VLAN 2 can not reach the internet.

[charlesviii]

I have two VLANs 2 and 3, VLAN 3 is my user network and VLAN 2 is my server network. The two VLANs can talk, but VLAN 2 can not get out to the internet. What am I doing wrong?

Building configuration...

Current configuration : 2735 bytes

!

! Last configuration change at 02:42:02 UTC Thu Mar 4 1993

!

version 15.0

service config

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname oacSwitch1

!

boot-start-marker

boot-end-marker

!

enable secret 4  *************

enable password *************

!

no aaa new-model

system mtu routing 1500

ip routing

!

!

!

!

!

!

!

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

!

!

!

!

!

interface FastEthernet0

no ip address

no ip route-cache

!

interface GigabitEthernet0/1

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/2

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/3

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/4

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/5

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/6

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/7

switchport access vlan 2

switchport mode access

spanning-tree portfast

!

interface GigabitEthernet0/8

switchport access vlan 2

switchport mode access

spanning-tree portfast

!

interface GigabitEthernet0/9

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/10

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/11

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/12

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/13

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/14

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/15

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/16

switchport access vlan 3

spanning-tree portfast

!

interface GigabitEthernet0/17

switchport access vlan 3

!

interface GigabitEthernet0/18

switchport access vlan 3

!

interface GigabitEthernet0/19

switchport access vlan 3

!

interface GigabitEthernet0/20

switchport access vlan 3

!

interface GigabitEthernet0/21

switchport access vlan 2

!

interface GigabitEthernet0/22

switchport access vlan 3

!

interface GigabitEthernet0/23

switchport access vlan 3

!

interface GigabitEthernet0/24

switchport access vlan 3

!

interface Vlan1

no ip address

shutdown

!

interface Vlan2

ip address 10.0.0.1 255.255.0.0

!

interface Vlan3

ip address 192.168.0.2 255.255.255.0

!

ip http server

ip route 0.0.0.0 0.0.0.0 192.168.0.1

!

!

line con 0

line vty 0 4

password *************

login

line vty 5 15

password *************

login

!

end

[John Blakley]

What's doing your natting? The switch has a default route to 192.168.0.1. What device is that, and does it know about the 10.0.0.0/16 subnet?

HTH,
John

*** Please rate all useful posts ***

[charlesviii]

It is a comcast bussness gateway (the SMC not the netgear) and I have added the static route for it.

Static Route Table

Name	Destination IP	Subnet Mask	Gateway IP	Active
Servers	10.0.0.0	255.255.0.0	192.168.0.2		Remove

[cadet alain]

Hi,

I'm not sure that the gateway will NAT a non directly connected subnet and in this case it won't work without another NAT device between the switch and the gateway

Regards

Alain

Don't forget to rate helpful posts.

[charlesviii]

would I be able to asing a public IP to it and go out that way?

[John Blakley]

What Alain is saying is that you have two subnets listed in your switch. The comcast modem may support static routes, but it may only support natting it's primary IP address that's configured on its lan. For example, from your config I assume that vlan 3 is the vlan that the comcast modem is configured as. If you were to change the lan side ip address on the modem to vlan 2, your vlan 2 would be able to get out, but vlan 3 would not. The only way that I can see getting around this is to get a router, or ASA, and put it between your comcast modem and switch. Have the public address passed to the router/ASA and then you can do your natting on that device.

HTH,
John

*** Please rate all useful posts ***

[dodi_forever_2003]

Hi,

You have to change the ip address 192.168.0.1 to be on a different subnet than VLAN 2 and 3, then for the port connected to your gateway disable switchport (layer 2 port) and enable layer 3 port by adding an ip address to that port.

http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a008019e74e.shtml

Regards,

Khaled Omar