Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Vlan forwarding w pix 501 and catalyst 4503

I created 2 ssids and 2 vlans on my aironets. One protected and one open. The protected one is the native vlan1 and the unprotected is vlan3. I can connect to both ssids fine, but when connected to vlan3 I cannot get a dhcp address or internet connectivity when assigned static. Our dhcp server is currently the pix 501 on vlan1. I did the all the trunk and vlan allowed 1,3 cmds on the aironet interface on the catalyst. Is the problem vlan forwarding? How do I go about forwarding, I dont think the 501 can have logical interfaces. Is there some way to forward on the catalyst? Thanks and if you need anymore info let me know.

5 REPLIES
Hall of Fame Super Blue

Re: Vlan forwarding w pix 501 and catalyst 4503

Hi

So have you got a trunk link between your aironet and the 4503. And on the 4503 you have the SVI's one for vlan 1 and one for vlan3 ?

Have you added an ip helper-address under your vlan 3 interface on the 4503. If you haven't you need to execute the following command under the vlan 3 interface

ip helper-address "address of pix501 vlan 1 address". (presumably this is the inside interface ?)

HTH

Jon

New Member

Re: Vlan forwarding w pix 501 and catalyst 4503

Thanks for the tip. I just tried entering the inside pix vlan1 address as you said and it didn't seem to help. Do I need to give vlan 3 an ip address too? I did the no shutdown on vlan 3 just to make sure.

Hall of Fame Super Blue

Re: Vlan forwarding w pix 501 and catalyst 4503

Hi

Yes vlan3 will need to have an IP address for it to be able to route. If vlan3 doesn't have an IP address then anything connected on vlan 3 will never be able to get off that vlan.

I'm assuming you want users on vlan 3 to be able to get out via the Pix ??

HTH

Jon

Hall of Fame Super Blue

Re: Vlan forwarding w pix 501 and catalyst 4503

Hi

One thing i forgot to mention. If you create a layer 3 interface with an IP address for vlan 3 on the 4503 then a user on that vlan can now access anything on vlan 1 or any other vlan you route off the switch for that matter.

As you say the pix 501 doesn't do logical interfaces so you can't use the firewall to segment your traffic.

If you want to restrict traffic from vlan 3 you will need an access-list on vlan 3 interface denying traffic to any other routed vlan on the 4503.

HTH

Jon

New Member

Re: Vlan forwarding w pix 501 and catalyst 4503

Its me again, sorry. I get what you are saying but when I tried to give vlan 3 an ip it errors and says 10.10.10.0 overlaps with vlan1. I was trying to give vlan 3 the ip 10.10.10.9/24, our internal network id is 10.10.10.0/24. Am I stuck? Because our pix is the dhcp. Thanks again, RT

277
Views
0
Helpful
5
Replies
CreatePlease to create content