VLAN. The switch to switch connection is trunk allowing all VLANs created on all these 3 switches. Now the issue is how I am going to have all these VLANs routed through single interface on the routeri-e f0/0, as all these subnets will communicating to remote site over VPN. What should be default gateway on the 2 Access switches and the CORE switch, also what static route should be on router to reach all subnets(VLANs) created on these 3 switches.
I have read inter-VLAN routing i-e creating sub interfaces on router but dont want to proceed with that and looking for any other way to have my VLANs talk on all three switches and then are accessible to remote site ove VPN?
View 9 Replies
View Related
Apr 17, 2012
I have tried to make policy based routing on Cisco 3560. I use ipservices ios (SW version 12.2.(50)SE3 and SW-IMAGE C3560-IPSERVICESK9-M) For below configuration there is no problem and pbr is working.
“Access-list 100 permit ip host 1.1.1.1 host 2.2.2.2
Access-list 101 permit ip host 1.1.1.1 host 3.3.3.3
Route-map pbr1 permit 10
Match ip address 100
Set ip next-hop verify-availability 1.1.1.2 1 track 11
interface fasthethernet 0/1
ip policy route-map pbr1”
But when i add another sequence to the "pbr1" with another sequence number like that.
“Route-map pbr1 permit 11
Match ip address 101
Set ip next-hop verify-availability 1.1.1.3 1 track 12”
pbr is not working. Switch gives message "PLATFORM_PBR-3-UNSUPPORTTED_RMP:Route-map pbr1 not supported for Policy Based Routing”"ip policy route-map pbr1" command not shown in the running config. And "show ip policy" output is blank.Configuration guide says you have insert many sequence to the route-map with the same name. And also this command is not in the unsupported command list.
View 16 Replies
View Related
Jun 4, 2013
I am trying to get my workstation to talk to a workstation on a different sub-net through a Cisco 3560 switch. The switch is running the following IOS version: [code]
My primary network is 172.16.0.0 and I am trying to connect to a device on a 192.168.111.0 sub-net. [code]
What would be the best way to get the two workstations talking via the switch?
View 3 Replies
View Related
Dec 11, 2012
I implemented access list on cisco 3560 switch but it never works. I want to block access from network B to Network A and allow from Ato B
Network A. 10.0.12.0/24
Network B 10.0.24.0/24
The configuration is
interface Vlan1
description Data VLAN
[Code].....
View 14 Replies
View Related
Apr 28, 2012
We recently purchased Cisco 3560X Layer3 Switch. We need to perform simple Inter VLAN routing. We have configured VLAN1 (name-server_vlan) and VLAN2 (name- user_vlan). We have also assigned the Ports and IP address to both the VLANs. After assiging this if we plug Laptop A into VLAN1 then it doesnt communicates with Laptop B (btw, Laptop A is able to Ping VLAN2 Gateway ) in VLAN2 but on the other hand Laptop B is able to communicate with Laptop A and ping everything i.e. Gateway of VLAN1.
View 17 Replies
View Related
Feb 25, 2013
We have two catalyst 3560 switches running c3560-ipbasek9-mz.122-58.SE2.bin They are connected using etherchannel using gi 0/21 - 24 interfaces.
on 3560-1 switch, there isn't any ip-default gateway or ip route configured. It only have 1 interface vlan configured.
on 3560-2 switch, there is ip default gateway configured along with 1 interface vlan.
What i dont understand here is that, i can reach out to other subnets from 3560-1 switch in which the routing is not enabled?
View 4 Replies
View Related
Oct 21, 2012
I have a 2504 WLC connected to a Catalyst 3560 which has multiple vlans and is connected to a 2800 series router. I know the catalyst is L3 but I am needing nat functions to get outside to the internet. From my 2800 series router I am able to ping out to the internet, also I am able to ping the vlan interfaces on the catalyst switch. Problem is from the catalyst switch I can ping the inside and outside address of the 2800 but I cannot get any further then that. I cannot ping the 2800 router gateway. Not sure what I am doing wrong as far as routing.
I've attached my 2800 and 3560 configs.
View 3 Replies
View Related
Oct 7, 2012
I am trying to upgrade the IOS in 3560 but I am facing one issue. Its flash is 15MB & available space is 8MB whereas the IOS is of 11MB. How can I upgrade the IOS without upgrading the flash?
View 4 Replies
View Related
Mar 10, 2013
We bought a 3560 PoE switch to replace tons of PoE-injectors but when connecting the devices our logs were flooded with
Mar 11 15:09:20.725: %ILPOWER-7-DETECT: Interface Fa0/7: Power Device detected: IEEE PD
Mar 11 15:09:20.725: %ILPOWER-5-INVALID_IEEE_CLASS: Interface Fa0/7: has detected invalid IEEE class: 7 device. Power denied
Mar 11 15:09:20.968: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down
Mar 11 15:09:20.985: %ILPOWER-7-DETECT: Interface Fa0/7: Power Device detected: IEEE PD
Mar 11 15:09:20.985: %ILPOWER-5-INVALID_IEEE_CLASS: Interface Fa0/7: has detected invalid IEEE class: 7 device. Power denied
While the message seems quite clear im wondering if there's any workaround on the problem?
View 13 Replies
View Related
Jun 6, 2013
I have a Cisco SW ( 3560 ) with one Trunk link to my router ( 7606 ), Trunk link is fully utilized so i need to add 2nd Trunk.Shall all move some customers from old trunk to 2nd one and create a new subterface for them ?I am think if i can create bundle and add subinterfaces under this bundle ?Add two GE ports to be memeber of this bundle ?
View 5 Replies
View Related
Oct 28, 2012
We have a IP-phone system connected to port 1 on a 3560 switch, the phone system tags traffic with dscp. The switch uplink is on port 24.
Is this configuration correct:
interface 1:
auto qos trust
interface 24:
priority-queue out
View 3 Replies
View Related
Nov 21, 2012
I have a 3560, which is being used as our core router that I have recently installed. It still has the standard IOS which came with (C3560E-UNIVERSALK9-M) it but I need to implement policy based routing so need to upgrade it and have downloaded c3560-ipservicesk9-mz.122-58.SE2.bin and indeally would like to install it in the morning before people start work.
I have 2 questions, 1, Is the ipservices capable of PBR as I have been reading conflicting reports, in fact my friend who works for Cisco has advised that it is not possible on the 3560.
2, When I do upgrade will there be any current configurations that are not compatible with the new one, I wouldnt image that there would be any but just wanted to make sure as it would be the biggest headache ever if it went wrong.
View 7 Replies
View Related
Nov 23, 2011
I configured following command to implement QoS on Cisco 3560.
class-map match-any IND
match access-group name Lync
policy-map LyncAV
class IND
set ip precedence 4
[code]....
how to apply this QoS on interface?
View 3 Replies
View Related
Jul 29, 2012
I have a 3560 POE that will no longer boot and I am not able to load a fresh copy of software onto it. It appears that it has lost all data. When I attempt to TFTP a new IOS, I receive that following error:
Transfer cancelled by remote system
I have tried using dir flash: to see what is contained in the flash directory but I receive the below message:
unable to stat flash/: no such device
I am stuck in rommon mode so when I do switch: dir command, I don't even see flash as being a filesystem. The below list are the only systems registered.
bsdcs[0]: (read-only)
bstage[1]: (read-only)
fstage[2]: (read-write)
xmodem[3]: (read-only)
null[4]: (read-write)
tftp[5]: (read-only)
Is this switch finished or is there something else I could try?
View 8 Replies
View Related
Jun 5, 2012
I have issue with 3560 switch QoS configuration . I checked in cisco site about mentioned model QoS configuration.once we mark the frame and map the CoS to DSCP and once it enters into switch and it processes according to LAN QoS configured on interface
we have configured both the commands shape and share.
once it leaves the switch and enters into Edge router and if we do not have configured QoS in router which is normally MQC , how does it process each packet ?Do we need to have end to end QoS configured in LAN ?
View 5 Replies
View Related
Mar 17, 2013
I found that when I enabled layer 2 auto QoS in 3560 switch, I need to wait so much time to open a file in network drive. Howerver, when I disable the Qos. It can improve a lot. I have used a sniffer to capture the packet to see. Those default packet is in DSCP 0. Therefore, I think majority packet will drop to queue 4. How can I increase the buffer and threshold in order to improve queue 4 performance.
View 1 Replies
View Related
May 12, 2013
We have two L3 3560's. One 3560 has an upstream MPLS router. The other 3560 has an upstream backup VPN router. Both of these 3560's are L3 switches with IP routing enabled. I created a PBR on both so that specific traffic routes through the MPLS router, while other traffic routes over the backup VPN router. I'm trying to apply the PBR to the SVI's, on each switch. However, when I do a "sh run", the PBR does not appear under either SVI. I've enabled the SDM Routing template, made sure that ip routing was enabled, and even verified that the IOS has the capability. Not sure what else to check for.
View 8 Replies
View Related
Sep 21, 2012
I've a question about QoS classification on Cat3560 From
"When QoS is enabled with the mls qos global configuration command and all other QoS settings are at their defaults, traffic is classified as best effort (the DSCP and QoS value is set to 0) without any policing. No policy maps are configured. The default port trust state on all ports is untrusted."
Now, when mls qos cos override is configured on a port, how is the switch behavior ? From documentation "All the incoming QoS values are assigned the default QoS value configured with this command". However I believe the port state is "untrusted".....so which DSCP values are assigned to them ? Is used a Qos-to-dscp map to derive the QoS label from the (overridden) QoS value also in this scenario ?
View 2 Replies
View Related
Jul 1, 2012
Consider the following case:
PC1-----Acess link--f1/1--SW1-- Acess link---------F 0/1-R1-acess link-------Sw2-----trunk--------SW3-f1/4--------PC2
All switches are multilayer switches ( 3560) Pc1 and PC2 are running Cisco Soft phones. If we configure SW3 with: int f1/4
mls qos trust dscp.
1)Does the above command require SW3's f1/4 be configured as layer 3 port not layer 2? ( My reasoning is since Sw3 has to get to Ip header to process DSCP values, therefore Sw3'f1/4 should be configured for layer 3 operation.)
2) What if sw3 were not 3560 but layer 2 switch such as old 2900 series. can layer 2 switch be configured with: mls qos trust dscp.? Will layer 2 switch be able to interpret dscp values and perform QOS ? ( My understanding is layer 2 switch should not be able to read dscp values ). I will be posting few more questions on the above scenario.
View 7 Replies
View Related
Oct 24, 2011
I upgraded our 3560-48-ps switch from c3560-advipservicesk9-mz.122-35.SE5.bin to c3560-ipservicesk9.mz.122-55.SE4bin and is having issues now.
Since I upgraded to the new IOS our older machines on the network can no longer connect to the domain and is not getting an IP address sh ip dhcp binding and sh ip dhcp conflict does not show any output, however all newer machines on the network received dhcp addresses without any problems and can connect to the network and internet.
For testing purposes I put the old IOS back on the switch and the older machines could connect again and received dhcp addresses.No other changes were made to the config.
I did a comparison on Cisco's website and both IOS's support DHCP. Not sure why the new IOS would not give any output when I ran the commands.older machines : Apollos and NCS (They all have XP service pack 2 with Intel 2.8 processors.)
View 1 Replies
View Related
Mar 4, 2012
I have a need to use a 3560 switch to terminate a provider's internet connection, but want to secure it so that it and the vlans connected to it are not wide open. At the same time, I'd like to use stateful packet inspection.
I have IOS 12.2(44)SE2, but IPBASE running on my 3560s. Is there an IOS (perhaps the ADVIPSERVICES of that version?) that allows a 3560 to use the 'ip inspect' command?
View 2 Replies
View Related
Apr 24, 2012
I’ve attached a simple network diagram of my WAN network. We have branch offices that came into our Headquarters using VPN tunnels over the public Internet and then we have a handful of offices that are connected to our headquarters via a private MPLS network. All of this traffic is routed into our Cisco ASA 5510s that we currently use for firewall and core network routing and VPN termination. All branch offices have VPN tunnels to our Cisco ASA. The Cisco ASA isn’t necessarily designed for core routing even though it was worked decent for us. We’d like to move the core routing off of the Cisco ASA and just use it as an Internet security/DMZ device like it is designed. We were hoping to purchase one pair (for failover) of the Cisco ISR router to perform our core routing and VPN termination. Can we eliminate the Cisco 2621 Internet router and use a single, beefy router to handle the Cox MPLS traffic and the Internet traffic on the same router?If we had one ISR doing these duties, where would the router sit in our topology?Is it safe to bring our Internet Circuit and MPLS circuit into the same router? How about with VRF?Do the Cisco ISR 2900/3900 support VRF and can I do VPN tunnels if I do the VRF?
View 2 Replies
View Related
Feb 29, 2012
I have an ASA5510 from which I am using 3 interfaces.
-One interface have the main internet connection router
-One interface is attache to a switch 3750 and has multiple virtual interface configured on it
-One interface has another internet connection router.
What I am trying to do is to have only one of the Vlan using the second internet connection and not the first one.
My idea was to just have a static route who says that on interface VLAN_B (for the special VLAN), all traffic goes to 2nd internet router interface. But it does not route. All I have is a default route configured : on interface Internet1 0.0.0.0/0 goes to 1st internet router interface.
View 10 Replies
View Related
Sep 26, 2012
On our ISA server we have some publishing rules with the option "Requests appear to come from the ISA Server computer". This allows us to forward incoming external traffic to a network that is not directly connected to the ISA Server internal interface. We need this because our internal server does not know the route to the internet client but does know the route to our ISA Server, so the internal server sends his response to the ISA server and he sends it to the internet client.
View 1 Replies
View Related
