I have just had a cisco 200-26 smart switch with 24 ports. I have set the IP of VLAN1 (also management Lan) to All ports except port 10 and 11 are assigned to VLAN1. Furthermore, I have created another VLAN with id VLAN2 and this VLAN is getting IP from DHCP server of my university network and the internet comes through the university network. The VLAN2 is using IP's from the range 10.103.72.x. What I want to accomplish here is that, I have a full 192.168.1.xx network behind VLAN1 and only requirement is that it should be passing the internet traffic to VLAN2 and getting the results back to the relevant devices in VLAN1.
For VLAN2, I have already done port to vlan mapping and assigned them port 10 and 11 with trunk and untagged settings.
It seems what I am trying to do is really simple but I am sort of a newbie in networking and don't know much about network configurations. Please also guide me how to make the required configuration through web ui. I am not really into the command line interface of cisco switches.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9, 2017 at 22:46

1 Answer 1


What you need is a router. Routers route traffic between networks, but layer-2 switches (what your switch is) do not. VLANs keep the networks separate, and to get traffic from one VLAN to another VLAN, you need a layer-3 device (router or layer-3 switch).

Your router will need a route, probably a static default route, for the interface toward the bigger network, and the router on the bigger network will need a route to the network behind your router. The easiest way to do this is to share a routing protocols with the router on the bigger network. That way, both routers can tell each other the networks about which they know. You really want fixed IP addresses for your router interfaces, if it is at all possible.

For your switch, you only use trunk interfaces for links that will have multiple VLANs crossing them. You tag the frames on a trunk link so that the switch on the other end can tell which frames belong to which VLANs. You could have one native (untagged) VLAN on a trunk, but all the other VLANs on the trunk will be tagged. Native VLANs can be a security problem, as can VLAN 1, so the recommendation is to not use native VLANs or VLAN 1.

  • It came to me as a surprise. Earlier, I had an unmanaged swtich and I created a full LAN of series network behind this switch. I connected one physical port of this switch to the bigger network VLAN2 in current context and it was routing network's traffic to the internet right through the bigger network. I can't imagine why such thing is not possible with cisco's switch with a lost more features and a lot more money. Also note that security is currently not my problem at them moment as I am in testing phase of a deployment Apr 5, 2017 at 9:52
  • Your switch is a layer-2 switch, and layer-2 switches do not route. You need a router or a layer-3 switch (a switch with a routing module). Routers route packets between networks, but switches switch frames on the same network.
    – Ron Maupin
    Apr 5, 2017 at 13:57
  • Ok, lets put it another way. Is there a way that my layer 2 switch can act as a NAT device, i.e, I can build a LAN behind the switch and it just passes my internet traffic to the other network that is using network? Apr 5, 2017 at 18:23
  • 1
    No. Layer-2 knows nothing about layer-3, e.g. IP. Ethernet switches only look at the layer-2 frame to see the source and destination MAC addresses. They do not strip off the frame to look at the IP packets the way routers do. Routers will strip off the layer-2 frame, and use the destination layer-3 address to forward a packet to the next interface, and build a new layer-2 frame for the next interface. What I have been telling you is that you have the wrong equipment to do what you want. You need a router or layer-3 switch. In fact, most layer-3 switches won't do NAT either.
    – Ron Maupin
    Apr 5, 2017 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.