1

I’m trying to set up multiple VLANs on my Cisco Catalyst 3850 switch and connect them to the internet using a TP-Link AX20/Asus RT-N12 router. I need this setup to have multiple isolated networks with different Ip ranges in a way that devices in each vlan cannot communicate with other vlans but they all have access to Internet. However, the routers don't seem to support VLAN tagging (802.1Q), and I’m wondering if it’s possible to achieve this setup without needing a more advanced router.

My Current Setup: Switch: Cisco Catalyst 3850 24T

VLANs created:

VLAN 10: 192.168.10.0/24
VLAN 20: 192.168.20.0/24
VLAN 30: 192.168.30.0/24

Each VLAN has an SVI configured with its respective gateway IP:

VLAN 10 SVI: 192.168.10.1
VLAN 20 SVI: 192.168.20.1
VLAN 30 SVI: 192.168.30.1

The routers do not support VLAN tagging or subinterfaces. Its LAN IP is 192.168.1.1 (assigned manually) and is connected to a trunk/access port on the switch. DHCP: DHCP pools are configured on the switch to assign IPs in the VLAN ranges automatically.

Problem: Devices in each VLAN can communicate within their VLAN but they cannot access the internet. I suspect the issue lies with the routers inability to recognize VLAN traffic. Since it doesn’t support VLAN tagging, it can only route traffic from a single subnet (VLAN 10 in this case).

just for test I even enabled Inter-VLAN routing on the switch using ip routing.

Question:

  • Is it possible to set up this configuration without replacing the router with a more advanced one that supports VLANs?
  • If yes, how can I configure the switch and router to make it work?
  • If no, what would be the simplest, cost-effective way to enable internet access for all VLANs?

Any advice or insights would be greatly appreciated. Let me know if additional details are needed.

Thanks in advance!

Improve this question
1
  • 1
    The switch does not NAT, so that has to be on the router, so the router needs to NAT for each network. You may be able to set up routing between the 3850 and the router (consumer-grade devices are off-topic here). You could then have a routed link between the router and switch, and configure NAT for each network on the router. You will need to put ACLs in place on the switch to prevent traffic between them.
    – Ron Maupin ♦
    Commented Nov 20 at 15:56

2 Answers 2

Reset to default
2

The Catalyst 3850 is a layer-3 switch, so inter-VLAN routing can be done on the switch.

Follow these steps:

  1. Configure VLANs as required on the Catalyst. Use a dedicated VLAN/subnet for the uplink port to the (consumer-grade and off-topic) router, e.g. 192.168.99.0/30.
  2. On the switch, configure IP addresses for distinct subnets on the VLAN interfaces (SVI).
  3. On the switch, add a default route for 0.0.0.0/0 with the router as gateway.
  4. On the switch, make sure routing is turned on.
  5. On the router, add a static route for each subnet but the router's and use the switch's IP address towards the router as gateway. For simplicity, you can also aggregate, e.g. 192.168.0.0/16 via 192.168.99.1.
  6. Configure DHCP for all subnets if desired. The switch SVI is the default gateway for that VLAN.

For DHCP you can alternatively use

  1. the Catalyst switch (on topic here)
  2. another DHCP server that is trunked/directly connected to all VLANs (off topic here)
  3. another suitable DHCP server (off topic here) that is connected to just a single VLAN in combination with a DHCP relay on the switch (on topic here)

By default, the layer-3 switch routes between all connected subnets. If you don't want that you need to add ACL rulesets that filter unwanted traffic. ACLs are stateless, so you might need to configure matching rules from both sides.

If you wanted 192.168.10.0/24 to only talk to the Internet, 192.168.20.0/24 to only talk to 192.168.30.0/24 and 192.168.30.0/24 to talk to 192.168.20.0/24 and the Internet you'd set:

VLAN 10 in:

deny ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.255.255
permit ip 192.168.10.0 0.0.0.255 any

VLAN 20 in:

permit ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255

VLAN 30 in:

permit 192.168.30.0 0.0.0.255 any

ACL use a 'first fit' logic, and there's an implied deny ip any any at the end of each ACL.

Improve this answer
2
  • Thank you @Zac67 for your detailed answer. The only part that I think I cannot do with my current devices is item 5.On the router, add a static route for each subnet... and that was kind of my main question. My two routers are not VLAN capable, and I don't know how I can define routes for different subnets in my switch.
    – Firouziam
    Commented Nov 22 at 13:15
  • You don't need VLANs on the router but you do need at least one static route. Without it, it's all for nothing. Many consumer-grade routers support static routes but many don't - anyway, we can't help you with off-topic devices here.
    – Zac67 ♦
    Commented Nov 22 at 14:36
-1

Private VLANs, supported on Cisco platforms, provide isolated VLANs with no communication between VLAN ports except for one designated port for layer-3 functions.

HTH.

Improve this answer
1
  • 1
    Please add answer details to your answer, don't just post a (rotting) link. Additionally, the OP is not asking about inhibiting traffic within each VLAN.
    – Zac67 ♦
    Commented Nov 21 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.