I have a router that has 4 VLANs configured, with an interface on each VLAN, the router serves as a gateway and provides internet access.

VLAN  |  Interface      |  Function
  1   |  |  DMZ
  2   |  |  Phones
  3   |  |  Work Stations
  4   |  |  Servers

The router has a single cable connecting it to a Cisco 3750 (Gi1/0/1), this connection is setup as an 802.11q trunk.

Other than the trunk port, the other ports on the switch are split among the 4 VLANs.

VLAN  |  Interface
1     |  Gi1/0/2-6
2     |  Gi1/0/7-12
3     |  Gi1/0/13-18
4     |  Gi1/0/19-24

How can I set up the switch so that all VLANs have internet access, via their respective gateways on the router, while still allowing any required inter-VLAN communication to occur on the switch itself?

The inter-VLAN communication I require is as follows:

from   |  to
2      |  1
3      |  1
4      |  1

I would prefer to run the DHCP server on the Cisco switch, but if necessary I can run it on the router.

System image file is "flash:c3750-advipservicesk9-mz.122-35.SE5.bin"

  • Tried this in 4500E "ip route" error response in the command shell. I used the standard masking then it was accepted.
    – user28115
    Jul 24, 2016 at 23:36
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 3:53

3 Answers 3


The switch would need to be a layer-3 switch with routing enabled to allow communication between the VLANs; a layer-2 switch cannot route traffic between VLANs. You would configure SVIs on the layer-3 switch, and the addresses of the SVIs would be the gateways of the VLANs.

You would then convert the trunk link to the router to a routed link:

interface GigabitEthernet 1/0/1
 no switchport
 ip address <ip address> <mask>

You will either need to run a routing protocol between the layer-3 switch and the router, or you will need to configure static routes to the VLAN network on the router.

You will also need a way to have a default route on the layer-3 switch, either specifically configured to point to the router, or through a routing protocol from the router.


Your setup this like you described is something called "router on a stick", you can search on the internet by the topic "inter vlan routing".

The thing is that is you already configure your scenario, and on host or devices connected to it respective vlans, already have it gateway, you must be able to communicate devices between vlans.

But to reach the internet, here is where you need to do some configuration.

  1. You need to create a default route that send all the traffic accross the interface connected to your ISP:

    ip route x

Note: x can be a gateway provide by your isp (usually you entablish a link using an /30 network, or can be the interface connected to you ISP, this one depends of your configuration)

  1. I guess you need to check if some kind of NATing is needed of if this is part of you ISP provider. It is not, you need to configure NAT on your router.

Here you can reach the internet from all vlans. Now, because you want to deny access from one vlan to another, you need to create access list and applied to the subinterfaces that you created on router: Eg:

   access-list 100 deny ip any
   access-list 100 deny ip any
   access-list 100 permit any any

This ACL is defined to vlan 4, allowing access to internet and to vlan 1. MUST be applied INBOUND on respective vlan 4 subinterface on router.

You need to create 2 mores to vlan 2 and 3, and do the same thing

  • The router-on-a-stick won't work because the OP wants the routing between VLANs to happen on the switch.
    – Ron Maupin
    May 14, 2016 at 16:36
  • Oh, my fault, i missed that part May 14, 2016 at 19:31

The 3750 is a layer 3 switch. It should be configured as such because better/faster inter-vlan routing.

interface VLAN1 
ip address

interface VLAN2
ip addres

interface VLAN5 //you need to first add vlan5
descript *** link to router ***
ip address

put the port linking to the router as

switchport mode access
switchport access VLAN5

..etc. finally the switch needs

ip route

Then on the router wipe out existing interface config and put

ip address

and then globally

ip route

your routers default route should point to the ISP gateway

Finally, you should have 2 links between the router and switch stack. See port-channel config guide.

  • 1
    Faster, yes; better, NOT REMOTELY. The layer-3 capabilities of the 3750 are extremely limited. Other than one of those vlans being the "DMZ", that isn't an issue.
    – Ricky
    May 14, 2016 at 21:52
  • 1
    Don't demand the use of etherchannel without providing meaningful justification. (bandwidth, resiliency, etc.)
    – Ricky
    May 14, 2016 at 21:54
  • @RickyBeam Switch does 13.1 mpps. Router does 353kppp. That's approx 40x performance difference. Use the switch for inter-vlan routing. May 14, 2016 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.