Recently I was troubleshooting a firewall issue on one of my servers and noticed that there was a LOT of ICMP redirect traffic being rejected (as it should be). But this got me thinking why I was getting this these redirect messages to begin with. After some investigation, I found that our central switch is sending them out because it feels that traffic for our branch office and the Internet should be routed by the firewall and not itself. Our network is laid out as follows:
Switch 1 Switch 2 Server ----- Cisco 3560 ---- Cisco 3560 ---- Firewall ---- Internet/Branch Office VPN No Routing IP Routing
The firewall is connected directly to the Cisco switch on one port and the traffic from the servers comes to the switch from a different port.
Switch 2 does a lot of inter-VLAN routing for us which is why it is the current default gateway for all devices on our network. It would be possible to set up static routes to the various VLANs on the servers/workstations/devices/etc and route all other traffic directly to the firewall but this seems like a lot of work, a hassle whenever a new network is added, etc. Also, from what I've read, the redirect messages should only be sent out if the switch has to forward the packets back out the same port that they arrived on to get to the proper destination (which is not the situation in my case) so I'm not sure why I get the redirects.
So, first, are there performance/security issues with routing to the firewall instead of the "router"? Second, why am I getting ICMP redirects?
Switch 2 config (secure info removed and port list limited to just the two we're interested in):
version 12.2 no service pad service timestamps debug uptime service timestamps log datetime service password-encryption service sequence-numbers ! hostname Switch2 ! boot-start-marker boot-end-marker ! aaa new-model ! aaa session-id common clock timezone EST -5 system mtu routing 1500 ip routing ip domain-name caymanport.com ip name-server 172.16.112.6 ip name-server 172.16.112.23 ip name-server 172.16.112.9 ! spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id ! vlan internal allocation policy ascending ! interface FastEthernet0/43 description fw-gcm eth1/8 (VL16-INETGUEST) switchport access vlan 16 switchport mode access spanning-tree portfast ! interface FastEthernet0/44 description fw-gcm eth1/1 (VL01) switchport trunk encapsulation dot1q switchport mode trunk ! interface FastEthernet0/46 description fw-gcm eth1/6 (VL06-Guest) switchport access vlan 6 switchport mode access spanning-tree portfast ! interface FastEthernet0/47 description fw-gcm eth1/7 (VL10-DMZ) switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/2 description BillingSwitch MM-F switchport trunk encapsulation dot1q switchport mode trunk srr-queue bandwidth share 10 10 60 20 srr-queue bandwidth shape 10 0 0 0 queue-set 2 mls qos trust cos auto qos voip trust macro description cisco-switch spanning-tree link-type point-to-point ! interface Vlan1 ip address 172.16.112.1 255.255.240.0 ! interface Vlan2 ip address 172.16.129.5 255.255.255.0 ! interface Vlan3 ip address 172.16.130.5 255.255.255.0 ! interface Vlan4 ip address 172.16.140.1 255.255.255.0 ! interface Vlan5 ip address 172.16.150.1 255.255.255.0 ! interface Vlan6 no ip address ! interface Vlan7 ip address 172.16.170.1 255.255.255.0 ! interface Vlan8 ip address 172.16.180.1 255.255.255.0 ! interface Vlan11 ip address 172.16.161.1 255.255.255.0 ! interface Vlan12 no ip address ! interface Vlan15 ip address 172.16.240.1 255.255.255.0 ! ip classless ip route 0.0.0.0 0.0.0.0 172.16.112.254 ip http server ip http secure-server ! end
Switch 2 routing table:
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 172.16.112.254 to network 0.0.0.0 172.16.0.0/16 is variably subnetted, 9 subnets, 2 masks C 172.16.180.0/24 is directly connected, Vlan8 C 172.16.170.0/24 is directly connected, Vlan7 C 172.16.161.0/24 is directly connected, Vlan11 C 172.16.150.0/24 is directly connected, Vlan5 C 172.16.140.0/24 is directly connected, Vlan4 C 172.16.129.0/24 is directly connected, Vlan2 C 172.16.130.0/24 is directly connected, Vlan3 C 172.16.240.0/24 is directly connected, Vlan15 C 172.16.112.0/20 is directly connected, Vlan1 S* 0.0.0.0/0 [1/0] via 172.16.112.254
Firewall routing table:
flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp VIRTUAL ROUTER: default (id 1) ========== destination nexthop metric flags age interface next-AS 0.0.0.0/0 126.96.36.199 10 A S ethernet1/3 188.8.131.52/30 184.108.40.206 0 A C ethernet1/8 220.127.116.11/32 0.0.0.0 0 A H 18.104.22.168/30 22.214.171.124 10 A S ethernet1/8 126.96.36.199/29 188.8.131.52 0 A C ethernet1/3 184.108.40.206/32 0.0.0.0 0 A H 172.16.10.0/24 172.16.10.0 10 A S tunnel.3 172.16.11.1/32 0.0.0.0 0 A H 172.16.100.0/24 172.16.100.10 10 A S tunnel.4 172.16.112.0/20 172.16.112.1 10 S ethernet1/1 172.16.112.0/20 172.16.112.254 0 A C ethernet1/1 172.16.112.254/32 0.0.0.0 0 A H 172.16.129.0/24 172.16.129.254 0 A C ethernet1/1.2 172.16.129.254/32 0.0.0.0 0 A H 172.16.130.0/24 172.16.130.254 0 A C ethernet1/1.3 172.16.130.254/32 0.0.0.0 0 A H 172.16.140.0/24 172.16.140.254 0 A C ethernet1/1.4 172.16.140.254/32 0.0.0.0 0 A H 172.16.150.0/24 172.16.150.254 0 A C ethernet1/1.5 172.16.150.254/32 0.0.0.0 0 A H 172.16.160.0/24 172.16.160.254 0 A C ethernet1/6 172.16.160.254/32 0.0.0.0 0 A H 172.16.170.0/24 172.16.170.254 0 A C ethernet1/1.7 172.16.170.254/32 0.0.0.0 0 A H 172.16.180.0/24 172.16.180.254 0 A C ethernet1/1.8 172.16.180.254/32 0.0.0.0 0 A H 172.16.190.0/24 172.16.190.254 0 A C ethernet1/1.9 172.16.190.254/32 0.0.0.0 0 A H 172.16.200.0/24 172.16.200.254 0 A C ethernet1/7.10 172.16.200.254/32 0.0.0.0 0 A H 192.168.1.0/24 192.168.1.1 10 A S tunnel.2 192.168.10.0/24 192.168.1.1 10 A S tunnel.2 192.168.40.0/24 192.168.1.1 10 A S tunnel.2 192.168.50.0/24 192.168.1.1 10 A S tunnel.2 192.168.70.0/24 192.168.1.1 10 A S tunnel.2 total routes shown: 35