I have an ERS5650 stack with several VLANs connected to a single firewall.
I have to add another firewall and send all 0.0.0.0 traffic for VLAN 187 only out the new firewall while still maintaining intraVLAN routing. I've created a fwd-nh policy and applied to VLAN 187 and while it will send the traffic out to the correct firewall, it breaks intraVLAN routing to VLAN 187.
Current static routing for all of my VLANs
0.0.0.0 0.0.0.0 Next Hop 192.168.136.1 (Current Firewall IP)
I need to take VLAN 187 only and make it route like:
0.0.0.0 0.0.0.0 Next Hop 192.168.187.254 (New Firewall for VLAN 187 Only)
How do I do that and yet keep the intraVLAN functionality?
On Cisco I could simply create an ACL that says
** Note - This is a Host based ACL example from Cisco **
access-list 100 permit ip host 192.168.187.2 any
!
route-map NEWFIREWALL permit 100
match ip address 100
set ip next-hop 192.168.187.254