Using Smoothwall Express With a Cisco Layer 3 Switch?

[Ric_]

Have you seen the attached image on post 1?

 

You mean the one that doesn't say whether the two IPs are for the clients or the switch and it has no subnet/IPs for the network the Smoothie is on?

[FN-GM]

Oh so it doesnt. Smoothie is on 192.168.0.1 255.255.255.0 the siwtch itself doesnt have an IP yet.

[twin--turbo]

The switch will need to be on a vlan with an ip in the 192.168.0.0/24 subnet.

 

and

 

ip route 0.0.0.0 0.0.0.0 192.168.0.1

[twin--turbo]

The smoothwall will need routes for the other vlans with a GW set as the IP of the switch.

[FN-GM]

The switch will need to be on a vlan with an ip in the 192.168.0.0/24 subnet.

 

and

 

ip route 0.0.0.0 0.0.0.0 192.168.0.1

 

Yes but that does every VLAN. I only need it on certain ones

[Ric_]

I think it is worth pointing out that nobody has given you the full config... we all seem to be giving you enough information to have a bash (maybe we are evil or maybe we are trying to help you learn).

 

The thinking is...

You need a route to VLAN A on the switch

You need a route to VLAN B on the switch

You need a default route on the switch

 

You then set the switch as your gateway on the clients and maybe add static routes on your Smoothie.

[FN-GM]

But you set the default gateway on the clients as the vlan interface? According to Cisco anyway.

 

If i do this and add the below static routes it should work?

 

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

[twin--turbo]

You only need one explicit route on the cisco and that is the default one.

 

Each client has a DG which is the IP of the VLAN interface IP for it's subnet.

 

Rob

[FN-GM]

I know you only need one but i dont want that. I am going to have another VLAN pointing to a different firewall. I want to specify the firewall for each vlan.

 

So will what i posted above work with that?

[twin--turbo]

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

 

To do what?

 

That would tell the cisco that those two networks are routed by the smoothie to somewhere else.

 

 

 

in brief.....

 

Cisco

------

 

vlan 1

name smoothwall_network

 

vlan 2

name twenty_one_network

 

vlan3

name twenty_two_network

 

interface vlan 1

description connection-to-smoothwall

ip address 192.168.0.2 255.255.255.0

ip helper-address (ip of dhcp server (must be on one of the vlans)

no shut

 

interface vlan 2

description twenty-one-network

ip address 172.20.1.1 255.255.255.0

ip helper-address (ip of dhcp server (must be on one of the vlans)

no shut

 

interface vlan 3

description twenty-two-network

ip address 172.20.2.1 255.255.255.0

ip helper-address (ip of dhcp server (must be on one of the vlans)

no shut

 

int range g0/1-10

description smoothwall vlan

switchport mode access

switchport access vlan 1

no shut

 

 

int range g0/11-20

description 20-1 vlan

switchport mode access

switchport access vlan 2

no shut

 

int range g0/11-30

description 20-2 vlan

switchport mode access

switchport access vlan 3

no shut

 

ip routing

ip route 0.0.0.0 0.0.0.0 192.168.0.1

 

 

 

 

point each client's dhcp default GW to the respective vlan interface IP.

 

Point smoothwall routing for 172.20.2.0/24 to 192.168.0.2

Point smoothwall routing for 172.20.1.0/24 to 192.168.0.2

 

Smoothwall should already be aware of 192.168.0.1

 

 

Rob

[FN-GM]

But you have put ip route 0.0.0.0 0.0.0.0 192.168.0.1 - This will send all vlans to smoothwall? I dont want to send all of them

 

Why cant i put this?

 

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

[twin--turbo]

I want to specify the firewall for each vlan.

 

Ok.

 

It's client configuration time..

 

You specify the DG as the firewall which must be plugged into the same vlan as the client.

You Specify on the client static routes to the other vlans you want to access and put the gw as the IP of the vlan.

 

Rob

[twin--turbo]

Your going to have to draw up a full diagram as I am struggling to understand what your trying to achieve.

 

What is the purpose of the Smoothwall?

 

Rob

 

 

Edit: Hold on just re referenced the diagram...

Edited November 21, 2012 by twin--turbo

[FN-GM]

Why cant i put this?

 

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

[twin--turbo]

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

 

This tells the cisco that to get to any client on 172.20.1.0 that the next routing hop is the smoothwall. But in reality the cisco itself has these networks directly connected to it's vlan interfaces..

 

to allow the clients to access the internet there must be a default gateway 0.0.0.0 0.0.0.0 which will send any networks it does not know about to the next hop.

 

vlan interfaces are classed as directly connected routes so will take precedence over the DG.

 

Rob

[twin--turbo]

its the smoothwall that needs to know how to reach the 172,,, networks

 

rob

[FN-GM]

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

 

This tells the cisco that to get to any client on 172.20.1.0 that the next routing hop is the smoothwall.

 

Well thats all i need to know. I dont want to send any/all networks to the smoothwall.

 

I i had another vlan pointing to another Smoothwall box or another firewall product i just stick an additional ip route in.

[twin--turbo]

but your diagram shows the smoothwall as being the internet gateway

[FN-GM]

It is. But i still dont want to send all VLANS there.

[twin--turbo]

Well thats all i need to know. I dont want to send any/all networks to the smoothwall.

 

I i had another vlan pointing to another Smoothwall box or another firewall product i just stick an additional ip route in.

 

 

the commands will fail or cause odd routing

[twin--turbo]

It is. But i still dont want to send all VLANS there.

then you need static routing on the clients to specify the hops to the other vlans. and their DG as their vlan firewall

Edited November 21, 2012 by twin--turbo

[FN-GM]

then you need static routing on the clients to specify the hops to the other vlans. and their DG as their vlan firewall

 

But why when i have a static route on the master switch? And if i set the DG as the firewall the Cisco wont be doing the routing.

[twin--turbo]

How are you going to get internet traffic to go to the smoothwall?

 

What static route do you have on the master switch?

Edited November 21, 2012 by twin--turbo

[FN-GM]

Isnt fully setup yet.

 

I dont understand why you would need to set a static route on the clients if these static routes are setup on the switch

 

ip route 172.20.1.0 255.255.255.0 192.168.0.1

ip route 172.20.2.0 255.255.255.0 192.168.0.1

[twin--turbo]

because they won't work.

your telling the switch that those addresses are available via the smoothwall.

 

look at your first diagram.

 

pretend your the cisco.

 

cisco "hmm, how do i get to 172.20.2.5?"

cisco "well my routes say that mr smoothy should be able to tell be, he's on 192.168.0.1"

smoothie "sorry mr cisco, have no idea where they are nowt to do with me"

cisco "oh!"

 

 

 

without those two ip routes...

cisco "hmm how do i get to 172.20.0.5?"

cisco "ahh that subnet is directly connted on vlan 2, super i will fire the packed ou vlan 2"