Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Installing VLAN's to an existing network

I don't know if this is the right forum to put this on, but this will get me started.

I have an existing network that has 3 remote locations that are connected with a VPN using the PIX 506e Firewall running PIX Version 6.3(3). The network scheme is, where B = branch number. 1 = HQ, 2 = B2, 3 = B3, 4 = B4. Branches 2 & 4 are at the same location and going through the same PIX in the VPN. The PIX's are the default gateway for the networks right now. They are taking care of the static routing between the stores. My NAT is (nat (in) 1 0 0, glo (out) 1 interface). I have the Business System at HQ with the IP of, which all of the locations talk to right now.

I created a VLAN scheme that will separate the departments at (HQ) Branch 1 using the Cisco's (1) 3550 layer 2/3 switch and using port 1 for the routing port that will connect to the PIX with a /30 scheme and (2) 2960 switches that are all trunked. It has 6 VLANs. To save time we'll say the IP scheme is Where D = Department number 1 - 5 and VLAN 6, for the business system and its devices.

I wanted to check with some people before I install the VLAN, so when I'm installing the equipment and changing the IP scheme if I hit a bum I don't have to reconfigure back to the old configuration because of some small detail I didn't think of. So, I thought I would ask for some advice. What I'm most concerned about is the routing / VPN between the locations, and everyone talking to one another.

For the Firewall I don't think that I have to do anything to the ACL because the VPN tunnel is still seeing the network that was already on the PIX because the VLAN and the 3550-layer 2/3 port 1 is the routing port and will find it in the routing table, correct? But if I want the other location to connect to say the network I will have to place the route on the PIX at the locations.

The only thing that I'm thinking is that if I wanted the other network to talk to the VLANs I would have to add then to the ACL with a permit. I think this is all I would have to add to the PIX to allow them to talk to one another. Of course I will have to reorder my ACL.

HQ # Access-l 100 permit ip

Br2# Access-l 100 permit ip

I will have to change the inside address to /30.

Is there anything other than that I would have to do in order for the VLANs to work and keep the networks functional?

  • Firewalling

Re: Installing VLAN's to an existing network

Hi ...

I think you need to take care of some aspects such as:

1.- Routing to/from the sites towards those new VLANs.

2.- ACL on the firewalls to allow access to/from the sites towards the new VLANS.

3.- This is critical .. You also need to make sure that your VPN configuration to/from those sites towards the new VLANS are including those extra ranges. If you don't add them to the access-list you are using for identifying the IPsec interesting traffic .. then you will have problems trying to communicate with those new VLANs over the IPsec tunnel.

4.- The above point also relates to making sure that you are BY-PASSING nat for the above traffic so that source IP addresses remain unchanged when communicating to/from sites over the VPN.

That's all I can think of right now.

I hope it helps .. please rate it if does !!!