1

I have two Cisco 1941 routers connected to a PA-200 firewall. Each router has a couple of switches attached to it. I want to implement this network.

enter image description here

I have defined a list of 8 firewall zones:

Zone 1 BYOD:           10.1.0.0/16 
Zone 2 DMZ:            10.2.0.0/24
Zone 3 FrontOffice:    10.2.1.0/24
Zone 4 BackOffice:     10.2.2.0/24
....

On the PA Firewall, I want to define access policies between different zones. All traffic inside the network needs to go through firewall, so it can decide for example, if a client from VLAN/zone 1 can send/receive packets from/to VLAN/zone 2.

The routers need to be redundant, so that PC0 can get to the firewall, even if R1 fails. It should then take the path SW1->SW3->R2->FW.

I honestly don't know how to configure it completely, which is something I'm trying to figure out by asking this question. Actually, there's three things I'm confused about.

Problem 1: How do I tell my cisco routers to forward all traffic to my firewall?

I can only guess that this has something to do with setting up a virtual router with an ip address that can function as a default gateway that the clients can use. However, I'm not sure that's going to work, because the PC probably won't be able to see the firewall's mac address since it's behind a router...

Problem 2: How to map my zones using only two physical interfaces (one for each router)?

I've been told that I need a trunk link and 8 logical subinterfaces because I'm using a single cable (instead of 8, one for each VLAN/zone) between each router and the FW. How to configure this?

However, I thought trunking was only possible on switches? Not between a router and a firewall? For example, in a router on a stick configuration, you would define a trunk port on the switch, by using switchport mode trunk, and on a router you would use subinterfaces and tell them to which vlan they belong with the encapsulation dot1q vlan command. This doesn't make the router port a trunking port, right?

Problem 3: Do I need to use redundancy protocols like STP, or FHRP? Or is my network free from loops?

Improve this question

1 Answer 1

Reset to default
4

Problem 1: Routing all traffic is done by the default gateway route.

Problem 2: Each zone requires its own VLAN to separate their traffic, each VLAN connects to the firewall where you set up rules to enable specific connections. Switch-to-switch and switch-to-router lines are set up as VLAN trunks to enable carrying traffic for all VLANs simultaneously. This is different from aggregation trunks.

Problem 3: From your graph you don't need STP but if your network is larger and SW1 and SW3 act as core switches you could set up redundant links from each edge switch to both core switches - then you'd need STP.

Since FW1 needs to do all inter-VLAN routing you could omit both 1941 routers and connect the switches to the PA directly.

Improve this answer
6
  • For problem 1, what would be the default gateway for my clients? An interface on my routers or firewall?
    – user1534664
    Commented Jun 6, 2017 at 21:01
  • What type of link would I need between the routers and the firewall? I don't understand how the traffic reaches the firewall, when the router might already route between vlans.
    – user1534664
    Commented Jun 6, 2017 at 21:02
  • Sorry I'm bad. I forgot what a default route was :p
    – user1534664
    Commented Jun 6, 2017 at 21:30
  • You wrote "all traffic inside the network needs to go through the firewall", so apparently you want to filter inter-VLAN traffic there. The routers are pretty redundant. From your graph, you use the 1941s to route from the VLANs to some other subnet connecting the firewall and the routers. I still have no idea what the colored dots are for - did you want to tell us something?
    – Zac67 ♦
    Commented Jun 6, 2017 at 22:05
  • I used packet tracer to emulate my network. It adds dots to the topology to indicate the interface status of each device. I didn't know how to remove them, but they are irrelevant to my question. You pretty much answered it :)
    – user1534664
    Commented Jun 6, 2017 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.