• May 21, 2012, 08:22:03 AM
Welcome, Guest. Please login or register. Registration is free.
Did you miss your activation email?

Author Topic: ERS5650 Traffic Redirection to Multiple Firewalls?  (Read 355 times)

0 Members and 1 Guest are viewing this topic.

Offline pronei

  • Rookie
  • **
  • Posts: 2
ERS5650 Traffic Redirection to Multiple Firewalls?
« on: December 16, 2011, 08:45:35 AM »
I have an ERS5650 stack with several VLANs connected to a single firewall.

I have to add another firewall and send all 0.0.0.0 traffic for VLAN 187 only out the new firewall while still maintaining intraVLAN routing.  I've created a fwd-nh policy and applied to VLAN 187 and while it will send the traffic out to the correct firewall, it breaks intraVLAN routing to VLAN 187.

Current static routing for all of my VLANs
0.0.0.0 0.0.0.0 Next Hop 192.168.136.1 (Current Firewall IP)

I need to take VLAN 187 only and make it route like:
0.0.0.0 0.0.0.0 Next Hop 192.168.187.254 (New Firewall for VLAN 187 Only)

How do I do that and yet keep the intraVLAN functionality? 

On Cisco I could simply create an ACL that says

** Note - This is a Host based ACL example from Cisco **
access-list 100 permit ip host 192.168.187.2 any
!
route-map NEWFIREWALL permit 100
 match ip address 100
 set ip next-hop 192.168.187.254


Online bylie

  • Sr. Member
  • ****
  • Posts: 120
Re: ERS5650 Traffic Redirection to Multiple Firewalls?
« Reply #1 on: December 16, 2011, 09:14:19 AM »
One way you could also do this is by using VRF's. The intra-VLAN routing could then be preserved by leaking routes between both VRF's but each VRF could still use it's own default gateway. The problem is that the ERS 5600's still don't have VRF capabilities if I'm not mistaken?

Offline pronei

  • Rookie
  • **
  • Posts: 2
Re: ERS5650 Traffic Redirection to Multiple Firewalls?
« Reply #2 on: December 16, 2011, 09:21:49 AM »
Unfortunately VRF is not available in the ERS5000 series, only 8600+ has that feature.

Any other ideas?