Question

I need one device to have a specific ip default route to another firewall


Hi I have a remote site that connects through our hub via LAN and they have their own independent Firewall connection for internet. They communicate to a few devices on our network and everything else is blocked via access-list but they need to have a server on our LAN. Now I need to move their server and host it on our network 172.16.x.x but they need it to use their Firewall for internet access. The only thing I can think of is create an access-list on our Firewall uplink to allow everything but their server and add the server to the access-list that connects to their LAN with addition to add another IP default route inside my hub. That’s the only thing I can think of at the moment, does anyone have a better solution?

20 replies

The server 172.16.10.10 will have to have a default route of 172.16.10.1 . On 172.16.10.1 create a policy based route, if it has that capability, to forward any traffic sourced from 172.16.10.10 to go to the IP address of the Customer Hub on the interface you have drawn and labeled LAN link.

It all depends on if your firewall supports policy based routing.
McKitrick, Mark wrote:

The server 172.16.10.10 will have to have a default route of 172.16.10.1 . On 172.16.10.1 create a policy based route, if it has that capability, to forward any traffic sourced from 172.16.10.10 to go to the IP address of the Customer Hub on the interface you have drawn and labeled LAN link.

It all depends on if your firewall supports policy based routing.

Understood but where would this access-list entry reside on? On the uplink to our Firewall (That doesn't have a access-list) or on the access-list that is between my site and the customers? Because I would like the policy to redirect to there network and not my firewall.
Userlevel 2
If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

The customers LAN is a flat network vs mine but they only need to communicate with a few devices on one VLan which I can give them a range of /29. But like I mentioned to the other user is that I'm a bit confused on where the PBR policy takes place in order to redirect it back to their LAN?
Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

It could be applied to the VLAN of the default gateway...
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

I'm a bit confused, because I have an ingress rule on the Link between the customer and I. I understand the entry you supplied with me with but I don't know where I should enter it? In the ingress rule between the site or create a egress rule between my hub and firewall and add that entry so that it redirects over the LAN link......... Sorry I come from a Cisco background.
Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

Just to confirm, what is the subnet for your server 172.16.10.10? And what is the name of that VLAN?
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

Lets just say its 172.16.10.0/24 and its called "SERVERS" and the customers network is 192.168.0.0/24
Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

So it should be:

config access-list PBR vlan Servers ingress
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

Ok, I think I'm getting it. You're basically telling me that the Policy can be entered on the VLAN interface itself and not just a port which is the usual. So once I create it I can enter the specific IP address to redirect its default route to the customers LAN. Also, in this scenario do I have to create a any any entry for the other IP's that I dont list get routed by its usual default route?
Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

If you use just the host (/32) as the source the other IPs will not match that ACL, so you don't have to worry about them. But, if that customer server needs to access anything on your hub network that is outside of its local subnet, the policy will need to be modified... I'm assuming it just needs access to servers on its own subnet which would be L2 switched, then anything from this host that hits the L3 gateway would match and follow the ACL.
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

I'm going to dedicate The SERVERS VLAN on my network for their servers to reside on. I just need to modify the current ACL to let their network communicate with the SERVERS VLAN on my Hub and apply the PBR policy on that vlan to redirect to their network........Does that make any sense?
Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

that makes sense
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

Ok, I'll get working on this but I wont have a server until next week. I'll let you know how it went 🙂
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

I attempted to create the PBR policy on the switch but I was unsuccessful because I couldn't figure out the next entry. Please see attachment. PS I have a x450a series Summit switch.

McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

I attempted to create the PBR policy on the switch but I was unsuccessful because I couldn't figure out the next entry. Please see attachment. PS I have a x450a series Summit switch.

Userlevel 2
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

you have to create the policy with:

edit policy pbr (policy name)

that will open a vi editor

http://gtacknowledge.extremenetworks.com/articles/How_To/How-to-create-and-apply-an-ACL-in-EXOS/?q=exos+acl&l=en_US&fs=Search&pn=1
McClane wrote:

If you're 172.16.X.X is a flat /16 and that's the only network the customer server needs access to, then I would think a simple PBR ACL on the network hub switch would suffice... According to the subnet masks you have in your diagram everything else would be L2 switched... If there are additional subnets at your hub site that the customer server needs access to, then more specifics would need to be added to the policy.

So something to the effect of:

entry PBR {
if {
source-address 172.16.10.10/32;
destination-address 0.0.0.0/0;
} then {
redirect X.X.X.X (the appropriate next hop for the remote site)
}
}

Update
Hi Everyone,

So far what I have done is I just added a VLAN on my network that extendeds there so I can keep the servers within there own subnet. I'm able to get passed the ACL that resides on they're port uplink but I cannot default route through it. Is there where I need to apply a PBR somewhere?

My Business HUB Customer HUB
17216.0.0 /16 192.168.0.0/24
ACL

Source Destination
VLAN A - 172.16.0.0/16 Deny 192.168.0.0/24
VLAN B - 192.168.2.1 Permit 192.168.0.0/24

Lab address Permit ANY (Succesful)
192.168.2.4
Ping 8.8.8.8 from 192.168.2.4 (Request Timed out)

Next step is I would assume I create a PBR ACL under VLAN B that default routes to their Firewall? The reason for this is because the VLAN resides on my network?

Reply