Routing issues - Layer 3 switch & Smoothwall

[mikkydoos]

Hi all,

 

Can anyone shed some light on this ????

 

I have a L3 Cisco switch at the core that is handling all my VLANs, VLAN routing and ACL's.

Clients have the VLAN gateway address of their VLAN.

 

Cisco:  Next hop address is:  0.0.0.0  ---> Smoothwall.  Smoothwall is configured with virtual VLAN adapters to return Internet back to the correct VLAN....   All is good.

 

However, pinging the gateways on the Cisco is dropping a lot of the ICMP packets.

 

Wireshark shows that the Cisco is redirecting some ICMP packets to Smoothwall... believing it to be a more efficient route than itself?....   the ICMP packet is then lost as Smoothwall isn't returning it to the host.

 

 

 

 

I'm wondering whether this is causing other network packets to be dropped.

 

Anyone got a similar setup or shed any light on why this is happening?

 

 

 

 

I so wish routing could be turned off in Smoothwall and it would JUST be a filter/firewall.  Its a pain with other routers on the network.

 

 

 

Cheers in advance 

 

Edited March 27 by mikkydoos

[Davit2005]

The Smoothwall will need to route traffic back to the core switch if it is routing traffic i.e. been a router for the site but I don't understand how local only traffic is been passed to it.

 

By default connected routes i.e. those that have their gateway on the actual routing device should have a metric of 0 for directly connected. This means that any layer 3 interfaces should communicate directly with each other and not be passed on to another router.

 

I don't have much experience of Smoothwall and limited experience lately of Cisco and with cisco it is has all been cli when ever I have done things in the past.

 

 

Edited March 27 by Davit2005

[mikkydoos]

1 minute ago, Davit2005 said:

The Smoothwall will need to route traffic back to the core switch.

 

 

@Davit2005 

 

Can you explain a bit more... not just routing back to to the VLAN ?

 

 

 

 

 

[Davit2005]

Each device acting as a router has to know how to get to a network it does not know about to pass traffic. Routers will not forward traffic if they have no route for that traffic. So for instance if you have a core switch which has local interfaces in the 10.10.0.0/16 subnet and another router, core switch or firewall that has interfaces in the  10.20.0.0/16 subnets the 2 routers will need to know how to get to each others networks.

Edited March 27 by Davit2005

[JCH_]

As Davidt2005 mentioned. Its sounds as though it is some form of routing issue if your smoothwall appliance is dropping packets and not returning them (Presumably the firewall configuration is setup correctly). Without stating the obvious potentially (I dont know your setup) you need to ensure that in the Smoothwall > Routing > Subnets all of your static routes are setup correctly including subnet and gateway for each of the internal networks on the other side of your core, but this may be fine already. 

 

I would also expect smoothwall to drop all packets if your routing is not setup correctly. They would all drop instead of a select few. It is hard to determine a true cause without having more information on the network setup.

[PaddyNewman]

Can the smoothwall not be configured as a transparent in-line?

 

I'd expect your Cisco to have all VLANs and have a static route of 0.0.0.0/0 to your actual next hop, with your next hop having a "schools network via your core" route to get traffic back, the MAC of which can be learnt through a transparent bridge. I would imagine thats a basic feasible item with Smoothwall. It can just filter on the line, didn't know they enforced some routing on there? 

 

If the Smoothwall needs to route, create a new VLAN on your end on a /30, your IP in one, the smoothwall in another, route between yourselves and have the Smoothwall route your school ranges back and default route to next hop. it either is your LAN or next hop, 1 single route in and 1 route out.

Edited March 27 by PaddyNewman

[ChrisC]

Are all your subnets (or a large range to capture them all) configured in the smoothwall under network > routing > subnets?

 

https://kb.smoothwall.com/hc/en-us/articles/15301663008668-Route-traffic-to-downstream-Subnets

 

Generally that with a static route as you have on your core should route everything correctly. You shouldn't need to have all the VLANs configured under the interfaces.