• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

routing question

D

DarkOne_BW

Limp Gawd
Joined
Apr 21, 2002
Messages
472
I'm not much of a router guy. I've heard the solution I'm looking for is "source based routing" but I haven't been able to locate any information that's useful to my current predicament.

Here's the situation:

We have our servers on 172.16.0.0/21.
Everyone else is on 172.16.8.0/21.
I have a Cisco ASA 5520 currently providing NAT with a local IP of 172.16.0.6.
I am putting a content filter in place.
All machines (including servers) currently have the core switch (HP 9304) defined as their default gateway, which in turn has the ASA 5520 defined as a default gateway.

How can I filter the workstations without filtering the servers?
Is anyone familiar enough with the HP 9300 series switches to tell me that it supports the necessary commands to establish a source-based route (workstation subnet routed to content filter)?
Would I be better off trying to do this type of routing in the ASA instead of the HP 9304?

Thanks!
 
That's exactly what I'm not sure how to do in the HP switch. The switch OS supports "source routing" but I can't find anything that references how to setup source routing, especially on an HP switch.
 
In Cisco terms, source routing = policy based routing. Punts it to the CPU... not recommended for a whole lot of traffic.

It is not supported on the ASA -- the ASA is not designed to be an advanced router. Not sure about HP.
 
After a bit of tinkering with my switch in the off-hours I was able to determine that while it is a layer 3 switch, it doesn't fully support PBR with the existing management module.

Were this a beefier Cisco switch I think I could build the routes I need, but instead I'm looking to put into production an old 3600 router I had laying around.

Thanks for the input.
 
Couldn't you just put the content filter on the subnet with the workstations? What kind of device is it?
 
You must log in or register to reply here.
Back
Top