InterVlan routing using a Cisco 3750

Posted on 2006-11-14
Medium Priority
Last Modified: 2013-11-16

I am trying to route communications between two vlans. Vlan10 is a DMZ and only accepts http traffic to the reverse proxy. VLAN4 is internal and only houses my webservers. Now I need to route data between the two VLANs to make the reverse proxy feature work. I know that VLANs as a standard do not route between each other without a router. My question is can the 3750 route the VLANs w/o a router and if so how? Also if this can be accomplished using the PIX that would be even better.

I have enabled ip routing and configured the VLANs with addresses. I can ping the VLANs from the switch but cannot ping VLAN10 from VLAN4 or VLAN4 from VLAN10 using the webservers. I used the sh ip route command and can see the routes.

This is what the environment looks like:

        PIX 506E
       CISCO 3750
    |                  |
VLAN10         VLAN4
Question by:a_pereira
  • 2
LVL 79

Expert Comment

ID: 17939157
>the 3750 route the VLANs w/o a router and if so how?
Yes. The 3750 is a full L3 switch:

interface vlan 10
  ip address
interface vlan 4
  ip address
interface vlan 1
  ip address

ip route  <== points to PIX

Servers in vlan 10 point to (switch) as their default gateway
Users in vlan 4 point to (switch) as their default gateway
Switch forwards everything else to PIX
(unless you have created a vlan interface on the PIX and are using it for all L3)
LVL 10

Accepted Solution

Sorenson earned 1500 total points
ID: 17939183
To enable the switch to do the routing:
after enableing routing on the cisco 3750, set an ip address on each vlan interface of the switch, also set a default route on the switch to point to your pix 506E
ip routing
int vlan 10
ip addr x.x.x.x x.x.x.x   (ip and subnet of vlan 10)
int vlan 4
ip addr y.y.y.y y.y.y.y  (ip and subnet of vlan 4)
ip route z.z.z.z    (ip address of pix)

on the pix 506 add a route to the vlan that it does not reside on
ip route  x.x.x.x x.x.x.x y.y.y.y

also check to be sure you have a nat command and/or static commands to handle the new subnet

then change default gateways on equipment to point to the ip addresses on the 3750 switch.  Switch will handle routing between the two subnets, and the pix will know how to communicate with both

using the pix 506e
see this link:  http://www.experts-exchange.com/Networking/Q_21818768.html?query=pix+vlan+506&clearTAFilter=true
and http://www.experts-exchange.com/Networking/Q_21399915.html?query=pix+vlan+506&clearTAFilter=true


Author Comment

ID: 17940270
Do I need to enable routing on all of my switches (15) or just the switch I have the webserver and PIX connected to?

Author Comment

ID: 17941816
The PIX is the gateway of the Reverse Proxy. (PIX address
Now I have tried both suggestions and can only ping from the switches and firewall as before. I cannot ping from a client machines still. Not sure what I am doing wrong.

Changes made:

interface Vlan4                                  (VLAN4 address on switch)
 ip address  
interface Vlan10                                 (VLAN10 address on switch)
 ip address
 no ip redirects
ip route (pix address)

ip route (route on PIX)

Featured Post

Managed Security Services Webinar - March 15

Selecting the right managed security services platform to grow your business can be a huge undertaking. Join WatchGuard and Frost & Sullivan in an upcoming webinar as we dive into the key elements of selecting a vendor platform and partnership to fuel a successful MSSP business.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
In this article, the configuration steps in Zabbix to monitor devices via SNMP will be discussed with some real examples on Cisco Router/Switch, Catalyst Switch, NAS Synology device.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Monitoring a network: how to monitor network services and why? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the philosophy behind service monitoring and why a handshake validation is critical in network monitoring. Software utilized …

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question