Cisco WAN :: 6500 / Inter / Intra VLan ACL - OSPF?
Dec 11, 2011
Core: DC : 2- 6500 (PO Trunked) Configured L3 vlan interfaces with HSRP.
Vlans:
Servers - 192.168.5.0/24
PCs: 192.168.10.0/24
Phones : 192.168.20.0/24
Replica-exchange: 192.168.30.0/24
DR- One Core SW:
Vlans:
Servers vlan - 10.10.5.0/24
PCs: 10.10.10.0/24
Phones : 10.10.20.0/24
Replica-exchange: 10.10.30.0/24
OSPF is the routing protocol. Everything works fine.New requirement (exchange 2010 MAPI & DAG subnets)
192.168.5.0 <--> 192.168.30.0 & 10.10.30.0 : Communication should fail
10.10.5.0/24<--> 192.168.30.0 & 10.10.30.0 : Fail
Replica@DC <--> Replica@DC: work
Replicas --> Rest of the nw- not that of an issue.
Iam thinking of adding a Extended ACLs on Replica-Exchange (DC & DR) and servers Vlan interfaces to block bidirectional communication.
CORE1 &2:
access-list 101 deny ip 192.168.5.0 0.0.0.255 192.168.30.0 0.0.0.255access-list 101 deny ip 10.10.5.0 0.0.0.255 192.168.30.0 0.0.0.255access-list 101 permit ip any any
!access-list 102 deny ip 192.168.30.0 0.0.0.255 192.168.5.0 0.0.0.255
[code]....
Similar to the same on DR as well. I wanted to see if ACL is the way to go or any other suggested methods with OSPF being the routing protocol.
View 2 Replies
ADVERTISEMENT
May 9, 2013
I'm looking to restrict Inter-VLAN routing through L3 switch (cisco 6500) and wanted to know best possible way to do it. I used VACL and achieved success to some extent, but my config is making clients take up to 5-6 mins to authenticate IP address from the DNS (bootps).My VACL config was as follows:
Subnet to restrict is 10.100.15.0 (VLAN 15)
STEP 1: Created extended ACL to allow bootpc/bootps through DNS
ip access-list extended EACL_DNS
permit udp any eq bootps any
permit udp any eq bootpc any
STEP 2: Created standard ACLs to allow only relevant subnet, server VLANs & some IPs from other subnets for printers/scanners etc.
ip access-list standard SACL_VLAN_15
permit 10.100.15.0 0.0.0.255 (the subnet I'm restricting)
permit 10.100.50.0 0.0.0.255 (server VLANs)
permit 10.100.25.45 0.0.0.0 (printer in another VLAN which has to have access in VLAN 15)
STEP 3: Created VLAN access list
vlan access-map VACL_15 10
match ip address EACL_DNS
action forward
vlan access-map VACL_15 20
match ip address SACL_15
action forward
STEP 4: Applying VLAN Access list on VLAN 15 vlan filter VACL_15 vlan-list 15 Though the above works, below is noted:
1. I'm still able to PING 10.100.15.2 (the switch virtual interface) from outside the subnet, which I don't intend to do so. Howeve all cients in the subnet have no connectivity from outside the VLAN 15.
2. As mentioned its taking quiet some time to negotiate with the DNS server at system boot time.
View 3 Replies
View Related
Mar 14, 2011
Currently the OSPF network consist of 2 segment route via static route.One is AREA 0 and another AREA 10.Both network are seperate entity, only static route to route between 2 networks.But the static route do not provide the dynamically and flexibility, I plan to run routing between 2 networks via VLAN160 and VLAN162.
I still want to manitnace it was 2 different OSPFrouting domain.Can I run OSPF with differrent OSPF porcess ID?
View 8 Replies
View Related
Feb 26, 2013
When you configure an ABR to inject a summary route into an area, what are the circumstances under which the ABR will inject the summary? I.e., since it's not a set of specific subnets learned directly from other OSPF routers, does the summary get injected regardless of what's in the routing table of the ABR?
I would imagine this could cause problems in a situation where there is an ABR injecting a large summary into an NSSA that also has a backup path over the Internet (IPsec tunnel or something). For example, if the area 0 routers from which the ABR receives routes went down, the ABR would continue to inject the summary route into the NSSA thus tricking those routers into sending traffic to the ABR rather than over the backup link.
I can't imagine any other way an ABR would decide when it's suitable to inject the summary though.
View 1 Replies
View Related
Feb 21, 2013
I have One switch 3750 and many switch 2960 c.I use one ASA 5510 to reach emote branche site (vpn conexion).I use one router 1841 for internet conexion.Router 1841, ASA and catalyst 2960 are connected on the 3750.Default gateway of all user is ASA IP
I configured Vlan 3750 and it work.Now I need to implement security : permit/block specific traffic between vlan [code] From vlan 72 I cannot have remote access on computer in vlan 34 and I cannot ping computer in vlan 34.
View 1 Replies
View Related
Mar 28, 2013
We recently extended our access layer using a pair of 5ks with extenders. We have a pair of 6509s at our core and they handle the intra-VLAN routing with SVIs. I recently noticed that access hosts connected to the extenders cannot pass traffic between each other if they are in different VLANs. The strange thing is these same hosts can ping devices in other VLANs as long as the other devices are not connected to the 5k environment.
For example, consider the following hosts. Each host has their gateway set to the appropriate SVI on our core.
HostA - VLAN100 - connected to 5k extender
HostB - VLAN200 - connected to 5k extender
HostC - VLAN100 - connected to 2960 off our core
HostD - VLAN200 - connected to 2960 off our core
Each host can ping each other with the exception of HostA and HostB. As for specifics, we use HSRP (no VSS) between our cores.
When I ping between hostA and hostB, I see the egress packets on either 5k1 or 5k2. I then see ingress AND egress on Core1. There are no ingress packets on 5k1 or 5k2.The egress packets from Core1 show the correct destination MAC address of the target host. The mac address table shows the mac address on po31.
View 16 Replies
View Related
Feb 4, 2013
We have an existing network with a core 6500 as a VSS connecting 4 buildings with 4500 chassis under which number of L2 switches are connected. Currunlty we are using RSTP in ring for redundancy but we want to use OSPF in LAN for faster conversion.All the VLAN's are created on 6500.
View 4 Replies
View Related
Jan 3, 2013
I have a customer who has vlan's and SVIs residing on a core 6509. the 6509 is connected to an ASA 5515 then out to the internet/sp edge deviceIP routing is not turned on. there is a static route on the 6509 that routes all ip's to the inside interface of the asa 5515 that the 6509 core is connected to.there is a set of vlans that are apart of a 192.168.128.0/19 subnet and all those vlans can "speak" to each other.
View 8 Replies
View Related
Apr 12, 2012
Just messing around with packet tracer for a little practice. I tried to setup a router on a stick config with 3 switches trunked and PCs on different vlans. Anybody know of any issues that may arise with STP and inter-vlan routing? I set everything up correctly with trunking, addressing, encapsulations, vlans, but did not touch STP. Unable to ping from any PC to any where.
View 19 Replies
View Related
Aug 26, 2012
I manage a small/medium sized campus network consisting of 4 Cisco 6500 series chassis (each with SUP720's) and a couple hundred Cisco 3550/3560/2960 edge switches. We recently completed a new leg of fiber that will make a completed loop between all of the 6500's .... before I make the pyhsical connection I need to figure out my OSPF entries on each 6500 switch.
View 4 Replies
View Related
Feb 25, 2013
Say I have a managed switch that supports VLANs. I have two computers and one server connected to the switch (I'll call them PC-1, PC-2, and SRV-1).Without routing, I want both PC-1 and PC-2 to talk to SRV-1 and vice versa, however I don't want PC-1 or PC-2 to talk to each other.I achieve this by making each port a trunk port. I make PC-1 a member of VLAN 2, PC-2 a member of VLAN 3, and SRV-1 a member of VLAN 4. The port that SRV-1 is on I make a tagged member of PC-1 and PC-2 (VLAN 2 and 3 respectively) and make the ports the PCs are on a member of the SRV-1 VLAN (VLAN 4).Everything tests OK (that is, the clients can't talk to each other, however the clients can individually talk to the server)
View 6 Replies
View Related
Jan 31, 2013
What is inter vlan routing protocol? What are its three modes?
View 6 Replies
View Related
Oct 21, 2011
i am doing a set-up having the ASA as my Layer 3 device providing inter-vlan communication. ASA with 8.3 firmware. how i can achieve this goal. i am trying to follow some answered topic related to this but its pre 8.3. VLANs created on the same physical have same security level.
View 2 Replies
View Related
Sep 12, 2011
[code] I would like to config two IP ranges, one for staff, one for guest wireless access. The dlink wap supports multi vlan SSIDs.Reason I'm doing this is to prevent access on the guest wireless to access the win 2003 server.Will the switch inter vlan route the 192.168.2.1 to 192.168.1.1? How will vlan 2 get DHCP, will dhcp relay need to be set on vlan 2 to 192.168.1.20 ? [code]
View 2 Replies
View Related
May 17, 2011
Can inter VLAN routing be done on SRW (Cisco 300 series) switches ?
View 5 Replies
View Related
May 12, 2013
I know very little about switches. This is the first time I've ever touched them. However, I'm the only one in the company who has the slightest knowledge on how to make them work.
4 vlans
vlan 1 - 192.168.32.1 - Existing network with Internet access
vlan 33 - 192.168.33.1
vlan 34 - 192.168.34.1
vlan 35 - 192.168.35.1
From the laptop on vlan 33 I can ping the management interfaces (192.168.x.1) for each of the vlans. However, I cannot ping anything on those networks.
Below is what I have with the config. Right now not much attached to these switches until they are setup.
Code:
config-file-header
poe-switch
[Code].....
View 19 Replies
View Related
Jan 11, 2012
We are cutting over from 6500 IOS to Nexus 7000 and have hit "Maximum ospf feature instance limit reached." as we configured up the 7 existing ospf processes - the limit is 4. These existing processes are for various vrf contexts we have. I see you can run multiple vrf contexts under one process - but how does that work in a mixed environment where the ospf neighbours are still ios 6500s? They still expect to see different ospf process id per vrf.
View 2 Replies
View Related
Oct 7, 2012
I am observing some strange behaviour related to the routing table, almost all external routes and some inter-area routes are getting refreshed every 10 seconds.
I am getting more than 1000 entries after running 'sh ip route | i 00:00:0', these external routes are being advertised by a neighbor 6500 which redistributing these static routes.
Platform is 6500 with SUP-720
View 3 Replies
View Related
Oct 30, 2012
I want to do the inter vlan routing packet tracer file url...configuration of MLS are as bellow can anyone tell me why vlan on switch0 can not ping vlan on switch1. [code]
View 12 Replies
View Related
Jan 15, 2013
Recently configured one nexus 3048 switch. Create two vlans (Vlan 10 and Vlan 19). Vlan 10 is 10.1.X.X/24 and Vlan 19 is 192.168.X.X/24, connected two pcs one is Vl 10 and second pc 19. But not able to communicate both Vlans.Nexus 3048 are not Support VTP Mode Server, running version 5.0. [code]
View 2 Replies
View Related
Dec 4, 2012
Short version is we cannot communicate between our subnets.We have a Cisco ASA 5505 we are using for our network router. We have a Netgear L3 switch behind that with 10 vlans. Each VLAN is on its own subnet. (10.0.10.x/24, 10.0.11.x/24, etc)We have PAT for each subnet to our outside interface. Each subnet NATs out properly currently.I have NAT exemption enabled for 2 of the subnets (eventually I will need all, but am just testing at the moment). I have tried multiple ways for the NAT exemption to allow all traffic from our inside VLANS. At this point in time I am trying to get "Engineering" to communicate with all hosts on "AuthUser". I can ping some hosts, but not as many as if I am directly on the interface. I can reach a port 80 service, but not 443. I cannot access anything via hostname or NetBIOS.What am I missing to allow higher security level interfaces to fully communicate with lower security level interfaces?
View 0 Replies
View Related
Jun 6, 2012
I have a connection on IP 192.168.1.21, Subnet 255.255.255.0 - this is on the default VLAN1 on the switch. I need to route this to IP 10.0.3.101, Subnet 255.255.252.0 - which is set up on VLAN2 on the switch. I have set the switch to Layer 3 via console.
how I setup this route? I am use the Browser based interface.
View 15 Replies
View Related
Jan 11, 2013
I have set up a 2811 with seperate VLANs for phones, and another for computers/printers. Fa0/0 is trunked to a 3560 switch, which has all end devices plugged in. I have enabled the IP Routing commands on both devices, and from advice turned off proxy-arp on the VLANs on the router (unsure if this is causing the issue). The setup is as follows
Computer VLAN = 192.168.20.0
Phone VLAN = 192.168.50.0
Both on the same subnet, along with a router loopback address in the same subnet, at 192.168.10.1.I am having an issue understanding why, but if I try to ping a phone from a PC it times out. Or if I try to type the phone's IP into an internet browser to get the phone's GUI on screen, it fails. This should not be happening as IP routing has been enabled on both, and everything is in the same subnet, correct? PC's can ping other PC's and network printing works fine. Phones register and operate fine, but the two VLAN's will not interoute.Furthermore if I try and ping the router's loopback from the switch, it fails. But the trunk is up and operational because DHCP and devices work within their own VLAN. If I try to ping end devices from the switch, it returns 100%. There seems to be an issue with the router looping the different networks together.
View 35 Replies
View Related
Oct 3, 2011
I've recently installed an SGE2010 switch, which I have set to 'Layer 3' mode.
I have created 2 VLANs using 192.168.10.x and 192.168.20.x (using .50 for the VLAN IP address in each case) - however, I need to be able to allow certain traffic between the VLANs.Alternatively, to get things started - I'm assuming I need to set up ACLs to allow access between VLANs - how would I configure the switch to allow all traffic from one VLAN to the other?
View 5 Replies
View Related
Jul 8, 2012
Ive been readin all over the internet (including this site) trying to figure out if the asa can handle intervlan routing. Im not sure what I am missing on my config to get this to work. Ive read that it can work and Ive read that it cant work. How to get this to work on my asa 5505.
Here is my setup
Cable Modem ---> ASA (eth0/0)
(eth0/2) -->unmanaged switch for LAN connectivity
(eth0/3) --> Access point for wireless LAN connectivty
My config is attached
What I would like to do is be able to communicate between vlan3(LAN) and vlan4(Wireless LAN)
Whats strange is I can RDP between the two vlans but I cant ping or anything else.
View 20 Replies
View Related
Jul 31, 2011
We use Cisco Any connect with a Cisco ASA 5520 firewall. Today I changed the inside interface of the firewall's IP because i needed to do some inter vlan routing and needed to move the inside interface from the lan vlan to a routed port on our 3750.
Now people can vpn and authenticate to the MS radius inside but cannot access any network resources nor ping anything inside.
View 1 Replies
View Related
Sep 29, 2011
I have no router inplace that can do trunking (5505 basic license )I have 2 VLANS 10 Data 20 voice I have given both VALNs IPs lets say
-VLAN10 192.168.1.1
-VLAN20 192.168.2.1
Enabled IP routing and set the router as the gateway of last resort.Now becuase the L3 switchis doing the routing I have had to set the default gateway as the VLAN IPs. So PCs on VLAN10 get a gateway of 192.168.1.1 and phones on VLAN20 get a gateway of 192.168.2.1
Any real downside to having the 3560 doing the VLAN routing, is this the "correct "way to do things in the event I don't have a trunkable router?
View 8 Replies
View Related
Mar 17, 2012
configure my new SG300-28P. When I have started the switch, I have specified a new password and enabled telnet in order to setup the switch in Layer 3 mode.
After a restart, the switch took its IP address from a DHCP server. When I try to set a static IP address (192.168.2.1), I receive the following error message: Duplicated IP interface on the same subnet.
The IP address 192.168.2.1 is not used by any device within the network. For information, the message doesn't appear when the switch is in Layer 2 mode.
why I can't change the IP address of default vlan in Layer 3 mode ? All I can do is set the IP address to static or dynamic.
For test purpose, I have added 2 vlans. But I wasn't able to route traffic between vlan. how to configure the switch to route traffic between vlan?
find below details informations about my VLANs.
- Default (VLAN ID 1)
IP Address : 192.168.2.1
Subnet : 255.255.255.0
[Code].....
View 3 Replies
View Related
Apr 1, 2012
In my home setup I have an PFsense firewall wich is doing all the routing right now, but right now my net speed is maxing out about 500mbit, i my think it's the pfsense hardware, but its an 1500Mhz C7 VIA with 2Gb ram, I just bought two new switchs, HP-1910-24g and a HP 5500-24G they can do some layer 3 routing, will my speed get a bumb up when the switch is doing some of the vlan routing.
View 2 Replies
View Related
Aug 21, 2012
We have an OSPF network with four 6500 Distribution Switches. They are fully meshed and see each other as peers and are sharing routes. Off of one pair (Border) there is a setup of 3750G siwtches that go off to another network and they do not run OSPF. Between the Border Dist and the 3750G Switches we run HSRP. The 3750G side uses HSRP GP 192 and the Dist Side uses HSRP 192.There are static routes on the 3750G pointing to the Dist HSRP address to get back to network.Pings fail from the OSPF side to the HSRP address on the 3750G side.If I do a trace from the OSPF side to the HSRP address it hits one border dist switch then the other and fails.If I have static routes on both border dist switches pointing to the HSRP on the 3750side, do we need to change the metric on one dist so that it is preferred over the other or should the router Id take care of that?
View 1 Replies
View Related
May 18, 2012
Second laptop attached to cisco 10mb port with an IP address of 10.18.158.200 and the cisco interface 10.18.158.254.Okay, here is what is happening and I cannot work it out.If I ping, from Laptop 1 to the cisco subinterface on 192.168.94.253 it is succesful. If I ping from the 1721 to Laptop 1 it is successful. I see the VPN come up and the rulebase on the junipers show the traffic flowing across (ICMP).If I ping, from the 10.18.158.254 interface via telnet on the 1721, I can ping all the way through to 192.168.194.254, which is the gateway for Laptop 1.
View 1 Replies
View Related
May 15, 2013
we have an SG300 latest 1.3 firmware, we have it acting as our DHCP server, we have a 10.10.1.x range, 10.10.3.x range, and 192.168.24.x range, they are all on seperate VLANs and all can talk to each other which is what we want. However we have someone who wants to use the 192.168.1.x range to add IP cameras to our network using there own switch. I figured I'd just setup our server to do DHCP etc and it would communicate with the 10.10.1.x range of IP addresses no problem. It turns out the SG300s can't do DHCP for that range, so if he has all static address on the 192.168.1.x range how can i setup inter VLAN communication so we can talk to that range?
View 1 Replies
View Related
Mar 6, 2012
Is there any way to granularly allow hosts from one vlan to be able to access another vlan with Inter-VLAN routing DISABLED?Can the use of an ACL override the setting?In general I don't want any traffic between VLAN's but there are 2 hosts on one VLAN that I would want to allow access to a server on another VLAN.
View 1 Replies
View Related
