Solved

Cisco cat vlan routing

Posted on 2004-10-18
7
1,274 Views
Last Modified: 2008-01-09
I have a Cisco Cat 3550 layer 3 switch, with 2 vlans.  How can I do static routing seperatly, so vlan one has a different default gateway than vlan two.  Right to the point I want vlan1 going our frame-relay, and vlan2 going to our pix.

thank you,
JT


sh run

sw3550#sh run
Building configuration...

Current configuration : 7532 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname xxxxxxxxxx
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
ip routing
!
!
spanning-tree extend system-id
!
!
 --More--         interface FastEthernet0/1
 no ip address
!
interface FastEthernet0/2
 no ip address
!
interface FastEthernet0/3
 no ip address
!
interface FastEthernet0/4
 no ip address
!
interface FastEthernet0/5
 no ip address
!
interface FastEthernet0/6
 no ip address
!
interface FastEthernet0/7
 no ip address
!
interface FastEthernet0/8
 no ip address
 --More--         !
interface FastEthernet0/9
 no ip address
!
interface FastEthernet0/10
 no ip address
!
interface FastEthernet0/11
 no ip address
!
interface FastEthernet0/12
 no ip address
!
interface FastEthernet0/13
 no ip address
!
interface FastEthernet0/14
 no ip address
!
interface FastEthernet0/15
 no ip address
!
interface FastEthernet0/16
 --More--          no ip address
!
interface FastEthernet0/17
 description port to 3745
 no ip address
!
interface FastEthernet0/18
 no ip address
!
interface FastEthernet0/19
 no ip address
!
interface FastEthernet0/20
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/21
 no ip address
!
interface FastEthernet0/22
 description Router
 no ip address
 duplex half
 --More--          speed 10
!
interface FastEthernet0/23
 no ip address
!
interface FastEthernet0/24
 no ip address
!
interface FastEthernet0/25
 no ip address
!
interface FastEthernet0/26
 no ip address
!
interface FastEthernet0/27
 no ip address
!
interface FastEthernet0/28
 no ip address
!
interface FastEthernet0/29
 no ip address
!
 --More--         interface FastEthernet0/30
 no ip address
!
interface FastEthernet0/31
 no ip address
!
interface FastEthernet0/32
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/33
 no ip address
!
interface FastEthernet0/34
 description WEB server port
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/35
 no ip address
!
interface FastEthernet0/36
 no ip address
 --More--         !
interface FastEthernet0/37
 no ip address
!
interface FastEthernet0/38
 no ip address
!
interface FastEthernet0/39
 no ip address
!
interface FastEthernet0/40
 no ip address
!
interface FastEthernet0/41
 no ip address
!
interface FastEthernet0/42
 no ip address
!
interface FastEthernet0/43
 no ip address
!
interface FastEthernet0/44
 --More--          no ip address
!
interface FastEthernet0/45
 no ip address
!
interface FastEthernet0/46
 no ip address
!
interface FastEthernet0/47
 no ip address
!
interface FastEthernet0/48
 no ip address
!
interface GigabitEthernet0/1
 no ip address
!
interface GigabitEthernet0/2
 no ip address
!
interface Vlan1
 ip address 10.10.10.10 255.255.255.0
!
interface Vlan2
 description WEB Server VLAN
 ip address 10.10.11.10 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.1
ip route 10.10.112.0 255.255.255.0 10.10.10.3
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.85.0 255.255.255.0 10.10.10.1
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.86.0 255.255.255.0 10.10.10.1
ip route 10.10.87.0 255.255.255.0 10.10.10.1
ip route 10.10.91.0 255.255.255.0 10.10.10.1
ip route 10.10.90.0 255.255.255.0 10.10.10.1
ip route 10.10.88.0 255.255.255.0 10.10.10.1
ip route 10.10.60.1 255.255.255.255 10.10.10.1
ip route 10.10.89.0 255.255.255.0 10.10.10.1
ip route 10.10.103.0 255.255.255.0 10.10.10.1
ip route 10.10.93.0 255.255.255.0 10.10.10.1
!
!
!
!
end

sw3550#
0
Comment
Question by:CUOL-MIS
  • 3
  • 2
  • 2
7 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 200 total points
ID: 12342318
Use policy routing:

   access-list 110 permit ip 10.10.10.0 0.0.0.255 any
   access-list 111 permit ip 10.10.11.0 0.0.0.255 any

   route-map FRAME permit 10
     match ip address 110
     set ip next-hop <ip of frame router>

    route-map PIX permit 10
      match ip address 111
      set ip next-hop <ip of PIX>

    Interface vlan 1
     ip policy route-map FRAME

    Interface vlan 2
      ip policy route-map PIX

0
 
LVL 2

Assisted Solution

by:wmilliga
wmilliga earned 50 total points
ID: 12343726


Simply don't route anything. Give your VLAN1 devices a DG of the FR router, and your VLAN2 devices a DG of the PIX. Policy routing will certainly work- but why bother, based on what you have described as your needs?
0
 

Author Comment

by:CUOL-MIS
ID: 12346330
WMILLIGA,
     That is exactly what I want to do.  I wanted to stay away from access-lists.  However I can not find the commands on cisco web site and I was not sure you could give dg to 2 or more vlans on a layer 3 switch.  So how do I set a dg to a vlan?

Thank You,
JT  
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:CUOL-MIS
ID: 12346364
FYI:
 I can not set Vlan2 and the pix on the same subnet.  So the servers on vlan2 can not have a dg of the pix it has to be set to the switch (10.10.11.10).

Thanks
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12346394
That will only work if the respective default gateway is on their local vlan.
If the PIX is actually in VLAN 2, and the frame router is actually on vlan 1, then yes, you can assign vlan 2 clients the PIX as their default gateway on their PC/server, same on vlan 1. This is a client configuration, not on the switch, so every client will have to be reconfigured.

The problem is that if you need vlan 2 to talk to vlan 1 or any other subnet, you just broke it because now VLAN 2 points to the PIX as the gateway and the PIX won't do redirects. You'll have to point to them to this 3550 as their gateway, which in turn, routes them appropriately to the other vlans out out to the PIX.  This is by far the best solution.

You can't stay away from access lists if you want to get the most use out of the capabilities that you have in a L3 switch. Let it do the job.

0
 
LVL 2

Expert Comment

by:wmilliga
ID: 12346412
JT:

The DG is set either statically or via DHCP on the host devices. If the PIX cannot have an interface in VLAN2, then you will need to use Policy Routing as per lrmoore's comment above. ACLs must be used for this type of configuration, because it is Cisco's way of pattern matching.
0
 

Author Comment

by:CUOL-MIS
ID: 12346751
That sounds good.  thank you for help guys!
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Let’s list some of the technologies that enable smooth teleworking. 
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now