Routing & default gateway problems.

[summoner]

We are redesigning our network at work and our aim is for all subnets to be able to access the internet. Our core switch is an alcatel 7800 omniswitch. It hosts 5 VLANS and the switch also has an IP address on each VLAN that is the default gateway for each VLAN.

Clients can ping other computers on other VLANS, a traceroute shows the packets being routed to other VLANS through the switch just fine.

Our firewall is located in VLAN2. Clients on VLAN2 (192.168.2.0/24) send packets to default gateway (the switch 192.168.2.254) which forwards them to the firewall 192.168.2.1. Its not true routing, the packets never leave the subnet but internet access works fine.

The real problem is other VLANS can't get out to the internet. Clients send packets to the switch as the default gateway, but then it can;t talk to the firewall. I have entered a default route (static route)into the switch that sends all traffic to the firewall but it just doesn't work.

Firewall is a watchguard firebox 1000...I can't see anything on the firebox as to why it doesn't accept traffic routed to it from other VLANS. It works fine for our vlan2 network.

Little visual diagram:
192.168.2.0/24-->192.198.2.254 (D.G.)-->192.168.2.1(firewall)-->internet works just fine.

192.168.3.0/24-->192.168.3.1 (D.G.)->192.168.2.1(firewall) no internet

Same thing with other VLANS.

Any suggestions? I'm about scraping the bottom of the barrell here. Thanks in advance.

 

[thedaver]

Bad internal route in the VLAN setup preventing access to other VLAN trunks and this preventing the Internet/firewall?

Surfinbox.com Business Internet Services - National Dialup, DSL, T-1 and more.

http://www.surfinbox.com/business/

 

[summoner]

The wierd thing is...I can access other VLANs and the switch is able to route packets from one VLAN to another. I think the problem is when packets destined to the outside world, the switch doesn't know what to do with them. It just doesnt route packets from these extra VLANS to the company firewall. Its almost as if the default route to the firewall doesn;t apply to the other VLANs, only to the VLAN where the firewall resides.

 

[ChrisAC]

And does the firewall have a route to the other VLANS and is it configured to NAT traffic from those networks? Look at the routing table and see if it knows how to get to the other VLANs and via what gateway address.

Chris.


**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[summoner]

Yes it is configured for NAT. I just found an area in the firebox and remembering what was posted here...put a route in there back to the other VLANs. That seems to do it. Internet access works fine for those VLANs.Thanks for all the help.

 

[bcastner]

192.168.3.0/24-->192.168.3.1 (D.G.)->192.168.2.1(firewall) no internet

Some Cisco, XyXel and other switches will let you do this, but it is not a common feature to bond the VLANs to a common Gateway.