Networking help required - to set up PBR or route mapping?

[michelle79]

Hi all, I need to segment our public network which currently spans across our WAN on L2. The problem I have is that routed traffic on a new segment traverses the network, following the default routes, and hits the firewall's "Trusted" interface. I need to somehow direct the Public subnet traffic to the Public interface on the firewall. I've tried setting up PBR on switch A (as labelled in diagram) but I think since all the traffic from B comes across on the same VLAN/subnet it doesn't pick up the originating source address. It's like the PBR isn't recursive if that makes sense.  Can anyone help please? If it's not going to work how I envisaged is there any alternative way of achieving the required outcome with the current hardware?

Diagram below is our current setup and includes the additional proposed subnet.

[Vince-Whirlwind]

Your host "public" that is attached to switch B is on the same subnet as the interface "public" on the firewall, so where does any routing come into it?

[michelle79]

Hi Vince, I've edited my post and updated the diagram to make it a bit more clear (and correct! Sorry about that, I screwed up on the addresses big time)

Cheers,

Michelle

[Paul Kurtz]

Wouldn’t you want to do the PBR on switch B

Classify all 5.5.5.5 to route to 1.1.1.254?

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03323396

PBR reference

[michelle79]

After researching further and working on this for most part of the day I've gotten a bit closer... I've applied a PBR but it doesn't work...

Command: show statistics policy "PublicTrafficToPublicFirewall" vlan 20 in returns that the packets are being ignored

Hit Counts for Policy PublicTrafficToPublicFirewall

Total

10 class ipv4 PublicNetworks action ignore
( 6286 ) 10 match ip 5.5.5.0 0.0.0.255 0.0.0.0 255.255.255.255

Currently have following config on switch A

class ipv4 "PublicNetworks"
     10 match ip 5.5.5.0 0.0.0.255 0.0.0.0 255.255.255.255
   exit
policy pbr "PublicTrafficToPublicFirewall"
     10 class ipv4 "PublicNetworks"
     action ip next-hop 1.1.1.254
     action ip default-next-hop 1.1.1.254
  exit
exit

vlan 20
   ip address 3.3.3.253 255.255.255.0
   service-policy "PublicTrafficToPublicFirewall" in
exit

What on Earth is wrong with my config???? Going mad here 

[Paul Kurtz]

Wouldn’t you want to do the PBR on switch B

Classify all 5.5.5.x to route to 1.1.1.254?

[michelle79]

That's what I was wondering but unfortunately I dont think the 2920s are capable.

[michelle79]

I feel like I'm close Paul, with the config I added in my comment posted at the same time you posted but missing something.

[michelle79]

Say I did apply a PBR on switch B, and got to the point where I could remove the layer 2 network, would the next-hop have to change? 1.1.1.254 would no longer be a next hop as such, or is it smart enough to figure out the best route?

[Paul Kurtz]

Verified, 3800 and 5400 support it and checked 2920 manual and not listed.

http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c04943197-2.pdf#page437

[Paul Kurtz]

So, what ports are connected to firewall for public traffic on switch A?

[Vince-Whirlwind]

OK, so as far as design goes, when you have two networks at different security classifications, you should use one of the following:
1/ Physical separation
2/ Virtual routing instances, VRF.

With infrastructure that doesn't support VRFs, and if you don't want to double-up on hardware, then the only semi-sensible way to achieve separation between the two zones that are on shared infrastructure is to remove all Layer3 functionality (from at least one of the zones, if not both) and to maintain VLAN separation.
*** NO UNTAGGED VLANs on dot1q INTERFACES!!!

Your existing setup has your "public" zone traversing a "trusted" network at Layer2, with (presumably) VLAN separation.
Personally, If I couldn't get budget for better toys, I would simply add 5.5.5.254 an an additional interface in the zone on the firewall that has the "Public" zone on it already and VLAN that subnet through to it without any routing.

[michelle79]

Hi Paul, there's actually another switch in between Switch A and the firewall but it isn't doing any routing so shouldn't matter but regardless, I'm interested to know where are you headed with this trail of thought..

My PBR on switch A is still capturing and ignoring traffic. It is doing my head in.

SwitchA# show statistics policy "PublicTrafficToPublicFirewall" vlan 20 in

Hit Counts for Policy PublicTrafficToPublicFirewall

Total

10 class ipv4 PublicNetworks action ignore
( 258221 ) 10 match ip 5.5.5.0 0.0.0.255 0.0.0.0 255.255.255.255

[michelle79]

Hi Vince, these switches unfortunately weren't purchased all that long ago but appears they were purchased without consideration of the future., mostly just to replace like for like To boot, I work in local government so new hardware just isn't an option. 

Unfortunately sticking with a layer 2 network just isn't an option as we are moving from layer 2 microwave links to IPVPN links which apparently aren't capable of this. It's so frustrating, I've just recently come back from mat leave to this mess.

 After much research, I am currently steering towards something like this - creating a sort of virtual redundant link so the public traffic gets routed over one and the trusted over the other. Would this work or am I crazy to even consider this?

[Vince-Whirlwind]

That would work easy with a router, but if you have the switches as per your initial post, you don't have the option of putting switchports into Layer-3 mode, so STP is going to try to block one of those links, so you will have to implement per-VLAN STP as well as PBR and access lists.

[michelle79]

Ok so I'm not sure if you very helpful people are still listening but if you are, I now have the PBR working (turned out to be a routing misconfiguration on the new VLAN and nothing to do with the PBR) and traffic is flowing out the required next hop but am stuck again as it doesnt get any further than the firewall. Would I need to set up a PBR in the other direction too? As in from the firewall?

Also, Vince, if you're reading thanks for the tips on securing the network. It's definitely on my radar. Could that be acheived with something like a Private VLAN? I think the switches we have are capable although that's another forum post for another day as they're new to me too ;P

Cheers,

Michelle

[michelle79]

For anyone that's interested in this, I found that I had to set up a PBR on the internet facing router in the opposing direction for reply traffic to come back through to the public network.