I have a Cisco 4948 switch that I'm dividing in half (half public, half private VLAN for NAS access). On the public side, Gi1/0 is the up-stream connection to the router, and G1/0-23 are configured in VLAN1 and designed for public access. Public IPs are xx.47.90.0/24, with a gateway of xx.47.90.1 (which lives on the router ... and is assigned to a separate VLAN on the router)

Ports G1/24-48 are designed VLAN2 and setup for private access. The private network is defined as I've added to the VLAN2 interface, and am using it as the default gateway for servers only on the private network (as well as the management IP for the switch).

Everything works, as long as servers have two NICs, they can reach both networks. My issue is servers that are ONLY on the private the private VLAN can't reach the public network. So my question(s)

1) Should I be using as the gateway for servers only on the private network? Or should I be using the public gateway (xx.47.90.1) even though the only IP assigned to the server is in the private range?
2) Is there a configuration needed on VLAN2 (private) to allow it to access the public network? All the documentation I've seen was written for routers where the public IP lived on the device. Basically what I want to do is route all traffic to the public gateway xx.47.90.1 except

  • Just a side note, it might be worth using some other vlan besides vlan1. – cpt_fink Oct 8 '14 at 5:34

Have you assigned an ip address to both the VLAN1 and VLAN2 interfaces on the switch? Have you enabled ip routing on the switch? If not, you need to.


If your goal is to allow hosts in VLAN1 and VLAN2 to communicate with each other and only for hosts in VLAN 1 to have internet access then you should only need to configure an appropriate ip address to the VLAN1 and VLAN2 interfaces and to enable ip routing on the switch.

If you also need hosts in VLAN2 to have internet access then there are a few more configurations needed on the switch and the router.

  • I've only assigned an IP address to VLAN2 (the private one). VLAN1 has no IPs - it is connected directly to the router, which does have the (public) IP ranges. The goal is VLAN1 can't talk to VLAN2, however VLAN2 can talk to VLAN1. (i.e. private can talk to public, but not the other way) – John P Oct 6 '14 at 4:19
  • Forgive me for saying this John, but communication is bidirectional. VLAN1 won't be able to talk to VLAN2 if VLAN 2 can't also talk to VLAN1. For instance, if you ping a host on VLAN2 from a host on VLAN1 the host on VLAN2 will receive the ICMP Echo Request but the reply will never make it back to the host on VLAN1. What type of communication do you envision where traffic only flows from VLAN1 to VLAN2, but not the other way? – joeqwerty Oct 6 '14 at 12:09
  • Also in addition to interfaces and addresses in both vlans/subnets and routing enabled, you will need a default route on the 4948 pointing to the router, otherwise the switch won't know where to send packets for not-connected routes. – cpt_fink Oct 8 '14 at 5:33

You will need to use a gateway on the same subnet as the hosts; if they are not on the same subnet, they'll have no way to know how to get to the gateway (not entirely true; you could do arp-spoofing and Layer2 proxying, but that is ugly and not nice).

It would be helpful if both the internal and external gateway addresses lived inside the router, rather than one in the router, one in the switch. You would do this by making the connection between the router and the switch a trunk (old-timers sometimes call it an ISL (Inter-Switch Link) or cross-connect or tie-line), assigning both VLAN1 and VLAN2 to be encapsulated on the trunk line, and configure the trunk identically on both the uplink port in the router and the switch.

Inside the router, you would assign the gateway IP numbers to the respective VLAN virtual interfaces.

In order for the machines in 10.1.40/24 to get out (or more importantly, to get out and to get back, you will want to setup NAT (or what Linux people call "Masquerading"). This would allow all of the 10.1.40/24 addresses to be mapped to one or more addresses in the xx.47.90/24 range (so upstream providers will be able to know what to do with them), and state kept for the return traffic to be sent back to the right originating servers.

Since you are using a Cisco device, you may want to look at instructions at http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.pdf, which describes setting up NAT in a Cisco router, especially the section titled "Example: Allowing Internal Users to Access the Internet". This will allow them outbound access, and allow return traffic for established sessions, but not inbound traffic (especially if you explicitly filter-out source-routed traffic at the VLAN1 interface or upstream from that).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.