On a Cisco Catalyst, you connect Access Gate with two switch ports and add two lines of routing: one route for the twin addresses, and one rule that sends a whole machine subnet through the gate. Nothing changes on the machines, and removing the rule undoes it.
What you will build
The examples use these addresses. Replace them with yours.
| What | Example |
|---|---|
| Admin VLAN | VLAN 254, 192.168.254.0/24 |
| Dedicated VLAN for the gate | VLAN 65, 100.65.0.0/29: switch 100.65.0.1, gate 100.65.0.6 |
| Twin addresses | 100.64.0.0/16 |
| Your machine subnet | 192.168.1.0/24, on interface Vlan1 |
1. Connect two ports
Create the dedicated VLAN, then put one port in each VLAN.
vlan 65
name AG-PROTECT
interface Vlan65
ip address 100.65.0.1 255.255.255.248
!
interface GigabitEthernet1/0/5
description Access-Gate-ADMIN
switchport mode access
switchport access vlan 254
!
interface GigabitEthernet1/0/1
description Access-Gate-PROTECT
switchport mode access
switchport access vlan 65
Cable Gi1/0/5 to the Access Gate admin port (5) and Gi1/0/1 to its protection port (1). The admin port takes an address from your admin VLAN over DHCP, or uses 10.0.0.1 after about a minute if there is none.
2. Add the route for twin addresses
Access Gate gives each machine a twin address in 100.64.0.0/16. Tell the switch where that range is:
ip route 100.64.0.0 255.255.0.0 100.65.0.6
Nothing uses these addresses yet, so this changes nothing on its own. It is what lets replies come back through the gate after step 3.
3. Switch with one rule
This rule sends everything coming from your machine subnet to the gate first, whatever its destination:
ip access-list extended MACHINES
permit ip 192.168.1.0 0.0.0.255 any
!
route-map TO-ACCESS-GATE permit 10
match ip address MACHINES
set ip next-hop 100.65.0.6
!
interface Vlan1
ip policy route-map TO-ACCESS-GATE
The ip policy line on the machine VLAN is the switch. Your machines keep their address, gateway and settings.
To undo: interface Vlan1, then no ip policy route-map TO-ACCESS-GATE.
4. Check it works
From a machine, reach something it usually talks to, exactly as before:
ping 192.168.2.20
In the Access Gate console, the flow now appears under its enclave. Access Gate starts in a dry run, so it shows what it would block without blocking anything until you approve the rules.
At a large manufacturer in North Carolina, a running production line was moved behind Access Gate this way in under a minute, on the existing Cisco switch. Production kept running.
Other options
Protect one machine instead of a whole subnet
Send only the traffic going to one machine's twin address through the gate, with a host route:
ip route 100.64.1.10 255.255.255.255 100.65.0.6
People and systems then reach that machine by its twin address (100.64.1.10) or its name. See Protect a machine you reach by its address.
Reach machines by name
Access Gate answers DNS at 100.65.0.6 and gives each machine a name that points to its twin address. Either hand that resolver to a VLAN over DHCP:
ip dhcp pool OT
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 100.65.0.6
or keep your DNS and forward one subdomain to the gate. See Give your machines easy names.
Which traffic the rule covers
The rule in step 3 covers everything that leaves the machine subnet: machines to IT, and machines to other VLANs. Traffic coming into the subnet from IT is covered when it is sent to a twin address or a name (the route in step 2 already handles it).
Machines that talk to each other on the same VLAN, with no router in between, never pass the switch's routing. For those, see Redirect traffic on your switches.
Use a routed port instead of a VLAN
Replace the Vlan65 interface with a routed port: interface Gi1/0/1, no switchport, ip address 100.65.0.1 255.255.255.248. The gate stays at 100.65.0.6.
What stays on the switch
The switch holds one route and one rule, written once. Who may reach which machine, sign-in, session recording, encryption and logs all live on Access Gate. When the network team asks what changes on the core switch, the answer is: a route-map, once.