VLANs not communicating to the internet

[isoto]

Hello. I need some help. I just setup a cisco firepower and setup vlans on there. I created the same vlans on the switch, but I cant get vlans to reach out to the internet. The native vlan 1 can, but not any of the others. 

[isoto]

That was the screen shot I provided earlier. I can not make a route for the vlans because of the implicit route

[isoto]

Sorry @Rob Ingram I just saw your response I just change it and am getting the same thing

[Rob Ingram]

@isoto the ping is sourced from the switch from a different VLAN, so it's probably routing the packet using 192.168.1.1 as its next hop, but you've got all of the VLANs defined on the FTD.

If you had a host connected to one of the VLANs on the switch with the default gateway as the FTD's IP address (not the switch SVI) it may well work, assuming NAT and ACP rules are setup correctly.

Or make a routed link between the FTD and the switch, remove the VLANs on the FTD, create static routes on the FTD to the VLAN networks on the switch and assuming the NAT and ACP is configured correctly it would work.

[isoto]

The default gateway being the FTD's inside interface correct, 192.168.1.1?

[isoto]

Im going to hope on that and see if it works. 

[isoto]

Also, if I try to ping the default gateway from vlan 2 I cant reached it

[IP_Cartel]

I think this video will help you.

https://www.youtube.com/watch?v=3cuf2SjH-6A&ab_channel=NetworkingHub

[IP_Cartel]

here is another video.  You want to send traffic back to the switch. ignore the DMZ part.

https://www.youtube.com/watch?v=5K-mHnGoydE&ab_channel=AyoKush

[Marius Gunnerud]

Could you run a packet-tracer on the FTD device and post the output here.  This should give us an indication of where it is being dropped.

packet-tracer input inside tcp 192.168.2.2 12345 8.8.8.8 443 detail

[Aref Alsouqi]

I didn't read all the posts thoroughly so apologies if I missed anything. The issue seems to be related to some wrong config on the link that is connecting the FTD to the switch. Please make sure that link configured as a trunk and all the used VLANs are allowed.

[isoto]

Thank you everyone for your help. Im going to try to get the users to plug in a host to one of the ports to see if I am just reading to much into the source ping. The setup is remote by over 1000 miles so I cant just plug it in myself.