Route-Maps and PIX

I have a situation where I have 3 networks on a L3 switch and would like to have them all access each other via the switch and use VLAN'd interfaces off of the PIX with different globals. Here's a quick rundown (written by hand, please excuse any syntax errors :D ):

l3 switch: vlan 10: net1 vlan 20: net2 vlan 30: net3

! interface vlan 10 ip address ip policy route-map netone ! ! interface vlan 20 ip address ip policy route-map nettwo ! ! interface vlan 30 ip address ip policy route-map netthree ! access-list 110 permit ip any any access-list 120 permit ip any any access-list 130 permit ip any any ! route-map netone match ip address 110 set ip next-hop ! route-map nettwo match ip address 120 set ip next-hop ! route-map netthree match ip address 130 set ip next-hop !


! interface ethernet1 vlan10 physical interface ethernet1 vlan20 logical interface ethernet1 vlan30 logical ! ip address vlan10 ip address vlan20 ip address vlan30 ! nat (vlan10) 1 0 0 nat (vlan20) 2 0 0 nat (vlan30) 3 0 0 ! global (outside) 1 global (outside) 2 global (outside) 3 !

So, net1 should be able to see net2 and net3 via the switch. I can tweak the ACL's for this to work but for now I don't see how to assign different global's for each subnet while traversing the pix. I've been able to configure these but the logs show me that all nats are being xlated to the global1 address. Has anyone done this before?

Reply to
Wil Schultz
Loading thread data ...

Why not create a single transfer net from the switch to the pix and pointing the default route to it?

I dont see any advantage of putting the pix in each VLAN, because you do plain routing between all VLANs on the switch without filtering traffic.

On the pix, you nat to different global addresses based on the source address:

nat (inside) 1 nat (inside) 2 nat (inside) 3

global (outside) 1 global (outside) 2 global (outside) 3

Reply to
Christian Zeng

I haven't much with VLAN's on a Pix or ASA, so this might not even be possible by why can't you specify what subnets belong to each nat statement. ie nat (vlan10) 1 nat (vlan20) 2 nat (vlan30) 3

If they need to be done on the "inside" interface nat (inside) 1 nat (inside) 2 nat (inside) 3

Reply to
Brian V Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.