I have two Cisco 1941 routers connected to a PA-200 firewall. Each router has a couple of switches attached to it. I want to implement this network.
I have defined a list of 8 firewall zones:
Zone 1 BYOD: 10.1.0.0/16 Zone 2 DMZ: 10.2.0.0/24 Zone 3 FrontOffice: 10.2.1.0/24 Zone 4 BackOffice: 10.2.2.0/24 ....
On the PA Firewall, I want to define access policies between different zones. All traffic inside the network needs to go through firewall, so it can decide for example, if a client from VLAN/zone 1 can send/receive packets from/to VLAN/zone 2.
The routers need to be redundant, so that PC0 can get to the firewall, even if R1 fails. It should then take the path SW1->SW3->R2->FW.
I honestly don't know how to configure it completely, which is something I'm trying to figure out by asking this question. Actually, there's three things I'm confused about.
Problem 1: How do I tell my cisco routers to forward all traffic to my firewall?
I can only guess that this has something to do with setting up a virtual router with an ip address that can function as a default gateway that the clients can use. However, I'm not sure that's going to work, because the PC probably won't be able to see the firewall's mac address since it's behind a router...
Problem 2: How to map my zones using only two physical interfaces (one for each router)?
I've been told that I need a trunk link and 8 logical subinterfaces because I'm using a single cable (instead of 8, one for each VLAN/zone) between each router and the FW. How to configure this?
However, I thought trunking was only possible on switches? Not between a router and a firewall? For example, in a router on a stick configuration, you would define a trunk port on the switch, by using
switchport mode trunk, and on a router you would use subinterfaces and tell them to which vlan they belong with the
encapsulation dot1q vlan command. This doesn't make the router port a trunking port, right?
Problem 3: Do I need to use redundancy protocols like STP, or FHRP? Or is my network free from loops?