• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 523
  • Last Modified:

How to make VLAN use a certain Gateway


I have created myself a VLAN on a cisco 3750 switch called VLAN 26.

We use DHCP to distribute IP addresses and currently everyone gets a default gateway of

I now need to ensure that anyone (ports, pc's etc) who are connected to VLAN 26 goes out through a certain default gateway. (eg. and not .254) I dont want them to have access to the rest of our network, it is simply for internet access only.

Can I do this using an access list?

  • 3
1 Solution
Aaron StreetInfrastructure ManagerCommented:
hold on valns seperate out ipsubnets

clients on vlan 26 would not be able to see devices on the currente vlan, think of vlans as seperate physical switchs

what you need is to set up a second sub net

so you would have

vlan(current) =  DGFGW

VLAN26 = 10.10
.252.0 DFGW

you then set up stow SVI / vlan interfaces

#int vlan26
#ipddress  ........ this is the dfgw addess above

from your DHCP you then can hand out the two differet ranges based on what vlan a device is on.

now you have two seperate subnets, you can then control how each can talk out of the network, and indeed between the two vlans.

so you can set up ACLS and routes that will forward traffic from a vlan out of the gateways you want.

but your first step is to seperate the network in to two vlans and configure a new IP address sceam.

Aaron StreetInfrastructure ManagerCommented:
if you have a digram it would be eaiser
kilbride98Author Commented:

Here is the diagram. Could I create a seperate DHCP pool that would be associated with the new vlan and in the pool set the gateway to be the one I want to use?
Aaron StreetInfrastructure ManagerCommented:
ok what are you using for you DHCP server?

you have two ways to do this, Either set the second fire wall / router to have a ipaddress in the same range as teh clietns in vlan 23

or you set it up as 4 seperate networks

the comman way to do this would be

#int valn 1
#ip address

#int vlan 23
#ip address
#ip helper-address <ip address of DHCP serve on vlan 1>

and set up the two scopes on the DHCP server in vlan1, the switch and the dhcp server will make sure devices in vlan23 get ipaddress from the correct range (the vlan23 interface intercepts DHCP requests, tags them so the DHCP server knows what address range they are from, and then passes them on to the dhcp server, its dhcp proxying)

you then woudl set up the fire walls to have two completly different IP addresses lets say

you now have 4 seperate layer 3 networks (the two vlans and the two firewalls)

you can now enter in routes that say basicaly

if traffic is commeing from vlan25 range use ipaddress to get out

if traffic is comming from vlan 1 range use ip address

this is also ever expandable as becasue you ahve taken the gateways out side the vlans you could at a later date add say vlan 33 and then decided how its traffic flows.

so I would say give your self 4 vlans on the switch

vlan 1
vlan 23
and then vlan 2 and 3 which you will use for the fire walls (you could put them boh in the same vlan but not good for security)

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

On-Demand: Securing Your Wi-Fi for Summer Travel

Traveling this summer?Check out our on-demand webinar to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now