Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Connect EMI 3550 Switch To Firewall

I am connecting a 3550 switch to the internal side of firewall. The 3550 switch is then trunked to another switch through giga (Switch 2), and then switch 2 is trunked to switch 3 through giga port (daisy chain).

There are 2 staff vlans in switch 1 and a management vlan.

Are there any examples on internet for this kind of setup? I basically cannot get switch 1 to be a layer 3 switch and also apply access lists to it. I also always have to specify ip route 0 0 firewall inside port as gateway of last resort and do not know how to specify ip route with internal ip of vlans....

  • Other Network Infrastructure Subjects

Re: Connect EMI 3550 Switch To Firewall

The switch 1 that will serve as L3 for inter-vlan will not need to be specified to route for these valns. The switch will simply know this when it look at its routing table and see the other vlans as directly connected. The switch 1 ser ving as L3 will need a gateway of last resort pointing to the firewall, so that routes to any other destination not in your internal network as as traffic to the Internet will be routed and go through the firewall. The firewall will need some kind of static route back to the other vlans. that's the concept.

Re: Connect EMI 3550 Switch To Firewall


The first thing that you will do to make it a Layer 3 switch is to enable " IP Routing " on it which is disabled by default.

conf t

ip routing

Now with ip routing enabled, you can define your Layer 3 Vlan SVI's and this will enable the Layer 3 communication between the vlans.

config t

int vlan x

ip x.x.x.x y.y.y.y

You can then set a defualt route pointing towards firewall.

Please see the below links:

HTH, please rate if it does.

-amit singh

This widget could not be displayed.