1

I have a Cisco C891F with 2 VLAN and 2 WAN, each VLAN has a route map so VLAN1 uses WAN1 and VLAN2 uses WAN2.

Devices are reaching the internet correctly on their routed outbound WAN interfaces.

Devices from VLAN1 can reach the gateway of VLAN2 and viceversa, but they can't reach devices from the other VLAN, doing a traceroute it sends them through the WAN interface without being able to find the destination since they go outside the router to the Internet.

Abbreviated configuration:

 !
 ip dhcp excluded-address 10.0.0.1 10.0.0.50
 ip dhcp excluded-address 10.0.1.1 10.0.1.50
 !
 ip dhcp pool vlan1
   network 10.0.0.0 255.255.255.0
   default-router 10.0.0.1
   dns-server 10.0.0.12 10.0.0.10
 !
 ip dhcp pool vlan2
   network 10.0.1.0 255.255.255.0
   default-router 10.0.1.1
   dns-server 10.0.0.12 10.0.0.10
 !
 interface GigabitEthernet8
   description WAN1
   ip address 10.0.10.42 255.255.255.248
   no ip redirects
   no ip unreachables
   no ip proxy-arp
   ip nat outside
   ip virtual-reassembly in
   duplex auto
   speed auto
   no keepalive
   no cdp enable
!
interface FastEthernet0
  description WAN2
  ip address dhcp
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip nat outside
  ip virtual-reassembly in
  duplex full
  speed auto
  no keepalive
  no cdp enable
!
interface Vlan1
  description VLAN1
  ip address 10.0.0.1 255.255.255.0
  ip access-group VIRUS in
  no ip proxy-arp
  ip nat inside
  ip inspect Firewall in
  ip virtual-reassembly in
  ip policy route-map ISP_SELECT
!
interface Vlan2
  description VLAN2
  ip address 10.0.1.1 255.255.255.0
  ip access-group VIRUS in
  no ip proxy-arp
  ip nat inside
  ip inspect Firewall in
  ip virtual-reassembly in
  ip policy route-map ISP_SELECT
!
ip nat inside source list WAN1 interface GigabitEthernet8 overload
ip nat inside source list WAN2 interface FastEthernet0 overload
ip route 0.0.0.0 0.0.0.0 10.0.10.41
ip route 0.0.0.0 0.0.0.0 FastEthernet0
!
ip access-list standard WAN1
  permit 10.0.0.0 0.0.0.255
ip access-list standard WAN2
  permit 10.0.1.0 0.0.0.255
!
route-map ISP_SELECT permit 10
  match ip address WAN1
  set interface GigabitEthernet8
!
route-map ISP_SELECT permit 20
 match ip address WAN2
 set interface FastEthernet0
!

I fail to understand why only the gateways are reachable from the opposite VLAN and not the whole subnet.

|improve this question
  • Not part of your problem, but, you are using a switch interface for WAN2, not a router interface, and you are leaving it at the default VLAN 1, when you should really be creating a separate VLAN for that interface and function. This can cause you other problems because you are really using two different layer-3 network on VLAN 1: The WAN network and your internal network. You want to use a single network per VLAN. – Ron Maupin♦ May 25 '17 at 15:55
  • On the CISCO C891F, GE8 and FE0 are both WAN interfaces. So it should be okay I think. imgur.com/a/kmDYM – Rayduxz May 25 '17 at 16:14
2

This is because PBR sends your packets to outside interfaces. To fix that you should replace standard ACL's by extended ACL's and in first lines deny traffic to RFC1918 networks. Example:

ip access-list extended WAN1
 deny ip 10.0.0.0 0.0.0.255 10.0.0.0 0.255.255.255
 deny ip 10.0.0.0 0.0.0.255 172.16.0.0 0.15.255.255
 deny ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.255.255
 permit ip 10.0.0.0 0.0.0.255 any

ip access-list extended WAN2
 deny ip 10.0.1.0 0.0.0.255 10.0.0.0 0.255.255.255
 deny ip 10.0.1.0 0.0.0.255 172.16.0.0 0.15.255.255
 deny ip 10.0.1.0 0.0.0.255 192.168.0.0 0.0.255.255
 permit ip 10.0.1.0 0.0.0.255 any
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.