Vlans routing to internet

Unanswered Question
Apr 13th, 2007

I have a scenario where I have created seperate vlans and using my switch as the default gateway. all vlans can route between each other but one vlan cant reach internet. The vlans are 1 and 3 and the address scheme is on vlan 1 which can reach internet. The secondary vlan is and cant reach internet. The firewall is on vlan 1

Any help would be greatly appreciated

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Fri, 04/13/2007 - 05:15


Is there a route on your firewall to get back to Vlan 3 subnet via the switch vlan 1 interface.

Your switch is definitely routing - yes ??


mburguk1000 Fri, 04/13/2007 - 05:41

yes there is, everything from the 10.0.40 network cant hit the internal interface of the firewall which is

there is a default route for via

We have a another firwall, is there a chance i can set up policy based routing or access to route internet traffice via that firewall


Jon Marshall Fri, 04/13/2007 - 06:04


Could you send a copy of the switch config and the firewall ( with any sensitive info removed ).


Richard Burts Fri, 04/13/2007 - 06:58


I have looked at the config that you posted. since you posted only part of the config there is a possibility that there is something in the part that you did not post that is influencing this behavior.

I note this in the config which I do not understand:

ip route Vlan1

why do you have a static route for the address space of VLAN 3 pointing to VLAN 1?

Perhaps the larger question is why you have static routes defined for the address space of any of the VLANs?

I also note this in the config which seems incorrect:

access-list 100 permit tcp host eq www host

this specifies the source address as host which is the subnet address. So it is logically inconsistent. And since this appears to be the only statement in the access list, the access list would not permit any traffic through. Since you do not show how the access list is used we can not tell whether this is impacting your problem or not.

Based on the config it does look like VLAN 3 should be able to get to the firewall. If it can not get through the firewall then it looks like the issue may be on the firewall. As Jon suggested it may be an issue of whether the firewall has a route back to the subnet. It might also be a question of the firewall rules and whether the firewall is permitting the traffic from VLAN 3 to go through, whether it is properly translating the traffic from VLAN 3, or some other similar issue.

Perhaps you can provide some more information about the firewall setup.



mburguk1000 Fri, 04/13/2007 - 07:27

The firewall is a checkpoint nokia and i have checked the logs and a host from the 10.0.40 is hitting the firewall ist just the addressspoofing that is coming up in the logs

Richard Burts Sun, 04/15/2007 - 17:04


Do I understand your post correctly that the firewall is denying the traffic from 10.0.40.x because of anti-spoofing? Have you figured out why the firewall thinks that these addresses are spoofed?



priestphil Fri, 04/13/2007 - 06:50

You need a default route pointing at the network that the firewall is connected to. You will also need routes back to the VLAN interfaces from the firewall.


This Discussion