Google Answers Logo
View Question
 
Q: Firewall per subnet with 1 Cisco router ( No Answer,   4 Comments )
Question  
Subject: Firewall per subnet with 1 Cisco router
Category: Computers > Security
Asked by: dcovell-ga
List Price: $30.00
Posted: 25 Aug 2004 15:10 PDT
Expires: 04 Sep 2004 15:54 PDT
Question ID: 392594
I have 2 subnets (10.0.1.0/24 and 10.0.2.0/24) both plugged into the
same Cisco 2611xm router with the physical interface fastethernet0/0
being 10.0.1.254 and fastethernet0/1 being 10.0.2.254.

The problem is I need the subnets to talk to each other but at the
same time have different internet routes. The 10.0.1.0/24 subnet needs
to send all internet traffic to 10.0.1.250 and the 10.0.2.0/24 subnet
needs to send all internet traffic to 10.0.2.250.
Answer  
There is no answer at this time.

Comments  
Subject: Re: Firewall per subnet with 1 Cisco router
From: crythias-ga on 26 Aug 2004 20:38 PDT
 
The devices on the subnets need their gateways (0.0.0.0) routes to
point to 10.0.1.250... at that point, in the router, have each
10.0.x.250 point to the WAN but have a static routing table (in
10.0.1) of 10.0.2.0/24 route to 10.0.2.250 and the reverse in
10.0.2...

However, this is possibly tough to route properly on the same physical
fe0 (depends on the IOS). The better way would actually  be to have
different WIC's for each network. Probably not likely to happen, but
you must get two different static routes on the same physical
interface. Possible? maybe, but it may not be the best in performance.
Subject: Re: Firewall per subnet with 1 Cisco router
From: antoiglesias-ga on 02 Sep 2004 00:04 PDT
 
In my opinion you should configure your devices in the following way:

Hosts on 10.0.1.0/24 (except 10.0.1.250 and 10.0.1.254)
Their default gateway should be 10.0.1.250. 
- Something like: ip route 0.0.0.0 0.0.0.0 10.0.1.250 

Hosts on 10.0.2.0/24 (except 10.0.2.250 and 10.0.2.254)
Their default gateway should be 10.0.2.250. 
- Something like: ip route 0.0.0.0 0.0.0.0 10.0.2.250 

Device with IP address 10.0.1.250:
It should have the following Static route stating that 10.0.2.0/24 is
reachable Via cisco Router.
- Something like: ip route 10.0.2.0 255.255.255.0 10.0.1.254


Device with IP address 10.0.2.250:
It should have the following Static route stating that 10.0.1.0/24 is
reachable Via cisco Router.
- Something like: ip route 10.0.1.0 255.255.255.0 10.0.2.254


Cisco Router:
To allow this operation it is not necessary to configure any static
route in the router. From the moment you assign IP addresses to F0/0
and F0/1, it knows how to reach 10.0.1.0/24 and 10.0.2.0/24.


The Operation would be as follows:

1) 	Let us suppose that device 10.0.1.10 needs to talk to 10.0.2.10.
It would work in the following way:
	From 10.0.1.10 to 10.0.1.250 to 10.0.1.254(Ciscosīs F0/0) to 10.0.2.10 via F0/1
	The reverse path would be:
	From 10.0.2.10 to 10.0.2.250 to 10.0.2.254(Ciscoīs f0/1) to 10.0.1.10 via F0/0

2)	Let us suppose now that the traffic is from 10.0.1.10 to the Internet:
	From 10.0.1.10 to 10.0.1.250. At this point the device 10.0.1.250
takes the forwarding decission and using probably a default route
would send the traffic to the propper next hop that might be, for
example the Internet Service Provider's router.
Subject: Re: Firewall per subnet with 1 Cisco router
From: dcovell-ga on 02 Sep 2004 10:05 PDT
 
I spoke with Cisco about this as well and the answer they gave me was
to set the PIX firewalls as the default gateways and then set a static
route in the PIX's back to the router. The router would then connect
the 2 subnets together by passing 10.0.1.0 traffic off to 10.0.1.250
and then 10.0.2.0 traffic to 10.0.2.250.

Thank you for your comments as they confirm that this solutions is the
best one available. I really would have liked to have the router as
the default gateway but that looks like it is not going to happen.
Subject: Policy Based Routing - Re: Firewall per subnet with 1 Cisco router
From: dcovell-ga on 04 Sep 2004 15:54 PDT
 
Finally I spoke with another Cisco Tech who gave me the answer I was
looking for. The problem with using a PIX as the default gateway is
they are not designed to route traffic except internally to it's
interfaces. So the previous plan that Cisco gave me failed. Policy
based routing is what I was looking for but the serveral steps
involved were confusing to me. I now have policy based routing on the
2611xm and it works great with the interfaces on the router acting as
the default gateways. Here is the email from Cisco explining the steps
and the actual commands..............

Topology:
 
T1----PIX1---10.0.1.0------ROUTER-----10.0.2.0-----PIX2---CableModem
 
Workstations on the 10.0.1.0 network should be sent to Internet
through the T1 link, and the 10.0.2.0 network through the cable modem.
Each network should be able to see the other.
The original problem was that the workstations were using the PIX as a
default gateway. The PIX is not able to re-route packets through the
same interface in which it received them in the first place. The best
way to deal with this is to change the default gateway of the
workstations to point to the router. To make all this configuration
work we needed to configure PBR (Policy Based Routing).
 
   This is the configuration we did:
 
SELECTING INTERESTING TRAFFIC
conf t
access-list 110 deny ip 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255
access-list 110 permit ip 10.0.1.0 0.0.0.255 any
 
access-list 120 deny ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255
access-list 120 permit ip 10.0.2.0 0.0.0.255 any
 
CREATING ROUTE-MAPS
route-map PBR1 permit 10
match ip address 110
set ip next-hop 10.0.1.250
exit
 
route-map PBR2 permit 10
match ip address 120
set ip next-hop 10.0.2.250
exit
 
APPLYING PBR
interface fast0/0
ip policy route-map PBR1
interface fast0/1
ip policy route-map PBR2

BIG THANKS to Ricardo Prado of Cisco for helping me with this.
Hopefully this will help someone else in the future.

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy