Hello,
with VLAN2 I assume you mean Vlan 100 (the Vlan interface you have created) ?
Either way, you don't need any additional routing (as long as whatever clients exist in Vlan 100 are directly connected to your router.
In the configuration below, interfaces GigabitEthernet4 and 5 have been assigned to the new Vlan. Here is what the config should look like (important parts marked in bold):
Current configuration : 2906 bytes
!
! Last configuration change at 16:00:12 GMT Mon Aug 9 2021 by admin1
version 15.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Pxxxxxc_Sxx-Cisco800
!
boot-start-marker
boot-end-marker
!
aqm-register-fnf
!
enable secret 5 $xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
aaa new-model
!
aaa session-id common
clock timezone GMT 8 0
!
--> ip dhcp excluded-address 192.168.1.1 192.168.1.30
--> ip dhcp excluded-address 192.168.30.1
!
ip dhcp pool one
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 165.21.83.88 165.21.100.88
!
--> ip dhcp pool two
--> network 192.168.30.1 255.255.255.0
--> default-router 192.168.30.1
--> dns-server 8.8.8.8
!
ip domain name pxxxxxxxxxxxx.com
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
license udi pid C891F-K9 sn FXXXXXXXXXXX
!
username admin privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxx
username admin1 privilege 15 password 0 xxxxxxxxxx
!
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 5
lifetime 28800
crypto isakmp key sxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxa hostname kyoten2
crypto isakmp keepalive 30
!
crypto ipsec transform-set IPSEC esp-aes 256 esp-sha-hmac
mode tunnel
!
crypto dynamic-map sa1-dynamic 10
set transform-set IPSEC
set pfs group5
!
crypto map sa1 1 ipsec-isakmp dynamic sa1-dynamic
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
duplex full
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
--> switchport access vlan 100
!
interface GigabitEthernet5
--> switchport access vlan 100
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
ip address 42.xx.xx.yyy 255.255.255.252
ip nat outside
ip virtual-reassembly in
duplex full
speed 1000
crypto map sa1
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
--> interface Vlan100
--> ip address 192.168.30.1 255.255.255.0
--> ip nat inside
--> ip virtual-reassembly in
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip nat inside source route-map nonat interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 42.xx.xx.yyy
!
--> route-map nonat permit 10
--> match ip address 101
--> match interface GigabitEthernet8
!
--> access-list 101 deny ip 192.168.1.0 0.0.0.255 172.31.152.0 0.0.0.255
--> access-list 101 deny ip 192.168.30.0 0.0.0.255 172.31.152.0 0.0.0.255
--> access-list 101 permit ip 192.168.1.0 0.0.0.255 any
--> access-list 101 permit 192.168.30.0 0.0.0.255 any
!
control-plane
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
line con 0
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
transport input ssh
!
scheduler allocate 20000 1000
!
end
