Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco 5505 router that I need help configuring. I have 3 VLANs set up. VLAN 1 is set for 192.168.1.0/24 subnet. I have one computer hooked up to this subnet with the address 192.168.1.2. The VLAN 1 address is 192.168.1.1 which is the default route set in the computer. VLAN 2 is set to get its address from company DHCP server.

I also have it configured to set the default route in the router to this same subnet. VLAN 3 is configured for the subnet 192.168.10.0/24. I have a static route set so packets with a 192.168.10.x address from the PC are vpn-tunneled through VLAN 3. The problem is I can't get packets with any other address to go out the default address set in the router, e.g., out to the company network which, by the way, is not a VPN.

Do I need to set another static route in the router to make this happen? If not, what do I need to do?

share|improve this question

Cisco 5505 is a Firewall, it's possible that in the license base vlan3 is restricted. Verify the Crypto Map used in your VPN (configuration, site-to-site-vpn, advanced, crypto map)

share|improve this answer

It looks like the company gateway where your router default route points to does not know how to reach your VLANs.

You need the routes 192.168.1.0/24 and 192.168.10.0/24 configured on that gateway pointing to the IP set on the VLAN2, therefore using DHCP is not a good option as this IP may change.

(company gateway)---VLAN2----(your router)----VLAN1
                                   |
                                   |
                                 VLAN3
share|improve this answer

Do the VLANs have the same security level? If so, make sure you have :

hostname(config)# same-security-traffic permit inter-interface

Also confirm that there is a default route to the ASA firewall from where ever it is that you need to access the outside.

I hope this'll work.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .