How to configure a Cisco Layer 3 switch-InterVLAN Routing

Cisco Catalysts switches equipped with the Enhanced Multilayer Image (EMI) can work as Layer 3 devices with full routing capabilities. Example switch models that support layer 3 routing are the 3550, 3750, 3560 etc.

On a Layer3-capable switch, the port interfaces work as Layer 2 access ports by default, but you can also configure them as “Routed Ports” which act as normal router interfaces. That is, you can assign an IP address directly on the routed port. Moreover, you can configure also a Switch Vlan Interface (SVI) with the “interface vlan” command which acts as a virtual layer 3 interface on the Layer3 switch.

On this post I will describe a scenario with a Layer3 switch acting as “Inter Vlan Routing” device together with two Layer2 switches acting as closet access switches. See the diagram below:

Interface Fa0/48 of the Layer3 switch is configured as a Routed Port with IP address 10.0.0.1. Two Vlans are configured on the L3 switch, Vlan10 and Vlan20. For Vlan10 we will create an SVI with IP address 10.10.10.10 and for Vlan20 an SVI with IP address 10.20.20.20. These two IP addresses will be the default gateway addresses for hosts belonging to Vlan10 and Vlan20 on the Layer2 switches respectively. That is, hosts connected on Vlan10 on the closet L2 switches will have as default gateway the IP address 10.10.10.10. Similarly, hosts connected on Vlan20 on the closet switches will have address 10.20.20.20 as their default gateway. Traffic between Vlan10 and Vlan20 will be routed by the L3 Switch (InterVlan Routing). Also, all interfaces connecting the three switches must be configured as Trunk Ports in order to allow Vlan10 and Vlan20 tagged frames to pass between switches. Let’s see a configuration snapshot for all switches below:

Cisco L2 Switch (same configuration for both switches)

!  Create VLANs 10 and 20 in the switch database
Layer2-Switch# configure terminal
Layer2-Switch(config)# vlan 10
Layer2-Switch(config-vlan)# end

Layer2-Switch(config)# vlan 20
Layer2-Switch(config-vlan)# end

!  Assign Port Fe0/1 in VLAN 10
Layer2-Switch(config)# interface fastethernet0/1
Layer2-Switch(config-if)# switchport mode access
Layer2-Switch(config-if)# switchport access vlan 10
Layer2-Switch(config-if)# end

!  Assign Port Fe0/2 in VLAN 20
Layer2-Switch(config)# interface fastethernet0/2
Layer2-Switch(config-if)# switchport mode access
Layer2-Switch(config-if)# switchport access vlan 20
Layer2-Switch(config-if)# end

!  Create Trunk Port Fe0/24
Layer2-Switch(config)# interface fastethernet0/24
Layer2-Switch(config-if)# switchport mode trunk
Layer2-Switch(config-if)# switchport trunk encapsulation dot1q
Layer2-Switch(config-if)# end

Cisco Layer 3 Switch

! Enable Layer 3 routing
Layer3-Switch(config) # ip routing

!  Create VLANs 10 and 20 in the switch database
Layer3-Switch# configure terminal
Layer3-Switch(config)# vlan 10
Layer3-Switch(config-vlan)# end

Layer3-Switch(config)# vlan 20
Layer3-Switch(config-vlan)# end

!  Configure a Routed Port for connecting to the ASA firewall
Layer3-Switch(config)# interface FastEthernet0/48
Layer3-Switch(config-if)# description To Internet Firewall
Layer3-Switch(config-if)# no switchport
Layer3-Switch(config-if)# ip address 10.0.0.1 255.255.255.252

!  Create Trunk Ports Fe0/47 Fe0/46
Layer3-Switch(config)# interface fastethernet0/47
Layer3-Switch(config-if)# switchport mode trunk
Layer3-Switch(config-if)# switchport trunk encapsulation dot1q
Layer3-Switch(config-if)# end

Layer3-Switch(config)# interface fastethernet0/46
Layer3-Switch(config-if)# switchport mode trunk
Layer3-Switch(config-if)# switchport trunk encapsulation dot1q
Layer3-Switch(config-if)# end

!  Configure Switch Vlan Interfaces (SVI)
Layer3-Switch(config)# interface vlan10
Layer3-Switch(config-if)# ip address 10.10.10.10 255.255.255.0
Layer3-Switch(config-if)# no shut

Layer3-Switch(config)# interface vlan20
Layer3-Switch(config-if)# ip address 10.20.20.20 255.255.255.0
Layer3-Switch(config-if)# no shut

!  Configure default route towards ASA firewall
Layer3-Switch(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.2

Get Free Cisco Tutorials – Sign Up Below

Fill out your e-mail address below to receive free
Cisco Configuration Examples and Tutorials
(Your email is safe with us)
My Email Address is:

Comments

  1. Hi there. I am running a similar topology in a non-production network that is going live next week. Instead of a default route going to a single internet connected ASA/Router, we’ll be using two ASA 5510s connected to two internet edge routers running BGP outside and iBGP between them. I was wondering how you might configure the two ASAs for maximum availability and load balancing. In particular i am not sure whether to put them in active/active failover or active/passive and leave the load balancing to the iBGP session. Any advice would be greatly appreciated.

    Thanks!

  2. Will,

    The best thing to do is to configure the ASA as active/standby and leave the load balancing on the iBGP between the routers. The default gateway of the Layer3 switch will point to the ASA Active inside IP. However, you will need to provide a default gateway address for the ASA outside because ASA5510 does not support BGP.

  3. Thanks for the advice! Correct me if i am wrong, but the plan will be to create an additional VLAN and SVI for both ASA inside interfaces and set my default route through this SVI (and not a router port)? Also for my active/passive config, will it be possible to use a single physical link for both LAN and stateful failover links (two subIFs)? And if so, will i need to connect these links via switch or will a crossover/straight through work?

  4. Yes you should create a vlan for the inside interfaces and create an SVI in the same subnet as the inside IP subnet of ASA. For the failover, a single physical interface is enough for both stateful and failover links (you don’t even need subifs). A direct crossover cable is ok also.

  5. Hi All,
    I’ve set up laboratory for vlan, What i want to achieve share the internet connection to the following vlans, vlan1,vlan2,vlan3.The vlan 1 can able to access internet connection but the other vlans vlan2,vlan3 can’t access the internet. Here’s my configuration

    CISCO 2800 Series

    interface FastEthernet0/0
    ip address 192.168.1.40 255.255.255.0
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    !
    interface FastEthernet0/1
    ip address 192.168.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    !
    interface Serial0/0/0
    no ip address
    shutdown
    no fair-queue
    clock rate 2000000
    !
    interface Serial0/0/1
    no ip address
    shutdown
    clock rate 2000000
    !
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 192.168.1.99
    no ip http server
    no ip http secure-server
    !
    !
    ip nat inside source list internet interface FastEthernet0/0 overload
    !
    ip access-list extended internet
    permit ip 192.168.2.0 0.0.0.255 any
    permit ip 20.20.20.0 0.0.0.255 any
    permit ip 30.30.30.0 0.0.0.255 any
    !
    !
    !
    !
    !
    !
    control-plane
    !
    !
    line con 0
    line aux 0
    line vty 0 4
    password cisco
    logging synchronous
    login
    !
    scheduler allocate 20000 1000
    end

  6. !
    hostname Switch
    !
    enable password cisco
    !
    no aaa new-model
    switch 1 provision ws-c3750g-24ts-1u
    system mtu routing 1500
    ip subnet-zero
    ip routing
    ip name-server 213.42.20.20
    ip dhcp excluded-address 20.20.20.1
    ip dhcp excluded-address 30.30.30.1
    !
    –More–
    01:01:36: %SYS-5-CONFIG_I: Configured from console
    ip dhcp pool pool1
    network 20.20.20.0 255.255.255.0
    dns-server 213.42.20.20
    default-router 20.20.20.1
    !

    network 30.30.30.0 255.255.255.0
    default-router 30.30.30.1
    dns-server 213.42.20.20
    !
    !
    !
    !
    no file verify auto
    spanning-tree mode pvst
    spanning-tree extend system-id
    !
    vlan internal allocation policy ascending
    !
    interface GigabitEthernet1/0/1
    !
    interface GigabitEthernet1/0/2
    switchport access vlan 2
    switchport mode access
    spanning-tree portfast
    !
    interface GigabitEthernet1/0/3
    switchport access vlan 3
    switchport mode access
    spanning-tree portfast
    !
    interface GigabitEthernet1/0/4
    !
    interface GigabitEthernet1/0/5
    !
    interface GigabitEthernet1/0/6
    !
    interface GigabitEthernet1/0/7
    !
    interface GigabitEthernet1/0/8
    !
    interface GigabitEthernet1/0/9
    !
    interface GigabitEthernet1/0/10
    !
    interface GigabitEthernet1/0/11
    !
    interface GigabitEthernet1/0/12
    !
    interface GigabitEthernet1/0/13
    !
    interface GigabitEthernet1/0/14
    !
    interface GigabitEthernet1/0/15
    !
    interface GigabitEthernet1/0/16
    !
    interface GigabitEthernet1/0/17
    !
    interface GigabitEthernet1/0/18
    !
    interface GigabitEthernet1/0/19
    !
    interface GigabitEthernet1/0/20
    !
    interface GigabitEthernet1/0/21
    !
    interface GigabitEthernet1/0/22
    !
    interface GigabitEthernet1/0/23
    !
    interface GigabitEthernet1/0/24
    !
    interface GigabitEthernet1/0/25
    !
    interface GigabitEthernet1/0/26
    !
    interface GigabitEthernet1/0/27
    !
    interface GigabitEthernet1/0/28
    !
    interface Vlan1
    ip address 192.168.2.2 255.255.255.0
    !
    interface Vlan2
    ip address 20.20.20.1 255.255.255.0
    !
    interface Vlan3
    ip address 30.30.30.1 255.255.255.0
    !
    ip classless
    ip route 0.0.0.0 0.0.0.0 192.168.2.1
    ip http server
    !
    !
    control-plane
    !
    !
    line con 0
    line vty 0 4
    password cisco
    logging synchronous
    login
    line vty 5 15
    login
    !
    end

  7. ———————————-
    —- ——————————– ——— ——————————-
    1 default active Gi1/0/1, Gi1/0/4, Gi1/0/5
    Gi1/0/6, Gi1/0/7, Gi1/0/8
    Gi1/0/9, Gi1/0/10, Gi1/0/11
    Gi1/0/12, Gi1/0/13, Gi1/0/14
    Gi1/0/15, Gi1/0/16, Gi1/0/17
    Gi1/0/18, Gi1/0/19, Gi1/0/20
    Gi1/0/21, Gi1/0/22, Gi1/0/23
    Gi1/0/24, Gi1/0/25, Gi1/0/26
    Gi1/0/27, Gi1/0/28
    2 test1 active Gi1/0/2
    3 test2 active Gi1/0/3
    1002 fddi-default act/unsup
    1003 token-ring-default act/unsup
    1004 fddinet-default act/unsup
    1005 trnet-default act/unsup

    VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
    —- —– ———- —– —— —— ——– —- ——– —— ——
    1 enet 100001 1500 – – – – – 0 0
    2 enet 100002 1500 – – – – – 0 0

    VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
    —- —– ———- —– —— —— ——– —- ——– —— ——
    3 enet 100003 1500 – – – – – 0 0
    1002 fddi 101002 1500 – – – – – 0 0
    1003 tr 101003 1500 – – – – – 0 0
    1004 fdnet 101004 1500 – – – ieee – 0 0
    1005 trnet 101005 1500 – – – ibm – 0 0

    Remote SPAN VLANs
    ——————————————————————————

    Primary Secondary Type Ports
    ——- ——— —————– ——————————————

  8. You need to create a routed port on the switch connected to inside of router. Remove vlan1 and put an IP address on the interface connected to inside of router (e.g make interface GigabitEthernet1/0/1 a “no switchport” port and then assign an IP address of 192.168.2.2).

  9. Thanks for the article, but i have some questions.

    1- If i want to connect host remotely from out side network on vlan 10 , then what is suggested configuration?
    2- if i want to enable hsrp for vlan 10 , then which ip address next of stanby ip will be use?

    Thanks

  10. Blog Admin says:

    1- Do a remote access VPN or create a static NAT mapping of vlan10 host to an outside address
    2- HSRP is used when having two layer3 devices as gateways. In our scenario above (only one layer3 device) there is no point to do HSRP

  11. sir i have question.
    i have created 4 vlans on cisco catalyst L3 3550 switch and i have configured thier default gateways on other cisco L3 3550.
    i have enabled ip roting over the second switch and applied ACL on default gateways.
    Is this scenario is possible without a router????

    when i am trying to ping other pc in second vlan it is not working but i m able to ping default gateway of ather vlas..

    please provide me some solution…

  12. Blog Admin says:

    Arun:

    1) all vlans must be created on all switches as Layer2 vlans
    2) remove all ACLs and try again.
    3) remove windows firewall (if any) from PC

  13. sir i am trying to create inter vlan communication for that ACLs must be there.
    and i have already removed windows firewall.

    sir,
    is intervlan communication possible with L3 switch without using a router.

  14. Blog Admin says:

    arun,

    Yes ofcourse you can do intervlan communication with a L3 switch. This is what is supposed to do actually.

  15. hi
    i am using layer3 4900m series switch.
    we have 4 networks in single vlan 1.like
    172.16.0.0/16
    172.15.0.0/16
    172.17.0.0/16
    172.18.0.0/16
    these network is directly connected with cisco 4900m switch.
    configure 4900 switch
    create Vlan 1 and give ip add
    pimary ip add is 172.15.100.1/16
    secodary ip add is 172.16.100.1/16
    secodary ip add is 172.17.100.1/16
    secodary ip add is 172.18.100.1/16
    and set default gatway 172.16.100.100/16(MPLS Router)

    and 2 another network is used at remote site. that network is connected with mpls router
    172.20.0.0/16
    172.30.0.0/16

    problem is that i am able to ping 172.30.1.5(local web site) but not able to browse that website.
    please give me solution

  16. Blog Admin says:

    Your configuration is fundamentally wrong. It is best practice to have a different layer2 Vlan for each different layer3 subnet. So I suggest you create 4 different vlans and 4 different SVI interfaces

  17. Excellent tutorial.

    What if i don’t want any traffic between vlans except from an specific groups of host on Vlan 10 to a server (or specifics host) in Vlan 20? How can you do that?
    Thanks in advance for your answer.

  18. Blog Admin says:

    Hi Tito,

    You will need to create access control lists and apply them either to “interface vlan 10″ or “interface vlan 20″ on the Layer3 switch. With these access control lists you can control which traffic can flow between vlan10 and vlan20 or vice-versa.

  19. Thank you very much for your answer. Do you know any good link or tutorial to access control lists so I can learn how to implement that? thank you very much again.

  20. Sorry, can you give an example of an ACL for doing that. No all only an example. Thank you very much!

  21. Blog Admin says:

    Tito,

    Its a normal access control list configuration.

    Example:

    access-list 101 permit tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
    access-list 101 permit tcp host 192.168.1.10 host 192.168.2.20 eq 25
    interface vlan 10
    access-group 101 in

  22. Hello,
    I have the following config on a L3 Switch with routing enable:
    interface GigabitEthernet0/10
    description UPLINK
    switchport access vlan 1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 2
    switchport trunk allowed vlan 1,3,4
    switchport mode trunk
    switchport nonegotiate
    switchport voice vlan 3
    ip access-group ACCESSLIST in
    spanning-tree portfast
    !

    and port

    interface GigabitEthernet0/14
    description UPLINK-HQ_L3
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 5
    switchport trunk allowed vlan 1,3,4
    switchport mode trunk
    switchport nonegotiate
    switchport voice vlan 3
    ip access-group ACCESLIST in
    spanning-tree portfast
    !

    the numbering vlans are for info purpose

    interface vlan 1
    ip address 192.168.1.1 255.255.255.0

    now on the acces list i don’t have an entry that permit trafic between 192.168.1.0 . Behaind these two port a have 2 layer 2 switches. It is possible to allow the communication between the computer1 that is behind interface 10 and computer 2 that is behind interface 14 using only layer 2 (without adding an entry on the access list that permits the traffic)

  23. There are a Switch layer 3 connects to Switch layer 2 through port Fa0/1. And Switch layer 2 has 2 Vlans. After configure everything fine, the PC in Vlan 2 still cannot ping PC in Vlan 3. I think my configuration has no problem.

    It looks like your lab, just no ASA firewall and only 1 switch layer 2 instead of 2 as you. I’m wondering if the different vlan can communicate with each other on the same switch. As I thought, It would be fine.

  24. sorry for bothering, I’ve just figured out the problem. Since I changed to use switch 2960 layer 2 it works. LOL

  25. Blog Admin says:

    Alex,

    Your configuration looks so messed up. Also, I didn’t understand what you want to do exactly.

  26. sorry , it’s kind like your picture, i have two L2 sw behind an L3 SW. the configuration that i put there is from the L3 sw and it represents the connected L2 SW (the port configuration). The L2 SW have computers from the same vlan. My question is: the computers from L2SW1 should communicate withe the computers from L2SW2 thru layer 2 or thru layer 3 communication.

  27. Blog Admin says:

    Alex,

    If the computers in L2SW1 belong in the same vlan as the computers in L2SW2 then they will communicate through layer2 and not layer3. However, if they belong to different vlans, they must communicate through layer3 routing.

  28. Brainslug says:

    Hi, thanks for this great article! Helped me a lot so far. However, I’m running into a problem because of a slightly different setup.

    I’m using three 3750x switches. One of them is configured as the Layer3 switch, has three VLANs:

    212: ip 10.2.12.254
    213: ip 10.2.13.254
    214: ip 10.2.14.254

    Two of the 3750′s are connected to this L3 switch via (LACP) trunks, all three VLANs on all the L2 switches. Inter-VLAN routing works nicely. For instance, I can ping from one machine in VLAN 212 on one of the L2 switches to another machine in VLAN 213 on the other L2 switch.

    Now, the big difference to the diagram above is that my L3 switch is not directly connected to an ASA, but to another switch, part of another network that is using an ASA for routing. This parent network is using 10.2.2.0/23 network, the ASA address is 10.2.3.254.

    On my L3 switch I have a L3 port (1/0/1) configured (ip 10.2.3.176) which is hooked up to an accessport on a 3560 in the 10.2.2.0 network. I can ping 10.2.3.254 from my L3 switch, and my default route on this switch is set to use the ASA:

    ip route 0.0.0.0 0.0.0.0 10.2.3.254

    From any of my PCs in the 212-214 VLANs I can ping 10.2.3.176, but not 10.2.3.254. Obviously, no connection to the Internet can be established.

    Any advice here? Running out of ideas… Thanks much!

  29. Blog Admin says:

    Brainslug,

    The problem seems to be routing related with the ASA. On the ASA, the administrator must configure a static route for its inside interface which must point to 10.2.3.176 for networks 10.2.12 , 10.2.13, 10.2.14.

    example ASA command:

    route inside 10.2.12.0 255.255.255.0 10.2.3.176

  30. Brainslug says:

    Thanks much for the quick reply!
    Makes sense, I’ll see if I can get the ASA admin to set up proper routing for me.

    Much appreciated!

  31. they belong to the same vlan , i also have an access list on the L3Sw , do you think that this could influence the layer 2 traffic between thees L2 Switches ?

  32. Blog Admin says:

    You must have trunk connections between the L2 sw and the L3 sw. Also, the vlans must be created on the L2 switches and on the L3 switch as well.

  33. Hi,

    Really Great Article. I just purchased your ebooks last night.

    Here is my configuration: Pretty much above diagram.

    I’m using 3 cisco 4948 switches and 3 vlans.

    vlan 25 : 10.10.25.0/24
    vlan 35: 10.10.35.0/24
    vlan 45: 10.10.45.0/24

    One of them – switch1, I have assigned ip address:

    vlan 25: 10.10.25.1
    vlan 35: 10.10.35.1
    vlan 45: 10.10.45.1

    ASA : 10.10.25.200

    I am trunking and passing all these vlan to switch2 and switch3. Switch 2 and Switch3 are like layer 2 switch.

    I have the following statement in my switch1:
    ip route 0.0.0.0 0.0.0.0 10.10.25.200

    Everything is working fine. But my problem is all vlan is communicating with each other. For example: Host A on Vlan 25 is communicating with vlan 35, and vlan 45. I don’t want vlan to communicate with each other. I have ip routing enabled on switch. I can’t disabled IP routing because then traffic doesn’t pass to ASA. I think, I can prevent vlan communicate with each other using ACL on VLAN interface. I don’t know how to creat ACL. Can you give ACL based on my above configuration?

    Thanks.

  34. Blog Admin says:

    Rahul,

    You can block traffic between vlans with access lists on the layer3 switch.

    Example: On switch 1 create the following access-list:

    access-list 101 deny ip 10.10.25.0 0.0.0.255 10.10.35.0 0.0.0.255
    access-list 101 deny ip 10.10.25.0 0.0.0.255 10.10.45.0 0.0.0.255
    access-list 101 permit ip 10.10.25.0 0.0.0.255 any

    Then under the layer3 vlan apply the ACL:

    ip access-group 101 in

  35. Thanks for quick reply. I’ll try them out. Thanks.

  36. scnthil says:

    Hello

    L3 switch 24 port 1 number
    L2 switch 24 port 15 number

    In L2 switch each one has a total 15 vlan ( total 15 L2 switch and total 60 vlan)
    How to communicate layer 3 switch and firewall

  37. Pankaj Agrawal says:

    If i want to send traffic from vlan 10 to vlan 20 then this traffic will go to FW or not ? Pls explain traffic flow from one VLAN to another(FW will come in to picture or not).

  38. Blog Admin says:

    Pankah,

    Traffic between Vlan10 to Vlan20 will NOT pass through the firewall. It will pass from the switch only. Traffic going out to the internet will only pass through the firewall.

  39. Michel Tan says:

    I came across the blog, and it seems like you’ve answer my question, however, I still can get my setting to work.

    Internet—ASA—-Catalyst 3560G——Vlan 10, Vlan 20, Vlan 30———hosts.

    I followed your directly exactly. I can ping to different hosts on different vlans without any problems, but when trying to go out into the interent, i am not able. Can you tell me what I am doing wrong?

  40. Blog Admin says:

    Michel,

    The problem is probably a routing issue on the ASA. You must configure a static route on the ASA to reach the inside networks. For example, to reach subnet 10.10.10.0/24 from the ASA, you must have a static route like:

    route inside 10.10.10.0 255.255.255.0 10.0.0.1

  41. Hi Great Blog. Can you help me with this issue I’m having. Thanks for the help.

    Internet – ASA – 3750 – VLAN 1, VLAN 10,VLAN20,VLAN30,VLAN40,VLAN50

    Running EIGRP on ASA and 3750

    I can route between VLANS just fine. But only VLAN1 can browse the Internet via the ASA.

    VLAN 1 on 3750 172.16.1.1/24

    3750 SWITCHPORT G1/0/1 on VLAN1 connected to ASA g0/1 interface 172.16.1.3/24

    on ASA

    g0/0 outside (192.168.1.30) (dhcp from DSL Modem)
    g0/1 Inside 172.16.1.3 connected to 3750 g1/0/1

    global (Outside) 1 interface
    nat (Inside) 1 0.0.0.0 0.0.0.0

    static route 0.0.0.0 0.0.0.0 192.168.1.254 (DSL MODEM IP)

  42. Blog Admin says:

    Johny,

    It seems that there is a routing problem. The ASA maybe can’t see the other inside network (vlan 10, 20 etc). Do a “show route” on ASA to see if it has knowledge of the internal networks. If not, you can configure static routes or fix the EIGRP.

  43. Thanks for the direction, it turns out it was EIGRP. I did a no auto sum on all the network devices and poof I’m able to browse on on VLAN’s. Thanks for the help.

    Johnny

  44. Ivan Ivanov says:

    In your diagram, if you have web server at VLAN10 with IP of 10.10.10.80.
    How can you expose it for internet access through the ASA outside IP address since the asa is not directly connected to VLAN10?

  45. Harris Andrea says:

    Ivan,
    It doesn’t matter if the ASA is not directly connected to vlan 10. You just configure normal static NAT on ASA between (inside,outside) interfaces even if the inside interface is not directly connected to vlan 10. Traffic from Vlan10 hosts is considered “inside” traffic.

    Harris

Speak Your Mind

*