I have to do the following configuration on an cisco Sg-300 small business L3 switch as in the figure.

network dig

Since i don’t have access to this switche for practice before doing this live in production i need to clear some doubts in my head.

So here is my plan, i would really appreciate if you could check it to see if im headed right.

1.Configure vlan 2 and 3 interface with .1 ips as per the subnet, assign ports and configure the clients to use them as the gateway. question: Does tagged port simply mean an access port on just a single vlan and a port tagged on many different vlans means a trunk port? what does an untagged port mean then?

2.Add a static route on the switch as with as next hop which is the firewall. Does the L3 switch allow its interfaces to be assigned an ip address? On packet tracert I had to do "no switchport" before i could assign an ip to an interface on the L3 switch

3.Add reverse routes on the firewall for both the vlan subnets with as the next hop for the internet to work.

4.Configure firewall policies to allow traffic from and 3.0 subnets to the internet. Does the switch to firewall /30 link need trunk ports? as that is going to on vlan1.

At this stage the internet should get started on both vlans.

My next phase of config is to block the entire vlan 3 from accessing one particular host on vlan2. And then allow only certain hosts on vlan2(printers) to be accessible from vlan3.

This is proving to be confusing, i could really use some help here.

Also the plan is to use static IPs for now, but if we decide to go with dhcp I would be configuring the switch itself as the dhcp server.

I am aware of creating the dhcp pools, how do i assign them to the vlans though?

Do we use the ip helper cmd in this case? eg: pools:

ip dhcp pool vlan2

ip dhcp pool vlan3

and then for the binding to vlan2 :

interface Vlan2
ip address
ip helper-address

Also if i am to add a access point in either of the vlans, the AP would to the vlan port on the switch and does it need to have vlan tagging enabled as well?

  • why won't you offload routing and acl's to Cyberoam appliance?
    – RobertoP
    Oct 29, 2015 at 16:38
  • my senior is against it, the argument is that the switch can better handle all the lan broadcast traffic etc.
    – allwynmasc
    Oct 29, 2015 at 16:39

1 Answer 1


You do not need the ip helper-address statement.

As I understand your requirement, you only want to allow printers on vl 2 to be accessed from vl 3. Nothing else on vl 2 can be accessed from vl 3.

ip access-list extended vlan3-in
 remark allow printers.  Repeat this line for each printer
 permit ip any host <printer address>
 remark alternatively, you can only allow the printer port on the VLAN, for ex.
 permit tcp any eq 9100
 remark block the rest of vlan 2
 deny ip any
 remark permit Internet
 permit ip any any

interface vlan 3
service-acl input vlan3-in

If your AP can offer multiple SSIDs, then you can have one SSID for each VLAN. You tag the VLANs and set the switchport to trunk.

If your AP can't offer multiple SSIDs, then make the switch port an access port and don't tag the vlan.

  • Hi thanks for the ans @RonTrunk. These are different cmds as compared to the sg300 switches, im not sure if they support acsl to be binded to the vlan interface. just to confirm about the AP, if i just have a single SSID on the AP, its a home AP device, so i just plug it in to the port and assign the port to the vlan like any normal port and this works just like normal vlan setting for rest of the clients? And why the permit internet entry in the acl? My internet will be going through vlan1 as in the diagram as i understand it.
    – allwynmasc
    Oct 30, 2015 at 6:20
  • I corrected the syntax for binding the acl to the interface. My mistake in thinking it was the same as standard IOS.
    – Ron Trunk
    Oct 30, 2015 at 11:45
  • @allwynmasc yes, just plug the AP into an access port -- make sure the port on the AP is a LAN port (i.e., not a routed interface).
    – Ron Trunk
    Oct 30, 2015 at 11:47
  • @allwynmasc The ACL filters traffic coming into the switch from VLAN 3. You have to let it into the switch to get to VLAN 1
    – Ron Trunk
    Oct 30, 2015 at 11:48
  • i got the vlan3-vlan1 now. Also is the switch - - firewall link correct, do i need to use trunk ports there, I shouldn't as the both the fw port and the sw routed port are on vlan1, right?
    – allwynmasc
    Oct 30, 2015 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.