1 Reply Latest reply on Nov 19, 2015 7:17 AM by petersjncv

    Routing through DMZ

    srumelhart New Member

      I have a NV3448 that has the following relevant configuration:

       

      interface switchport 0/2

        description Office

        speed 100

        no shutdown

        switchport access vlan 2001

      !

      interface vlan 1

        ip address  10.170.30.1  255.255.255.0

        access-policy Private

        no shutdown

       

      interface vlan 2001

        description Uplink to Scada network

        ip address  10.127.0.4  255.255.255.0

        no shutdown

      !

      !

      ip route 172.16.1.0 255.255.255.0 10.127.0.1

       

       

      10.127.0.1 is an endpoint on a Cisco router that I am trying to route traffic from the 10.170.30.0/24 network to the 172.16.1.0/24 network. On a computer on the inside lan (ex 10.170.30.10) I can ping the Cisco external endpoint 10.127.0.1, but not 172.16.1.1.

       

      In the NV3448, I can ping 172.16.1.1, but fails if I ping 172.16.1.1 source 10.170.30.10.

       

      What am I missing to get this to work for the local subnet?

        • Re: Routing through DMZ
          petersjncv Visitor

          This sounds like a routing problem.  It sounds like the Cisco does not have a return route for the 10.170.30.0/24 network.

           

          Another observation - If you are running firewall, then all of your IP interfaces need an access policy of some kind.  How you want to build your security zones would affect how you build those policies.  VLAN 2001 should have a security/access policy on it, even if it is a just an allow any.  With firewall on and no policy on the interface, it may not pass return traffic back through to the 10.170.30.1 interface from the 10.127.0.1 host.