Routing Question 1

[ermora]

Just want to make sure. Company has two locations.

There are three devices, two are located in the same location. They are as follows;

Dev1 @ LOC A
PIX515
E0:xx.xx.xx.xx/255.255.255.240
E1:10.0.100.1/255.255.255.0

Dev2 @ LOC A
C1841
S0:172.16.1.1
E0:10.0.200.254/255.255.255.0

Dev3 @ LOC B
C1841
S0:172.16.1.2
E0:10.0.300.254/255.255.255.0

I have the routes setup (per Dev) as follows;

Dev1
route inside 10.0.200.0 255.255.255.0 10.0.200.254 1
route inside 10.0.300.0 255.255.255.0 10.0.300.254 2
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

Dev2
ip route 10.0.300.0 255.255.255.0 S0
ip route 10.0.200.0 255.255.255.0 E0

Dev3
ip route 10.0.300.0 255.255.255 E0
ip route 0.0.0.0 0.0.0.0 S0

It's been a while since I've been involved in router configs.

Thanks and your input is much appriciated.

 

[burtsbees]

You don't need these...

Dev2
ip route 10.0.200.0 255.255.255.0 E0

Dev3
ip route 10.0.300.0 255.255.255 E0

I would put in a default route in Dev2.
Also, does the PIX know where 10.0.200.254 and 10.0.300.254 are? It doesn't look like it---it won't be able to route to the 10.0.200.0/24 and 10.0.300.0/24 networks. What is ETH1 connected to physically? Are Dev1 and Dev2 connected together, or are they separate as failover WANs?

Burt

 

[cyberspace]

Why do you have IP addresses containing .300.?

Forgive me if it is just for example.

'When all else fails.......read the manual'

 

[ermora]

Dev1 @ LOC A
PIX515
E0:xx.xx.xx.xx/255.255.255.240
E1:10.0.200.1/255.255.255.0

Dev2 @ LOC A
C1841
S0:172.16.1.1
E0:10.0.200.254/255.255.255.0

Dev3 @ LOC B
C1841
S0:172.16.1.2
E0:10.0.300.254/255.255.255.0

I have the routes setup (per Dev) as follows;

Dev1
route inside 10.0.200.0 255.255.255.0 10.0.200.254 1
route inside 10.0.300.0 255.255.255.0 10.0.300.254 2
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

Dev2
ip route 10.0.300.0 255.255.255.0 S0
ip route 0.0.0.0 0.0.0.0 E0 <--Default Route ?

Dev3
ip route 0.0.0.0 0.0.0.0 S0


I revised the Dev1 (PIX) IP so that it's in the same subnet as the Dev2 router.

How is the config now?

 

[burtsbees]

ip route 0.0.0.0 0.0.0.0 E0 <--Default Route ?
No---change it to s0

You don't need this---that route is directly connected!
Dev1
route inside 10.0.200.0 255.255.255.0 10.0.200.254 1

Also, for the PIX to get to the .300 network, you need to specify the next hop---300.254 is not it!
Are dev1 and dev2 connected through a switch???

Burt

 

[ermora]

Dev1 @ LOC A
PIX515
E0:xx.xx.xx.xx/255.255.255.240
E1:10.0.200.1/255.255.255.0

Dev2 @ LOC A
C1841
S0:172.16.1.1
E0:10.0.200.254/255.255.255.0

Dev3 @ LOC B
C1841
S0:172.16.1.2
E0:10.0.300.254/255.255.255.0

I have the routes setup (per Dev) as follows;

Dev1
route inside 10.0.300.0 255.255.255.0 10.0.300.254 2
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

Dev2
ip route 10.0.300.0 255.255.255.0 S0
ip route 0.0.0.0 0.0.0.0 S0 <--Default Route ?

Dev3
ip route 0.0.0.0 0.0.0.0 S0


Yes Dev1 and Dev2 are physically connected thru a Cisco Catalyst 5000 switch.

On Dev2, if I set the default route 0.0.0.0, do I even need the 10.0.300.0 ?

 

[ermora]

Let me step back a bit. The company has two locations.

These locations are connected via a Point-2-point T1.

One location (LOC A) also has a T1 for internet access which is connected to the PIX.


[LOC B] -----------p2p---------- [LOC A] --------Internet

 

[blueshark101]

[LOC B] [LOC A]
------------- E0-Dev3-S0 -----p2p---- S0-Dev2-E0 ------------ E1-Dev1-E0 -----------Internet
10.0.300.0/24 172.16.1.0 10.0.200.0/24 xx.xx.xx.xx


Dev1 @ LOC A
PIX515
E0:xx.xx.xx.xx/255.255.255.240
E1:10.0.200.1/255.255.255.0

Dev2 @ LOC A
C1841
S0:172.16.1.1
E0:10.0.200.254/255.255.255.0

Dev3 @ LOC B
C1841
S0:172.16.1.2
E0:10.0.300.254/255.255.255.0


Dev1
Has an interface on the .200 network so does not need a route for that network
Does not need to know about the 172 network as it is a p2p connection
route inside 10.0.300.0 255.255.255.0 10.0.200.254 2 <---- needs to know the next hop for .300 traffic
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

Dev2
If you make S0 the default route, traffic from the 300 network will not be able to get to the internet
Has an interface on the .200 network so does not need a route for that network
ip route 10.0.300.0 255.255.255.0 S0
ip route 0.0.0.0 0.0.0.0 10.0.200.1

Dev3
ip route 0.0.0.0 0.0.0.0 S0

-Blue
The significant problems we face cannot be solved at the same level of thinking we were at when we created them