I have a Cisco C891F with 2 VLAN and 2 WAN, each VLAN has a route map so VLAN1 uses WAN1 and VLAN2 uses WAN2.
Devices are reaching the internet correctly on their routed outbound WAN interfaces.
Devices from VLAN1 can reach the gateway of VLAN2 and viceversa, but they can't reach devices from the other VLAN, doing a traceroute it sends them through the WAN interface without being able to find the destination since they go outside the router to the Internet.
Abbreviated configuration:
!
ip dhcp excluded-address 10.0.0.1 10.0.0.50
ip dhcp excluded-address 10.0.1.1 10.0.1.50
!
ip dhcp pool vlan1
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
dns-server 10.0.0.12 10.0.0.10
!
ip dhcp pool vlan2
network 10.0.1.0 255.255.255.0
default-router 10.0.1.1
dns-server 10.0.0.12 10.0.0.10
!
interface GigabitEthernet8
description WAN1
ip address 10.0.10.42 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no keepalive
no cdp enable
!
interface FastEthernet0
description WAN2
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex full
speed auto
no keepalive
no cdp enable
!
interface Vlan1
description VLAN1
ip address 10.0.0.1 255.255.255.0
ip access-group VIRUS in
no ip proxy-arp
ip nat inside
ip inspect Firewall in
ip virtual-reassembly in
ip policy route-map ISP_SELECT
!
interface Vlan2
description VLAN2
ip address 10.0.1.1 255.255.255.0
ip access-group VIRUS in
no ip proxy-arp
ip nat inside
ip inspect Firewall in
ip virtual-reassembly in
ip policy route-map ISP_SELECT
!
ip nat inside source list WAN1 interface GigabitEthernet8 overload
ip nat inside source list WAN2 interface FastEthernet0 overload
ip route 0.0.0.0 0.0.0.0 10.0.10.41
ip route 0.0.0.0 0.0.0.0 FastEthernet0
!
ip access-list standard WAN1
permit 10.0.0.0 0.0.0.255
ip access-list standard WAN2
permit 10.0.1.0 0.0.0.255
!
route-map ISP_SELECT permit 10
match ip address WAN1
set interface GigabitEthernet8
!
route-map ISP_SELECT permit 20
match ip address WAN2
set interface FastEthernet0
!
I fail to understand why only the gateways are reachable from the opposite VLAN and not the whole subnet.