• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1294
  • Last Modified:

Cisco cat vlan routing

I have a Cisco Cat 3550 layer 3 switch, with 2 vlans.  How can I do static routing seperatly, so vlan one has a different default gateway than vlan two.  Right to the point I want vlan1 going our frame-relay, and vlan2 going to our pix.

thank you,
JT


sh run

sw3550#sh run
Building configuration...

Current configuration : 7532 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
hostname xxxxxxxxxx
!
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
enable password xxxxxxxxxxxxxxxxxxxx
!
ip subnet-zero
ip routing
!
!
spanning-tree extend system-id
!
!
 --More--         interface FastEthernet0/1
 no ip address
!
interface FastEthernet0/2
 no ip address
!
interface FastEthernet0/3
 no ip address
!
interface FastEthernet0/4
 no ip address
!
interface FastEthernet0/5
 no ip address
!
interface FastEthernet0/6
 no ip address
!
interface FastEthernet0/7
 no ip address
!
interface FastEthernet0/8
 no ip address
 --More--         !
interface FastEthernet0/9
 no ip address
!
interface FastEthernet0/10
 no ip address
!
interface FastEthernet0/11
 no ip address
!
interface FastEthernet0/12
 no ip address
!
interface FastEthernet0/13
 no ip address
!
interface FastEthernet0/14
 no ip address
!
interface FastEthernet0/15
 no ip address
!
interface FastEthernet0/16
 --More--          no ip address
!
interface FastEthernet0/17
 description port to 3745
 no ip address
!
interface FastEthernet0/18
 no ip address
!
interface FastEthernet0/19
 no ip address
!
interface FastEthernet0/20
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/21
 no ip address
!
interface FastEthernet0/22
 description Router
 no ip address
 duplex half
 --More--          speed 10
!
interface FastEthernet0/23
 no ip address
!
interface FastEthernet0/24
 no ip address
!
interface FastEthernet0/25
 no ip address
!
interface FastEthernet0/26
 no ip address
!
interface FastEthernet0/27
 no ip address
!
interface FastEthernet0/28
 no ip address
!
interface FastEthernet0/29
 no ip address
!
 --More--         interface FastEthernet0/30
 no ip address
!
interface FastEthernet0/31
 no ip address
!
interface FastEthernet0/32
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/33
 no ip address
!
interface FastEthernet0/34
 description WEB server port
 switchport access vlan 2
 no ip address
!
interface FastEthernet0/35
 no ip address
!
interface FastEthernet0/36
 no ip address
 --More--         !
interface FastEthernet0/37
 no ip address
!
interface FastEthernet0/38
 no ip address
!
interface FastEthernet0/39
 no ip address
!
interface FastEthernet0/40
 no ip address
!
interface FastEthernet0/41
 no ip address
!
interface FastEthernet0/42
 no ip address
!
interface FastEthernet0/43
 no ip address
!
interface FastEthernet0/44
 --More--          no ip address
!
interface FastEthernet0/45
 no ip address
!
interface FastEthernet0/46
 no ip address
!
interface FastEthernet0/47
 no ip address
!
interface FastEthernet0/48
 no ip address
!
interface GigabitEthernet0/1
 no ip address
!
interface GigabitEthernet0/2
 no ip address
!
interface Vlan1
 ip address 10.10.10.10 255.255.255.0
!
interface Vlan2
 description WEB Server VLAN
 ip address 10.10.11.10 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.105
ip route 4.239.249.93 255.255.255.255 10.10.10.1
ip route 10.10.112.0 255.255.255.0 10.10.10.3
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.85.0 255.255.255.0 10.10.10.1
ip route 10.10.92.0 255.255.255.0 10.10.10.1
ip route 10.10.86.0 255.255.255.0 10.10.10.1
ip route 10.10.87.0 255.255.255.0 10.10.10.1
ip route 10.10.91.0 255.255.255.0 10.10.10.1
ip route 10.10.90.0 255.255.255.0 10.10.10.1
ip route 10.10.88.0 255.255.255.0 10.10.10.1
ip route 10.10.60.1 255.255.255.255 10.10.10.1
ip route 10.10.89.0 255.255.255.0 10.10.10.1
ip route 10.10.103.0 255.255.255.0 10.10.10.1
ip route 10.10.93.0 255.255.255.0 10.10.10.1
!
!
!
!
end

sw3550#
0
CUOL-MIS
Asked:
CUOL-MIS
  • 3
  • 2
  • 2
2 Solutions
 
lrmooreCommented:
Use policy routing:

   access-list 110 permit ip 10.10.10.0 0.0.0.255 any
   access-list 111 permit ip 10.10.11.0 0.0.0.255 any

   route-map FRAME permit 10
     match ip address 110
     set ip next-hop <ip of frame router>

    route-map PIX permit 10
      match ip address 111
      set ip next-hop <ip of PIX>

    Interface vlan 1
     ip policy route-map FRAME

    Interface vlan 2
      ip policy route-map PIX

0
 
wmilligaCommented:


Simply don't route anything. Give your VLAN1 devices a DG of the FR router, and your VLAN2 devices a DG of the PIX. Policy routing will certainly work- but why bother, based on what you have described as your needs?
0
 
CUOL-MISAuthor Commented:
WMILLIGA,
     That is exactly what I want to do.  I wanted to stay away from access-lists.  However I can not find the commands on cisco web site and I was not sure you could give dg to 2 or more vlans on a layer 3 switch.  So how do I set a dg to a vlan?

Thank You,
JT  
0
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

 
CUOL-MISAuthor Commented:
FYI:
 I can not set Vlan2 and the pix on the same subnet.  So the servers on vlan2 can not have a dg of the pix it has to be set to the switch (10.10.11.10).

Thanks
0
 
lrmooreCommented:
That will only work if the respective default gateway is on their local vlan.
If the PIX is actually in VLAN 2, and the frame router is actually on vlan 1, then yes, you can assign vlan 2 clients the PIX as their default gateway on their PC/server, same on vlan 1. This is a client configuration, not on the switch, so every client will have to be reconfigured.

The problem is that if you need vlan 2 to talk to vlan 1 or any other subnet, you just broke it because now VLAN 2 points to the PIX as the gateway and the PIX won't do redirects. You'll have to point to them to this 3550 as their gateway, which in turn, routes them appropriately to the other vlans out out to the PIX.  This is by far the best solution.

You can't stay away from access lists if you want to get the most use out of the capabilities that you have in a L3 switch. Let it do the job.

0
 
wmilligaCommented:
JT:

The DG is set either statically or via DHCP on the host devices. If the PIX cannot have an interface in VLAN2, then you will need to use Policy Routing as per lrmoore's comment above. ACLs must be used for this type of configuration, because it is Cisco's way of pattern matching.
0
 
CUOL-MISAuthor Commented:
That sounds good.  thank you for help guys!
0

Featured Post

Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

  • 3
  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now