In Addition to My Current Router-on-a-Stick Configuration...

[goosed]

Thanks to the forum here, I was able to get my Router-on-a-Stick configuration working. Now I have another question to go along with this. I'm trying to get access to my firewall.

I can do inter-VLAN routing between my Router's Fa0/1 subinterfaces and the VLANs I have setup on my Switch. My Router's Fa0/0 interface is setup with "ip address 10.199.199.2 255.255.255.248". And my firewall is setup with "ip address 10.199.199.1 255.255.255.248".

I can ping my firewall from my Router, but not from the Switch or any of the VLANs.

I tried created a new subinterface on the Switch, Fa0/1.99. I gave it Fa0/0's IP address and gave Fa0/0 no IP. I then created VLAN99 on the Switch, plugged the firewall into the Switch and gave it the appropriate VLAN access. This did not work.

The only thing I was successful in doing was giving the firewall an IP address in the Switch Management VLAN range, but I don't really want to do it like this. Is there any way to establish connectivity to the firewall using Fa0/0 on the Router? Thanks in advance.

 

[burtsbees]

How does the topology go? Firewall---router---switch---nodes

Like that? Or is the firewall between the router and switch? What kind of firewall?

Burt

 

[goosed]

Firewall -- Router -- Switch -- Node

It's a m0n0wall firewall. FreeBSD based open source.

Thanks for the reply Burt.

 

[goosed]

Also I am able to ping the Router, Switch, and VLANs from the firewall. I cannot however ping the firewall from the Switch or any of the VLANs.

 

[burtsbees]

You sure that the firewall isn't rejecting ICMP?

Burt

 

[goosed]

Yeah it's not. When I put the Firewall on the Management VLAN, I was successfully able to ping it from the Switch.

Also I can't access the Firewall web-gui while it's on Fa0/0.

Thanks again for the reply.

 

[goosed]

I believe I found out what the issue is. From what I can tell, the firewall's LAN IP needs to be on the same subnet as as the workstation that is accessing it.

That being said, I figure I need to NAT my workstation's IP address to an available IP in the firewall's subnet. Do you guys think that this will work?

 

[goosed]

Just wanted to leave a note saying I resolved the issue. Very stupidly, I neglected to add a rule permitting traffic from the VLANs to the firewall's LAN subnet. (I'm still kicking myself)

Just wanted to thank the community for the help.