Cisco cat vlan routing

I have a Cisco Cat 3550 layer 3 switch, with 2 vlans.  How can I do static routing seperatly, so vlan one has a different default gateway than vlan two.  Right to the point I want vlan1 going our frame-relay, and vlan2 going to our pix.

thank you,
JT


sh run

sw3550#sh run
Building configuration...

Current configuration : 7532 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname xxxxxxxxxx
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
ip routing
!
!
spanning-tree extend system-id
!
!
 --More--         interface FastEthernet0/1
 no ip address
!
interface FastEthernet0/2
 no ip address
!
interface FastEthernet0/3
 no ip address
!
interface FastEthernet0/4
 no ip address
!
interface FastEthernet0/5
 no ip address
!
interface FastEthernet0/6
 no ip address
!
interface FastEthernet0/7
 no ip address
!
interface FastEthernet0/8
 no ip address
 --More--         !
interface FastEthernet0/9
 no ip address
!
interface FastEthernet0/10
 no ip address
!
interface FastEthernet0/11
 no ip address
!
interface FastEthernet0/12
 no ip address
!
interface FastEthernet0/13
 no ip address
!
interface FastEthernet0/14
 no ip address
!
interface FastEthernet0/15
 no ip address
!
interface FastEthernet0/16
 --More--          no ip address
!
interface FastEthernet0/17
 description port to 3745
 no ip address
!
interface FastEthernet0/18
 no ip address
!
interface FastEthernet0/19
 no ip address
!
interface FastEthernet0/20
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/21
 no ip address
!
interface FastEthernet0/22
 description Router
 no ip address
 duplex half
 --More--          speed 10
!
interface FastEthernet0/23
 no ip address
!
interface FastEthernet0/24
 no ip address
!
interface FastEthernet0/25
 no ip address
!
interface FastEthernet0/26
 no ip address
!
interface FastEthernet0/27
 no ip address
!
interface FastEthernet0/28
 no ip address
!
interface FastEthernet0/29
 no ip address
!
 --More--         interface FastEthernet0/30
 no ip address
!
interface FastEthernet0/31
 no ip address
!
interface FastEthernet0/32
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/33
 no ip address
!
interface FastEthernet0/34
 description WEB server port
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/35
 no ip address
!
interface FastEthernet0/36
 no ip address
 --More--         !
interface FastEthernet0/37
 no ip address
!
interface FastEthernet0/38
 no ip address
!
interface FastEthernet0/39
 no ip address
!
interface FastEthernet0/40
 no ip address
!
interface FastEthernet0/41
 no ip address
!
interface FastEthernet0/42
 no ip address
!
interface FastEthernet0/43
 no ip address
!
interface FastEthernet0/44
 --More--          no ip address
!
interface FastEthernet0/45
 no ip address
!
interface FastEthernet0/46
 no ip address
!
interface FastEthernet0/47
 no ip address
!
interface FastEthernet0/48
 no ip address
!
interface GigabitEthernet0/1
 no ip address
!
interface GigabitEthernet0/2
 no ip address
!
interface Vlan1
 ip address 10.10.10.10 255.255.255.0
!
interface Vlan2
 description WEB Server VLAN
 ip address 10.10.11.10 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.1
ip route 10.10.112.0 255.255.255.0 10.10.10.3
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.85.0 255.255.255.0 10.10.10.1
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.86.0 255.255.255.0 10.10.10.1
ip route 10.10.87.0 255.255.255.0 10.10.10.1
ip route 10.10.91.0 255.255.255.0 10.10.10.1
ip route 10.10.90.0 255.255.255.0 10.10.10.1
ip route 10.10.88.0 255.255.255.0 10.10.10.1
ip route 10.10.60.1 255.255.255.255 10.10.10.1
ip route 10.10.89.0 255.255.255.0 10.10.10.1
ip route 10.10.103.0 255.255.255.0 10.10.10.1
ip route 10.10.93.0 255.255.255.0 10.10.10.1
!
!
!
!
end

sw3550#
CUOL-MISAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
lrmooreConnect With a Mentor Commented:
Use policy routing:

   access-list 110 permit ip 10.10.10.0 0.0.0.255 any
   access-list 111 permit ip 10.10.11.0 0.0.0.255 any

   route-map FRAME permit 10
     match ip address 110
     set ip next-hop <ip of frame router>

    route-map PIX permit 10
      match ip address 111
      set ip next-hop <ip of PIX>

    Interface vlan 1
     ip policy route-map FRAME

    Interface vlan 2
      ip policy route-map PIX

0
 
wmilligaConnect With a Mentor Commented:


Simply don't route anything. Give your VLAN1 devices a DG of the FR router, and your VLAN2 devices a DG of the PIX. Policy routing will certainly work- but why bother, based on what you have described as your needs?
0
 
CUOL-MISAuthor Commented:
WMILLIGA,
     That is exactly what I want to do.  I wanted to stay away from access-lists.  However I can not find the commands on cisco web site and I was not sure you could give dg to 2 or more vlans on a layer 3 switch.  So how do I set a dg to a vlan?

Thank You,
JT  
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
CUOL-MISAuthor Commented:
FYI:
 I can not set Vlan2 and the pix on the same subnet.  So the servers on vlan2 can not have a dg of the pix it has to be set to the switch (10.10.11.10).

Thanks
0
 
lrmooreCommented:
That will only work if the respective default gateway is on their local vlan.
If the PIX is actually in VLAN 2, and the frame router is actually on vlan 1, then yes, you can assign vlan 2 clients the PIX as their default gateway on their PC/server, same on vlan 1. This is a client configuration, not on the switch, so every client will have to be reconfigured.

The problem is that if you need vlan 2 to talk to vlan 1 or any other subnet, you just broke it because now VLAN 2 points to the PIX as the gateway and the PIX won't do redirects. You'll have to point to them to this 3550 as their gateway, which in turn, routes them appropriately to the other vlans out out to the PIX.  This is by far the best solution.

You can't stay away from access lists if you want to get the most use out of the capabilities that you have in a L3 switch. Let it do the job.

0
 
wmilligaCommented:
JT:

The DG is set either statically or via DHCP on the host devices. If the PIX cannot have an interface in VLAN2, then you will need to use Policy Routing as per lrmoore's comment above. ACLs must be used for this type of configuration, because it is Cisco's way of pattern matching.
0
 
CUOL-MISAuthor Commented:
That sounds good.  thank you for help guys!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.