Suppose you have three groups of servers on the following VLANs and subnets:
Name VLAN ID Subnet ----------------------------------- Production 3 10.0.0.0/24 Test 103 10.0.0.0/24 Lab 111 10.0.0.0/24
Suppose also that
Production is connected to the internet with a Cisco ASA as its gateway at
The purpose of
Lab is to allow us to replicate as closely as possible the servers on the
Production network so that we can safely test changes to them without impacting production.
If you naively replicate the servers on the
Production network and connect them to
Test then they retain their
10.0.0.0/24 IP addresses as shown in the above table. Now suppose I want to also provide a connection to the internet for the
Test network through the same Cisco ASA. It seems like this would be a problem because the ASA would base its routing decisions on IP addresses of which there are now duplicates on different VLANs.
This leaves me with the following questions:
- Is there a way to provide internet access to multiple VLANs which incidentally have the same subnet behind a single ASA?
- If so, how is this acheived? How would the ASA know to which VLAN to send a given packet if both VLANs have the same subnet?
- Is there a better way to provide internet connectivity to a test network containing servers with the same IP addresses as production?