Different default route for vlan

[Roberto Cremasco]

Hi,

i need to configure a different dafault route for a specific vlan. In my case i have 5 vlan that has as default route the firewall to access internet. Now i need to configure the 6th Vlan but with a different default route to access an other firewall.
This can be possible?

Thank,
RoC

[Mohieddin Kharnoub]

Hi
My dear ,what you need is Policy-based routing, which uses route maps that provide specific
forwarding instructions for the router based on source address.

If your switch doesn't support this, you can use an Static route for Vlan 6 to internet with Administrative Distance (metric) bigger than 1 (so non of other vlans use it), and add an Access list to prevent vlan 6 to use the default route, so all Vlan6 traffic will be directed to the new Firewall.

Anyway, If you use multiple ip route 0.0.0.0 0.0.0.0 commands to configure a default route, traffic is load-balanced over the multiple routes, so YOU can control this using ACL to redirect Vlan1-5 to first firewall, and Vlan6 to second firewall.

Good Luck

[Roberto Cremasco]

Thank for the answer.
My switch is a procurve 5300, do you known if support the policy based routing?

RoC.

[Leo Katona]

No, the 5300xl doesn't support policy-based routing, so there is no way to configure different routes for different source addresses/VLANs.

Would it be possible for you to connect the second firewall directly to the 6th VLAN, so the clients could use the firewall (and not the 5300xl) as their default gateway?

The firewall could then route traffic destined for your internal networks back to the 5300xl, if needed.

-leok

[Roberto Cremasco]

No i can't use the firewall as default gateway because all the traffic, including the local traffic to the server farm, will be routed by fw causing perf. problems.

Any other ideas?

Thanks in advance,
RoC

[Matt Hobbs]

The 9300 and 7000dl series support policy based routing so you may need one of these products to achieve what you need. I'd recommend the 7000dl to use in combination with your existing 5300.


If you submit a question or new topic and another member replies to it, you will see a dropdown menu of points next to the reply (you must be logged in to see the menu). Select the point value and then click the "submit points" button. Note that you can rate multiple replies and submit them at one time.