1

I have 2 subnets on a switch, connected to a router. The attached diagram should show the setup. The firewall controls communications between the 10.45.45.0/25 and the 10.75.75.0/24 subnets, however, the firewall is the gateway for the 45 subnet, not the 75 subnet.

For traffic to get from 45 -> 75, there is 1 hop, the firewall. For traffic to get from 75 -> 45 there are 2 hops, switch, then firewall.

Traffic will not pass from 75 -> 45 when the gateway is set to the switch, but will when it is set to the firewall, even though the switches default route is the firewall.

Does anyone have any idea what would cause this to happen?

enter image description here

Improve this question
4
  • Is the switch a layer-3 switch? If not, it cannot be the gateway (router).
    – Ron Maupin ♦
    Mar 30, 2016 at 16:51
  • It is a layer 3 switch. Using it as the gateway, I can browse online (the router/firewall has connection to the internet)
    – user2678506
    Mar 30, 2016 at 17:30
  • 1
    You need to edit your question to clarify things. You have two answers based on the question, but you keep changing the rules. You need to say that the switch is a layer-3 switch, and that the 45 network is a DMZ, then provide the router and switch models and configurations.
    – Ron Maupin ♦
    Mar 30, 2016 at 17:53
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 7, 2017 at 22:38

2 Answers 2

Reset to default
1

Is there a reason you are avoiding giving vlan45 an ip on the switch? I'd give it a routable IP then gateway to the firewall. If the switch is layer two, the firewall will need a separate/sub-interface to make the hop with. Google router-on-a-stick. Also, keep in mind many, if not most, firewalls are not full featured routers. Make sure your firewall can do the job.

Improve this answer
1
  • This firewall is a full router also (cisco asa). We are not giving the 45 net an IP as it is a dmz, and we want to control traffic between the two subnets. This switch is also layer 3
    – user2678506
    Mar 30, 2016 at 17:09
0

Since the switch is a layer-3 switch, you should make it the gateway for the VLANs, and have a routed link (/30 or /31) from the layer-3 switch to the firewall. This is the standard practice, and it allows the layer-3 switch to route the LAN, and the firewall to route the WAN.

You will need some way for the firewall to know that the LAN networks are on the layer-3 switch, and you can do this with static routes, or via a routing protocol. You will also need to set up a default route on the layer-3 switch to the firewall, or you can receive it from the firewall if you use a routing protocol.

Since both LAN networks will use the layer-3 switch as the router, traffic will automatically be routed between them.

Improve this answer
2
  • We are sending this traffic through the firewall as the 45 net is in a DMZ and should not have full access to the 75 net. Otherwise that is exactly what I would do. Thanks though
    – user2678506
    Mar 30, 2016 at 17:46
  • If the 45 net can't have full access to the 75 net, you will have problems. You will need to provide the firewall model and configuration in order for us to help you.
    – Ron Maupin ♦
    Mar 30, 2016 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.