• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 629
  • Last Modified:

routing from 2nd VLAN to Default gateway from native VLAN

Hi, i have configured 2 SSID's on 1 cisco 1252 AP (Corporate & Guest)
Corporate SSID mapped to Native VLAN1 (because there are all the corporate resources and DHCP server) (network is 10.1.1.X with default gaeway ip
Guest SSID mapped to VLAN102.(network 192.168.112.x)
VLAN 1 and VLAN 102 are also created on the procurve 2650 switch (switch should be able to perform inter vlan routing) and the ip routing command is enabled on the switch
THe corparate SSID is working fine and the Guest SSID also but my setup is not compelted yet .
I want the WIFI clients connected to the Guest SSID (subnet 192.168.112.x) be able to have internet access via the default gateway ( from the subnet of VLAN 1.
How do i configure that? I assume via the Procurve 2650 switch?
The WIFI clients use a DHCP server ( located in VLAN 102 for the moment.
Can you assist me quickly? Thank you
4 Solutions
You cannot have a client on VLAN1 use the default gateway on another VLAN.

Does your VLAN1 default gateway ( have an interface on VLAN102? if not, what you'd need to do is use your procurve switch as your Guests default gateway; if so, point the efault gateway to that interface. (you mentioed your procurve is doing intervlan routing - this is the most appropiate default gateway for your guests)

If you want the traffic to go from your guest network to through your corporate network in order to reach the internet, then it is essentially not a secure solution. If you don't care about that then just make sure your switch has a default router configured on it. ie. ip route The guest devices will still use their own gateway, 192.168.112.x, but internet traffic will be routed to the
Get rid of the VLANing and the Routing you enabled on the 2650 and let it go back to being just a Layer2 Switch.

You need a Firewall that has the ability to have more than two interfaces.  You need 3 interfaces with the 3rd one being Untrusted by the LAN.  Plug the Guest WAP into that Interface.  The firewall must be capable of granting DHCP Addresses to the Hosts on the 3rd Interface,...if it is not capable then you will have to ditch the Guess WAP and replace it with a Wireless NAT Device (commonly but incorrectly called a "Wireless Router" in retail stores).

 Guess WAP
1) Switch port needs to configured as trunk to carry multiple VLANs

2) As mentioned, Layer 2 VLAN will work instead of Layer 3, which is secure to segregate traffic.
antwerp2007Author Commented:
Hello Thank you all for the information.
I figured out that i don't need inter vlan routing for my setup and implemented my setup with following devices:

1 Cisco 800 router (2 lan ports are connected with 2 ports from the procurve 1800 switch, port 1 connected with a port that is untagged on vlan1 and the other port is connected to a untagged switch port from vlan102)
DHCP server is enabled on the cisco lan port connected to vlan102 (Guest vlan)

1 procurve 1800 switch (22 ports on vlan1,1 utagged port vlan102 , 1 trunk port with untagged info from vlan1 and tagged info from vlan102)
1 SBS SERVER 2008 is active on a switch port from VLAN1 and is also DHCP server for client computers from VLAN1.

1 cisco 1252 AP with vlan1 & vlan102 configuration and respectively SSID corporate & ssid Guest.

I have also 2 other Procurve switches  (2626 & 2650)connected with each other and the procurve 1800 switch
The 2626 & 2650 procurves have all their ports in vlan1 and no trunk ports because i do'nt need it.
They dont need to reach vlan102
The cisco 1252 AP needs also to reach only the devices from Procurve 1800.
The setup was implemented last friday (everything works) but yesterday some client computers (connected on ports from the 2626 & 2650 switches lost their connection with the network,other client computers also on the same switches were having no problems)
A quick solution was restarting procurves 2626 & 2650.
I cannot find any issue's in the log state from the procurve switches.
On the 2626 and 2650 switches i see first time instation alert only from yesterday while the switches are running for at least one year?)


Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now