2

Recently I was troubleshooting a firewall issue on one of my servers and noticed that there was a LOT of ICMP redirect traffic being rejected (as it should be). But this got me thinking why I was getting this these redirect messages to begin with. After some investigation, I found that our central switch is sending them out because it feels that traffic for our branch office and the Internet should be routed by the firewall and not itself. Our network is laid out as follows:

              Switch 1        Switch 2
Server ----- Cisco 3560 ---- Cisco 3560 ---- Firewall ---- Internet/Branch Office VPN
             No Routing      IP Routing

The firewall is connected directly to the Cisco switch on one port and the traffic from the servers comes to the switch from a different port.

Switch 2 does a lot of inter-VLAN routing for us which is why it is the current default gateway for all devices on our network. It would be possible to set up static routes to the various VLANs on the servers/workstations/devices/etc and route all other traffic directly to the firewall but this seems like a lot of work, a hassle whenever a new network is added, etc. Also, from what I've read, the redirect messages should only be sent out if the switch has to forward the packets back out the same port that they arrived on to get to the proper destination (which is not the situation in my case) so I'm not sure why I get the redirects.

So, first, are there performance/security issues with routing to the firewall instead of the "router"? Second, why am I getting ICMP redirects?

EDIT:

Switch 2 config (secure info removed and port list limited to just the two we're interested in):

version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
service password-encryption
service sequence-numbers
!
hostname Switch2
!
boot-start-marker
boot-end-marker
!
aaa new-model
!
aaa session-id common
clock timezone EST -5
system mtu routing 1500
ip routing
ip domain-name caymanport.com
ip name-server 172.16.112.6
ip name-server 172.16.112.23
ip name-server 172.16.112.9
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/43
 description fw-gcm eth1/8 (VL16-INETGUEST)
 switchport access vlan 16
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/44
 description fw-gcm eth1/1 (VL01)
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/46
 description fw-gcm eth1/6 (VL06-Guest)
 switchport access vlan 6
 switchport mode access
 spanning-tree portfast
!
interface FastEthernet0/47
 description fw-gcm eth1/7 (VL10-DMZ)
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/2
 description BillingSwitch MM-F
 switchport trunk encapsulation dot1q
 switchport mode trunk
 srr-queue bandwidth share 10 10 60 20
 srr-queue bandwidth shape 10 0 0 0
 queue-set 2
 mls qos trust cos
 auto qos voip trust
 macro description cisco-switch
 spanning-tree link-type point-to-point
!
interface Vlan1
 ip address 172.16.112.1 255.255.240.0
!
interface Vlan2
 ip address 172.16.129.5 255.255.255.0
!
interface Vlan3
 ip address 172.16.130.5 255.255.255.0
!
interface Vlan4
 ip address 172.16.140.1 255.255.255.0
!
interface Vlan5
 ip address 172.16.150.1 255.255.255.0
!
interface Vlan6
 no ip address
!
interface Vlan7
 ip address 172.16.170.1 255.255.255.0
!
interface Vlan8
 ip address 172.16.180.1 255.255.255.0
!
interface Vlan11
 ip address 172.16.161.1 255.255.255.0
!
interface Vlan12
 no ip address
!
interface Vlan15
 ip address 172.16.240.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.112.254
ip http server
ip http secure-server
!
end

Switch 2 routing table:

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 172.16.112.254 to network 0.0.0.0

     172.16.0.0/16 is variably subnetted, 9 subnets, 2 masks
C       172.16.180.0/24 is directly connected, Vlan8
C       172.16.170.0/24 is directly connected, Vlan7
C       172.16.161.0/24 is directly connected, Vlan11
C       172.16.150.0/24 is directly connected, Vlan5
C       172.16.140.0/24 is directly connected, Vlan4
C       172.16.129.0/24 is directly connected, Vlan2
C       172.16.130.0/24 is directly connected, Vlan3
C       172.16.240.0/24 is directly connected, Vlan15
C       172.16.112.0/20 is directly connected, Vlan1
S*   0.0.0.0/0 [1/0] via 172.16.112.254

Firewall routing table:

flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,
       Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp


VIRTUAL ROUTER: default (id 1)
  ==========
destination                                 nexthop                                 metric flags      age   interface          next-AS
0.0.0.0/0                                   162.211.139.1                           10     A S              ethernet1/3
74.222.73.100/30                            74.222.73.102                           0      A C              ethernet1/8
74.222.73.102/32                            0.0.0.0                                 0      A H
77.222.73.100/30                            77.222.73.101                           10     A S              ethernet1/8
162.211.139.0/29                            162.211.139.2                           0      A C              ethernet1/3
162.211.139.2/32                            0.0.0.0                                 0      A H
172.16.10.0/24                              172.16.10.0                             10     A S              tunnel.3
172.16.11.1/32                              0.0.0.0                                 0      A H
172.16.100.0/24                             172.16.100.10                           10     A S              tunnel.4
172.16.112.0/20                             172.16.112.1                            10       S              ethernet1/1
172.16.112.0/20                             172.16.112.254                          0      A C              ethernet1/1
172.16.112.254/32                           0.0.0.0                                 0      A H
172.16.129.0/24                             172.16.129.254                          0      A C              ethernet1/1.2
172.16.129.254/32                           0.0.0.0                                 0      A H
172.16.130.0/24                             172.16.130.254                          0      A C              ethernet1/1.3
172.16.130.254/32                           0.0.0.0                                 0      A H
172.16.140.0/24                             172.16.140.254                          0      A C              ethernet1/1.4
172.16.140.254/32                           0.0.0.0                                 0      A H
172.16.150.0/24                             172.16.150.254                          0      A C              ethernet1/1.5
172.16.150.254/32                           0.0.0.0                                 0      A H
172.16.160.0/24                             172.16.160.254                          0      A C              ethernet1/6
172.16.160.254/32                           0.0.0.0                                 0      A H
172.16.170.0/24                             172.16.170.254                          0      A C              ethernet1/1.7
172.16.170.254/32                           0.0.0.0                                 0      A H
172.16.180.0/24                             172.16.180.254                          0      A C              ethernet1/1.8
172.16.180.254/32                           0.0.0.0                                 0      A H
172.16.190.0/24                             172.16.190.254                          0      A C              ethernet1/1.9
172.16.190.254/32                           0.0.0.0                                 0      A H
172.16.200.0/24                             172.16.200.254                          0      A C              ethernet1/7.10
172.16.200.254/32                           0.0.0.0                                 0      A H
192.168.1.0/24                              192.168.1.1                             10     A S              tunnel.2
192.168.10.0/24                             192.168.1.1                             10     A S              tunnel.2
192.168.40.0/24                             192.168.1.1                             10     A S              tunnel.2
192.168.50.0/24                             192.168.1.1                             10     A S              tunnel.2
192.168.70.0/24                             192.168.1.1                             10     A S              tunnel.2
total routes shown: 35
2
  • 1
    can you share Switch 2 configuration and routing table, as well as the firewall routing table?
    – JFL
    Nov 30, 2016 at 13:51
  • @JFL - I added the configs you requested.
    – Caynadian
    Nov 30, 2016 at 16:39

1 Answer 1

5

A very quick (and therefore incomplete) answer:

Assuming all of the inside stuff is on the same subnet the ICMP messages are switch2 saying "I don't need to be involved in this, talk to the firewall directly".

What I've usually done for these situations is set up a transit subnet between the inside router (switch2) and the firewall so that switch2 can route to something that's not on the internal subnet. It also gives you a choke point where you can monitor and control traffic leaving your internal network.

I wouldn't recommend static routes on servers in this situation. It's just a pain to manage and adds unneeded complication.

2
  • I hadn't thought about subneting the connection between the two. That's a great suggestion, thanks. I posted more info in case it helps with a better answer.
    – Caynadian
    Nov 30, 2016 at 16:42
  • 2
    Good suggestion. I always like to use a dedicated subnet just for routing. You can also configure "no ip redirect" on the layer 3 interfaces to disable icmp redirects.
    – John K.
    Nov 30, 2016 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.