Cisco cat vlan routing
I have a Cisco Cat 3550 layer 3 switch, with 2 vlans. How can I do static routing seperatly, so vlan one has a different default gateway than vlan two. Right to the point I want vlan1 going our frame-relay, and vlan2 going to our pix.
thank you,
JT
sh run
sw3550#sh run
Building configuration...
Current configuration : 7532 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname xxxxxxxxxx
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
ip routing
!
!
spanning-tree extend system-id
!
!
--More-- interface FastEthernet0/1
no ip address
!
interface FastEthernet0/2
no ip address
!
interface FastEthernet0/3
no ip address
!
interface FastEthernet0/4
no ip address
!
interface FastEthernet0/5
no ip address
!
interface FastEthernet0/6
no ip address
!
interface FastEthernet0/7
no ip address
!
interface FastEthernet0/8
no ip address
--More-- !
interface FastEthernet0/9
no ip address
!
interface FastEthernet0/10
no ip address
!
interface FastEthernet0/11
no ip address
!
interface FastEthernet0/12
no ip address
!
interface FastEthernet0/13
no ip address
!
interface FastEthernet0/14
no ip address
!
interface FastEthernet0/15
no ip address
!
interface FastEthernet0/16
--More-- no ip address
!
interface FastEthernet0/17
description port to 3745
no ip address
!
interface FastEthernet0/18
no ip address
!
interface FastEthernet0/19
no ip address
!
interface FastEthernet0/20
switchport access vlan 2
no ip address
!
interface FastEthernet0/21
no ip address
!
interface FastEthernet0/22
description Router
no ip address
duplex half
--More-- speed 10
!
interface FastEthernet0/23
no ip address
!
interface FastEthernet0/24
no ip address
!
interface FastEthernet0/25
no ip address
!
interface FastEthernet0/26
no ip address
!
interface FastEthernet0/27
no ip address
!
interface FastEthernet0/28
no ip address
!
interface FastEthernet0/29
no ip address
!
--More-- interface FastEthernet0/30
no ip address
!
interface FastEthernet0/31
no ip address
!
interface FastEthernet0/32
switchport access vlan 2
no ip address
!
interface FastEthernet0/33
no ip address
!
interface FastEthernet0/34
description WEB server port
switchport access vlan 2
no ip address
!
interface FastEthernet0/35
no ip address
!
interface FastEthernet0/36
no ip address
--More-- !
interface FastEthernet0/37
no ip address
!
interface FastEthernet0/38
no ip address
!
interface FastEthernet0/39
no ip address
!
interface FastEthernet0/40
no ip address
!
interface FastEthernet0/41
no ip address
!
interface FastEthernet0/42
no ip address
!
interface FastEthernet0/43
no ip address
!
interface FastEthernet0/44
--More-- no ip address
!
interface FastEthernet0/45
no ip address
!
interface FastEthernet0/46
no ip address
!
interface FastEthernet0/47
no ip address
!
interface FastEthernet0/48
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 10.10.10.10 255.255.255.0
!
interface Vlan2
description WEB Server VLAN
ip address 10.10.11.10 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.1
ip route 10.10.112.0 255.255.255.0 10.10.10.3
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.85.0 255.255.255.0 10.10.10.1
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.86.0 255.255.255.0 10.10.10.1
ip route 10.10.87.0 255.255.255.0 10.10.10.1
ip route 10.10.91.0 255.255.255.0 10.10.10.1
ip route 10.10.90.0 255.255.255.0 10.10.10.1
ip route 10.10.88.0 255.255.255.0 10.10.10.1
ip route 10.10.60.1 255.255.255.255 10.10.10.1
ip route 10.10.89.0 255.255.255.0 10.10.10.1
ip route 10.10.103.0 255.255.255.0 10.10.10.1
ip route 10.10.93.0 255.255.255.0 10.10.10.1
!
!
!
!
end
sw3550#
thank you,
JT
sh run
sw3550#sh run
Building configuration...
Current configuration : 7532 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname xxxxxxxxxx
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
ip routing
!
!
spanning-tree extend system-id
!
!
--More-- interface FastEthernet0/1
no ip address
!
interface FastEthernet0/2
no ip address
!
interface FastEthernet0/3
no ip address
!
interface FastEthernet0/4
no ip address
!
interface FastEthernet0/5
no ip address
!
interface FastEthernet0/6
no ip address
!
interface FastEthernet0/7
no ip address
!
interface FastEthernet0/8
no ip address
--More-- !
interface FastEthernet0/9
no ip address
!
interface FastEthernet0/10
no ip address
!
interface FastEthernet0/11
no ip address
!
interface FastEthernet0/12
no ip address
!
interface FastEthernet0/13
no ip address
!
interface FastEthernet0/14
no ip address
!
interface FastEthernet0/15
no ip address
!
interface FastEthernet0/16
--More-- no ip address
!
interface FastEthernet0/17
description port to 3745
no ip address
!
interface FastEthernet0/18
no ip address
!
interface FastEthernet0/19
no ip address
!
interface FastEthernet0/20
switchport access vlan 2
no ip address
!
interface FastEthernet0/21
no ip address
!
interface FastEthernet0/22
description Router
no ip address
duplex half
--More-- speed 10
!
interface FastEthernet0/23
no ip address
!
interface FastEthernet0/24
no ip address
!
interface FastEthernet0/25
no ip address
!
interface FastEthernet0/26
no ip address
!
interface FastEthernet0/27
no ip address
!
interface FastEthernet0/28
no ip address
!
interface FastEthernet0/29
no ip address
!
--More-- interface FastEthernet0/30
no ip address
!
interface FastEthernet0/31
no ip address
!
interface FastEthernet0/32
switchport access vlan 2
no ip address
!
interface FastEthernet0/33
no ip address
!
interface FastEthernet0/34
description WEB server port
switchport access vlan 2
no ip address
!
interface FastEthernet0/35
no ip address
!
interface FastEthernet0/36
no ip address
--More-- !
interface FastEthernet0/37
no ip address
!
interface FastEthernet0/38
no ip address
!
interface FastEthernet0/39
no ip address
!
interface FastEthernet0/40
no ip address
!
interface FastEthernet0/41
no ip address
!
interface FastEthernet0/42
no ip address
!
interface FastEthernet0/43
no ip address
!
interface FastEthernet0/44
--More-- no ip address
!
interface FastEthernet0/45
no ip address
!
interface FastEthernet0/46
no ip address
!
interface FastEthernet0/47
no ip address
!
interface FastEthernet0/48
no ip address
!
interface GigabitEthernet0/1
no ip address
!
interface GigabitEthernet0/2
no ip address
!
interface Vlan1
ip address 10.10.10.10 255.255.255.0
!
interface Vlan2
description WEB Server VLAN
ip address 10.10.11.10 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.1
ip route 10.10.112.0 255.255.255.0 10.10.10.3
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.85.0 255.255.255.0 10.10.10.1
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.86.0 255.255.255.0 10.10.10.1
ip route 10.10.87.0 255.255.255.0 10.10.10.1
ip route 10.10.91.0 255.255.255.0 10.10.10.1
ip route 10.10.90.0 255.255.255.0 10.10.10.1
ip route 10.10.88.0 255.255.255.0 10.10.10.1
ip route 10.10.60.1 255.255.255.255 10.10.10.1
ip route 10.10.89.0 255.255.255.0 10.10.10.1
ip route 10.10.103.0 255.255.255.0 10.10.10.1
ip route 10.10.93.0 255.255.255.0 10.10.10.1
!
!
!
!
end
sw3550#
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
FYI:
I can not set Vlan2 and the pix on the same subnet. So the servers on vlan2 can not have a dg of the pix it has to be set to the switch (10.10.11.10).
Thanks
I can not set Vlan2 and the pix on the same subnet. So the servers on vlan2 can not have a dg of the pix it has to be set to the switch (10.10.11.10).
Thanks
That will only work if the respective default gateway is on their local vlan.
If the PIX is actually in VLAN 2, and the frame router is actually on vlan 1, then yes, you can assign vlan 2 clients the PIX as their default gateway on their PC/server, same on vlan 1. This is a client configuration, not on the switch, so every client will have to be reconfigured.
The problem is that if you need vlan 2 to talk to vlan 1 or any other subnet, you just broke it because now VLAN 2 points to the PIX as the gateway and the PIX won't do redirects. You'll have to point to them to this 3550 as their gateway, which in turn, routes them appropriately to the other vlans out out to the PIX. This is by far the best solution.
You can't stay away from access lists if you want to get the most use out of the capabilities that you have in a L3 switch. Let it do the job.
If the PIX is actually in VLAN 2, and the frame router is actually on vlan 1, then yes, you can assign vlan 2 clients the PIX as their default gateway on their PC/server, same on vlan 1. This is a client configuration, not on the switch, so every client will have to be reconfigured.
The problem is that if you need vlan 2 to talk to vlan 1 or any other subnet, you just broke it because now VLAN 2 points to the PIX as the gateway and the PIX won't do redirects. You'll have to point to them to this 3550 as their gateway, which in turn, routes them appropriately to the other vlans out out to the PIX. This is by far the best solution.
You can't stay away from access lists if you want to get the most use out of the capabilities that you have in a L3 switch. Let it do the job.
JT:
The DG is set either statically or via DHCP on the host devices. If the PIX cannot have an interface in VLAN2, then you will need to use Policy Routing as per lrmoore's comment above. ACLs must be used for this type of configuration, because it is Cisco's way of pattern matching.
The DG is set either statically or via DHCP on the host devices. If the PIX cannot have an interface in VLAN2, then you will need to use Policy Routing as per lrmoore's comment above. ACLs must be used for this type of configuration, because it is Cisco's way of pattern matching.
ASKER
That sounds good. thank you for help guys!
ASKER
That is exactly what I want to do. I wanted to stay away from access-lists. However I can not find the commands on cisco web site and I was not sure you could give dg to 2 or more vlans on a layer 3 switch. So how do I set a dg to a vlan?
Thank You,
JT