routing from 2nd VLAN to Default gateway from native VLAN

Posted on 2011-10-14
Last Modified: 2012-05-12
Hi, i have configured 2 SSID's on 1 cisco 1252 AP (Corporate & Guest)
Corporate SSID mapped to Native VLAN1 (because there are all the corporate resources and DHCP server) (network is 10.1.1.X with default gaeway ip
Guest SSID mapped to VLAN102.(network 192.168.112.x)
VLAN 1 and VLAN 102 are also created on the procurve 2650 switch (switch should be able to perform inter vlan routing) and the ip routing command is enabled on the switch
THe corparate SSID is working fine and the Guest SSID also but my setup is not compelted yet .
I want the WIFI clients connected to the Guest SSID (subnet 192.168.112.x) be able to have internet access via the default gateway ( from the subnet of VLAN 1.
How do i configure that? I assume via the Procurve 2650 switch?
The WIFI clients use a DHCP server ( located in VLAN 102 for the moment.
Can you assist me quickly? Thank you
Question by:antwerp2007
    LVL 10

    Accepted Solution

    You cannot have a client on VLAN1 use the default gateway on another VLAN.

    Does your VLAN1 default gateway ( have an interface on VLAN102? if not, what you'd need to do is use your procurve switch as your Guests default gateway; if so, point the efault gateway to that interface. (you mentioed your procurve is doing intervlan routing - this is the most appropiate default gateway for your guests)

    LVL 26

    Assisted Solution

    If you want the traffic to go from your guest network to through your corporate network in order to reach the internet, then it is essentially not a secure solution. If you don't care about that then just make sure your switch has a default router configured on it. ie. ip route The guest devices will still use their own gateway, 192.168.112.x, but internet traffic will be routed to the
    LVL 29

    Assisted Solution

    Get rid of the VLANing and the Routing you enabled on the 2650 and let it go back to being just a Layer2 Switch.

    You need a Firewall that has the ability to have more than two interfaces.  You need 3 interfaces with the 3rd one being Untrusted by the LAN.  Plug the Guest WAP into that Interface.  The firewall must be capable of granting DHCP Addresses to the Hosts on the 3rd Interface,...if it is not capable then you will have to ditch the Guess WAP and replace it with a Wireless NAT Device (commonly but incorrectly called a "Wireless Router" in retail stores).

     Guess WAP
    LVL 2

    Assisted Solution

    1) Switch port needs to configured as trunk to carry multiple VLANs

    2) As mentioned, Layer 2 VLAN will work instead of Layer 3, which is secure to segregate traffic.
    LVL 1

    Author Comment

    Hello Thank you all for the information.
    I figured out that i don't need inter vlan routing for my setup and implemented my setup with following devices:

    1 Cisco 800 router (2 lan ports are connected with 2 ports from the procurve 1800 switch, port 1 connected with a port that is untagged on vlan1 and the other port is connected to a untagged switch port from vlan102)
    DHCP server is enabled on the cisco lan port connected to vlan102 (Guest vlan)

    1 procurve 1800 switch (22 ports on vlan1,1 utagged port vlan102 , 1 trunk port with untagged info from vlan1 and tagged info from vlan102)
    1 SBS SERVER 2008 is active on a switch port from VLAN1 and is also DHCP server for client computers from VLAN1.

    1 cisco 1252 AP with vlan1 & vlan102 configuration and respectively SSID corporate & ssid Guest.

    I have also 2 other Procurve switches  (2626 & 2650)connected with each other and the procurve 1800 switch
    The 2626 & 2650 procurves have all their ports in vlan1 and no trunk ports because i do'nt need it.
    They dont need to reach vlan102
    The cisco 1252 AP needs also to reach only the devices from Procurve 1800.
    The setup was implemented last friday (everything works) but yesterday some client computers (connected on ports from the 2626 & 2650 switches lost their connection with the network,other client computers also on the same switches were having no problems)
    A quick solution was restarting procurves 2626 & 2650.
    I cannot find any issue's in the log state from the procurve switches.
    On the 2626 and 2650 switches i see first time instation alert only from yesterday while the switches are running for at least one year?)


    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
    Network ports are the threads that hold network communication together. They are an essential part of networking that can be easily ignore or misunderstood, my goals is to show those who don't have a strong network foundation how network ports opera…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now