L3 VLANs on Catalyst 3750 and weird traffic forwarding

Unanswered Question
Feb 8th, 2007

Hi All,

I need to subnet my net to a 32 subnets. It's easy.

But also I need to do a strange trick.

All traffic from subnets, and so on, must be forwarded to MS ISA server if it's destined to network other than

for example subnet has a default gw propagated from DHCP server via ip helper-address

the same is for subnet but with a default gateway

And the trick I must to do is - forward to MS ISA server all traffic from subnets, and so on, if it's destined to network other than

I now that I can do this trick with PBR on a Cisco Catalyst. Something like

ip access-l e TO-ISA

deny ip

permit ip any any

route-map pbr permit 10

match ip address 10

set ip next-hop IP-OF-ISA-SRV

and then insert PBR into each VLAN.

But I think that on a huge network load this configuration would work extremely slow :-(

So how can I do this trick without PBR?

Or may be it would work not very slow?

May be Microsoft Firewall Client can create something like a Tunnel to forward packets directly from PC via default gateway to MS ISA server?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 2 (1 ratings)
etamminga Thu, 02/08/2007 - 09:42


Wouldn't the easiest thing be to add a default-route to the switch and have it forward all traffic to ? This requires the default-gateway on the network (vlan1, ex to be the switch's interface instead of the MS ISA server and the MS ISA server to have a route to via the switch's interface (vlan1, ex

As more-specific routes have a higher preference than less-specific routes, all traffic will stay local and all other traffic will be redirected via the default-route.


ip routing

int vlan1

ip address

int vlan2

ip address

ip helper-address 10.0.0.xxx

int vlan3

ip address

ip helper-address 10.0.0.xxx

! int vlan4 to vlan32 analog to vlan2

! the default route to MS-ISA

ip route


Erik Tamminga


This Discussion