dastrix Posted July 3, 2015 Posted July 3, 2015 Hello All, I am hitting a brick wall at the moment, we have multiple VLAN's and i want the traffic to go to a different filtering system, however i am unable to change the default gateway for a separate VLAN I have to change it for all vlans. Is there a way i can achieve what i am trying to do. Regards Chris
IanT Posted July 3, 2015 Posted July 3, 2015 (edited) Hello, Are you doing this via the Web GUI or CLI, if you want to change the default gateway for a particular VLAN see below via CLI (example): conf t vlan 201 no ip address then input your new default gateway for your vlan: ip address 10.52.200.254 255.255.255.0 wr mem maybe do a show ip test | Manual 10.52.200.254 255.255.255.0 No Edited July 3, 2015 by IanT
dastrix Posted July 4, 2015 Author Posted July 4, 2015 Ok maybe im not explaining properly we have all the Vlans setup etc but i need to tell the vlan to use a different ip for getting on the internet not using the default gateway on the switch how do i tell it to use a different gateway on a vlan basis
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 Ok maybe im not explaining properly we have all the Vlans setup etc but i need to tell the vlan to use a different ip for getting on the internet not using the default gateway on the switch how do i tell it to use a different gateway on a vlan basis Do you mean a completely different system, as in hardware not just have a different policy applied? I think you need a second router(layer3 switch) for this. I'd set vlan 1 to go to router 1 and its default gw will be filter 1. Vlan 2 can then go to router 2 and its default gw will bite filter 2.
dastrix Posted July 4, 2015 Author Posted July 4, 2015 Well we have a layer 3 core and 2 filtering systems, i just want to get a vlan to access the new filtering system so that i can test it out before going live in the holidays.
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 Set the d gw to of the vlan to be the new filter rather than the layer 3 switch?
dastrix Posted July 4, 2015 Author Posted July 4, 2015 tryed that wont let me it changes the default gateway for all vlans
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 Not on the layer 3 switch. On the clients. Change the option in DHCP.
dastrix Posted July 4, 2015 Author Posted July 4, 2015 tried that and the traffic seems to be going though old filtering for some reason
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 Is the new filter on the same vlan as the test vlan? If not then the layer 3 switch will detect that the traffic is not local and send it down is default route.
IanT Posted July 4, 2015 Posted July 4, 2015 I think we need a bit more information on this, if you change the default gateway in the DHCP Settings for that scope should be good. Can we have some screenshots, wireshark logs, filtering system in use?
dastrix Posted July 4, 2015 Author Posted July 4, 2015 i have specified a route for the vlan to send to traffic to the new filtering system.
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 i have specified a route for the vlan to send to traffic to the new filtering system. Could you post the route table of the layer 3 switch?
dastrix Posted July 4, 2015 Author Posted July 4, 2015 ip route 0.0.0.0 0.0.0.0 10.0.0.25 (this is current firewall and filter) ip route 0.0.0.0 0.0.0.0 192.168.120.1 ip route 10.1.0.0 255.255.255.0 10.0.30.11 ip route 10.5.32.0 255.255.252.0 10.0.30.16 (this is new filter) ip route 192.168.0.0 255.255.255.0 10.0.0.25 The current firewall is staying its just having the filtering turned off.
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 Okay, so are all these addresses on the switch apart from the 2 filters? Which I'm assuming are Old 10.0.0.25 New 10.0.30.16 The subnet you want to go through the new filter is 10.5.32.0 That route table shouldn't work as traffic which is not bound for local traffic has to choose between the two 0.0.0.0 routes.
dastrix Posted July 4, 2015 Author Posted July 4, 2015 So are you saying I need to add 0.0.0.0 0.0.0.0 10.0.30.16
Marshall_IT Posted July 4, 2015 Posted July 4, 2015 I'm saying you shouldn't have to 0.0.0.0 0.0.0.0 routes on one router unless one is a backup route and has a higher cost to it. Otherwise it'll get confused.
dastrix Posted July 4, 2015 Author Posted July 4, 2015 I think its more to do with this default gateway that i cant change
GeekyPete Posted July 5, 2015 Posted July 5, 2015 Your DFG has to be in the vlan you are setting it for. Think about is as "which door to use to get out of the house". It has to be a door that's actually in the house, you can't use next door's front door to leave your house. Where it goes to after that is a routing issue. So set up a static route between your DFG and the Filtering device on your layer three switch. Alternatively assign an interface on your filtering device an IP address in your vlan and set that as the DFG.
dastrix Posted July 5, 2015 Author Posted July 5, 2015 The device doesn't allow multiple interfaces, we have static routes in place as i can ping etc from all the vlans and reach the management console
GeekyPete Posted July 5, 2015 Posted July 5, 2015 The device doesn't allow multiple interfaces, we have static routes in place as i can ping etc from all the vlans and reach the management console So you keep the same DFG as all traffic passes through it anyway. All the routing points all externally bound traffic to the internal interface of the filtering device which you also set as your proxy server whether you set it up transparent or otherwise.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now