Access local VLANs from ClientVPN

[Diniguez]

Hi,

We have an MX connected to a MS and then, to an ISR.

MX <--> MS <--> ISR

The ISR is our Voice Gateway, which is VLAN 30 (IP = 10.10.30.1), and it has a Management interface which stands in VLAN 10 (IP = 10.10.10.1).

In order to access our voice vlan from the ClientVPN, I added a static route in the ISR with:

ip route 192.168.102.0 255.255.255.0 10.10.30.254

where 192.168.102.0 is our ClientVPN subnet and 10.10.30.254 is the MX IP for VLAN 30.

Everything good so far, but if I try to access the ISR's management interface I get this error in the MX log:

The only way that I achieved to make it work, is adding a second static route like this:

ip route 192.168.102.0 255.255.255.0 10.10.10.254

where 10.10.10.254 is the MX IP.

My question is, how can I reach both subnets without adding two static routes?

[PhilipDAth · Accepted solution]

If you only need to get to the management interface on the ISR, only add the second default route.

ip route 192.168.102.0 255.255.255.0 10.10.10.254

You would make this much simpler if the ISR used a single interface, or you only attached the MX to one of the interfaces connected to the ISR.

[Diniguez]

So is not possible to have a single static route in the ISR and make it work for both VLANs?

[DensyoV]

Hi,

The connectivity between the MS and the ISR, can you make it an access port on VLAN 10? The alert detects the MAC address is sending using VLAN 30 IP 10.10.10.1 but from MX's perspective, this should be VLAN 10 network. 

Thanks,

[Diniguez]

But I have some computers attached to phones, so I guess the link between the MS and ISR should be trunk, isn't it?