Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Basic Small LAN Config Changes

I have a few questions on setting up (re-configuraing) a small business LAN. The network consists of 2 core switches, both cisco 3750G and a Microsoft Threat Management Gateway as the router / firewall. The TMG has 3 NIC, DMz, Internal LAN, and External. The 2 3750G's are in two separate rooms connected via trunked VTP. I have a number of vlan's: vlan 9 (DMz) int ip192.168.0.2 | vlan10 (INT_LAN) int ip | vlan20 (vMotion) int ip | vlan30 (iSCSI) int ip ip routing is enabled on switch. I do not have ip default-gateway set.

Threat Management Gateway (TMG) Server NIC Config: DMz, IP: connected to gi1/0/x switchport access vlan9. INT_LAN, IP: connected to gi/1/0/x switchport access vlan10. Ext, IP: Public connected to ISP. All internal servers / workstations use the TMG INT_LAN IP as their gateway. Internal AD DNS server forwards to DMz DNS DMz DNS forwards to External Public for all external resolution.

With the above configuration, I'm noticing SYN_PACKET_DROPPED error in the TMG firewall logs. I've come across some information that might relate to having the gateway set as the TMG instead of the VLAN those servers / workstations are in, vlan10. i.e. their gateway should be set to with a route to the TMG INT_LAN IP. My question being what is the best way to go about configuring this? Since the TMG is essentially a router, should / can I change it's INT_LAN IP to say and set ip default-gateway to -or- would adding a route like work -or- What would the port settings for the TMG NIC INT_LAN be? Would it be a routed port or still remain a switchport in a vlan i.e. vlan1

Any assistance would be greatly appreciated with this configration. Thank you!




Hi SKTo me there is no right


To me there is no right/wrong answer about the main router.
If you want to keep the TMG as the router that should be ok.

Before you go changing default gateways.

Lets try diabling proxy arp in the 3750 ip interfaces.

int vlan 9
no ip proxy-arp
int vlan 10
no ip proxy-arp
int vlan 20
no ip proxy-arp
int vlan 30
no ip proxy-arp

Then retest

Let us know the outcome


Regards, Alex. Please rate useful posts.
New Member

Ok, I've made the changes no

Ok, I've made the changes no ip proxy-arp on all the vlan interfaces. I will test and see if the logs are still showing TCP_SYN_PACKET_DROP and how internet browsing is. I'm posting this message from a system in the internal LAN so that's good.

With the firewall being at, would it be beneficial to put it on's it own VLAN in it's own subnet? Thanks for the help thus far.



New Member

I've made the changes noted

I've made the changes noted and I'm still experiencing a wrath of  SYN_PACKET_DROPPED in the firewall logs still. I have to constantly refresh or press enter in the address bar of internet sites I'm trying to visit from clients in the Internal VLAN 10.

I think I need to have the TMG act as the router so-to-speak in the environment. What I'm trying to figure out is how to configure my core switch in this situation. What I'm thinking is configuring one of the interfaces on the 3750 as layer 3, no switch port. assigning it an IP address of say with SN Configuring the INT_LAN NIC of the TMG as IP Would I need to add a route on the 3750 for all internet traffic to end up at the TMG INT_LAN interface and most likely have the TMG routing set properly for the 200.1.1.x and 10.0.10.x subnets as part of the INT_LAN?

If the above scenario is taken, do I have to make any changes on the 2nd 3750? I have 3 VLAN's only. Management, VLAN 10, and VLAN 5. could the ip default-gateway of the 2nd 3750 be the management interface IP address with the core1 3750 having the static route, or do both switches need a static route to the TMG IP? Thanks.


CreatePlease login to create content