1

We are in the process of replacing our firewall and are keeping the VPN client traffic on the older device. The public IP range is being split between the two devices from our border router. All the devices are Cisco. My question is given the setup below is there a better way to set the route statements?

I am going to change the PUB IPs to a RFC1918 range for this example.

physical connection --> edge switch, connecting: edge_router_inside_int01, edge_router_inside_int02, FW_old outside, FW_new outside

Range info: 192.168.1.1/24

config: edge_router_inside_int01: 192.168.1.249/29 FW_old_outside: 192.168.1.250/29

edge_router_inside_int02: 192.168.1.2/25 FW_New_Outside: 192.168.1.1/25

Route config:

ip route 192.168.1.0 255.255.255.128 New_FW_outside
ip route 192.168.1.128 255.255.255.192 New_FW_outside
ip route 192.168.1.192 255.255.255.224 New_FW_outside
ip route 192.168.1.224 255.255.255.240 New_FW_outside
ip route 192.168.1.240 255.255.255.248 New_FW_outside
ip route 192.168.1.248 255.255.255.248 Old_FW_outside

Is there a better way to abbreviate that?

2

You could consider prioritising the routes for the small portion like this. The tighter route will take precedence over the longer, so the priorities aren't strictly necessary but help explain the mechanism:

ip route 192.168.1.0   255.255.255.0   newfw 20
ip route 192.168.1.248 255.255.255.248 oldfw 10

Perhaps with a device-of-death in case the link to oldfw goes down and you want to prevent the route to newfw: this does need a priority that's worse than the real route.

ip route 192.168.1.248 255.255.255.248 null0 15
| improve this answer | |
  • Longest match always wins, so metrics aren't necessary. Also, unless oldfw is on a physical interface that goes down, the loopback (did you mean null?) route will never replace the lower metric route. – Ricky Beam Dec 21 '18 at 20:02
  • Thanks Ricky, I wasn't paying enough attention! Corrections made. – jonathanjo Dec 21 '18 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.