EMS 2010 routing problem inter vlan

Similar Questions

• Problem of trunking routing\802.1 Q inter - VLAN SGE2000P - Cisco 2821

  I am to evaluate the EMS and is unable to get routing inter - VLAN to work on aid and the external router via a 802. 1 q trunk. I have a 2821 with 3 secondary interfaces and I use the VLAN 1 as the VLAN native. G0/0 on router is connected to the port of G1 to the port of the EMS. I can create a VLAN and devices in the VLANs can reach devices in their VLAN respective, but they can't get the router IP address to access the other subnets. Currently I have the port connected to the configuration of the router, as a trunk by using VLAN 1, which is not marked. The EMS has the latest firmware and I tried some types of access ports, general & trunk, changed the PVID, nothing has worked for the other ports on the switch. What would have taken two minutes on a Cisco Configuration switch left flabbergasted me, it could be a defective switch? I was not able to find documentation or examples of this configuration scenario.

  For reference, config the router interface:

  G0/0.1

  encapsulation dot1q 1 native

  IP 1.1.1.1 255.255.255.0

  G0/0.2

  encapsulation dot1q 2

  2.2.2.1 IP address 255.255.255.0

  G0/0.3

  encapsulation dot1q 3

  3.3.3.1 IP address 255.255.255.0

  Any help\direction is appreciated.

  Thank you

  Burt

  Burt Hello, good evening,

  Have you included the VLAN 2 and 3 on the trunk port and ensured that they are labeled?  It should be set to tagged.  The Web interface can be confusing with this config / operation.

  Please check this and let me know, and if necessary I'll lab this for you as well.  Please let me know,

  Andrew

• Problem with routing inter - VLAN... How to solve it?

  Hi all.

  I have a WRVS4400N in my office to have a VPN with our main customer and also to manage the entire network of small size.

  In two weeks, more or less we will change our office somewhere else, merge two in one.

  At its new location, we will have two different ADSL connections, and we will keep our separate LAN to the other LAN.

  The goal is to interconnect the two local networks in order to 'see' the machines on one local network to another, but keep the two local networks with their current configuration, subnet, etc..

  To achieve this, I created a new VLAN on the router and I have attached only port4 to this VLAN.

  

  

  As you can see, VLAN main has its own/24 subnet (10.148.145.0/24) and dhcp enabled (for addresses on my LAN) while the new VIRTUAL local network has its own 24 subnet too (10.0.0.0/24) but with the disabled dhcp (is a different LAN with its own DHCP server).

  

  

  

  

  VLAN 1 use ports 1-3 and VLAN 2 use the single port 4.

  Of course, I enabled routing inter - VLAN:

  

  To emulate the future scenario, I connected a router with an Internet port 4 with IP:10.0.0.2, and I therefore two different local networks.

  Well, the reality is this:

  -From my PC connected to the VLAN1 I have an IP address (assigned by my Cisco) and I see all my VLAN and I see 10.0.0.1 too (IP of the router on VLAN2), but I don't see any more (pings to 10.0.0.2 didn't answer). I can access Cisco router to 10.0.0.1 and 10.148.145.97.

  -My PC connected to the VLAN2 I have an IP address (assigned by the other router on 10.0.0.2), I see only my VLAN (10.0.0.0/24 IPs). I can access only Cisco router to 10.0.0.1.

  How can I do to enable these two VLANS to 'see' each other?

  How can I control access to the WAN port? I don't want machines to VLAN2 accessing internet through our router.

  Thank you and best regards!

  Hello Francisco,.

  In router mode gateway mode switch will turn off the NAT on the router. Which will allow to the vlan 2 does not to get out to the internet but also vlan 1 and which is not what you want. You may be able to create access rules and deny rules for not being able to get out of the internet... may create some default of the rules of the road as 0.0.0.0. Also, you may be able to create internet air to stop a certain subnet that it is able to get out of the internet as well.

  Regarding the VLAN talk to each other, everything looks good, routing inter - vlan, it is allowing the two VLAN to talk to each other and which is activated. What your default gateways are installed on devices you are testing? As long as default gateways on your PC and devices are pointing to the routers ip/gateway address, you should be good to go at this point.

  VLAN 1: default gateway should be 10.148.145.97

  VLAN 2: default gateway must be 10.0.0.1

  Other than that everything seems to be implemented correctly based on the images. The VLANs that you put in place on the ports are correct.

  Let me know your devices are configured on the rise and will go from there.

  Hope this helps,

  Thank you

  Clayton Sill

• No SG300-52 routing inter - VLAN

  Hello

  I have a base on this SG300-52 configuration:

  • L3 is enabled
  • Latest Firmware is installed (1.4.0.88)
  • Vlan1 IP is 10.0.0.1/24
  • A PC is connected to port 1 (with IP 10.0.0.3)
  • VLAN99 IP is 192.168.0.2/29
  • A router is connected to the 49 port (with the 192.168.0.1 IP address and Internet access to the router is OK)
  • On SG300-52 default gateway is 192.168.0.1

  The SG-300:

  • I can ping the default gateway (192.168.0.1) and any Internet address, using 192.168.0.2 as address IP Source
  • I can't ping the default gateway (192.168.0.1) or any Internet address, using 10.0.0.1 as address IP Source
  • I can ping my PC (10.0.0.3), using 10.0.0.1 as the IP Source address
  • I can't ping my PC (10.0.0.3), using 192.168.0.2 as address IP Source

  There is no routing inter - VLAN, but I can't find how to activate...

  The complete configuration is the following:

  #show run SG300-52
  config-file-header
  SG300-52
  v1.4.0.88 / R800_NIK_1_4_194_194
  CLI v1.0
  router adjustment system mode

  SSD of encrypted file indicator
  @
  SSD-control-start
  config of SSD
  control of password file unrestricted SSD
  no control of the integrity of the file ssd
  SSD-control-end cb0a3fdb1f3a1af4e4430033719968c0
  !
  database of VLAN
  VLAN 99
  output
  Add a voice vlan Yes-table 0001e3 Siemens_AG_phone___
  Add a voice vlan Yes-table 00036 b Cisco_phone___
  Add a voice vlan Yes-table 00096e Avaya___
  Add a voice vlan Yes-table 000fe2 H3C_Aolynk___
  Add a voice vlan Yes-table 0060 b 9 Philips_and_NEC_AG_phone
  Add a voice vlan Yes-table 00d01e Pingtel_phone___
  VLAN voice Yes-table add Polycom/Veritel_phone___ 00e075
  Add a voice vlan Yes-table 00e0bb 3Com_phone___
  Hello interface range vlan 1
  hostname SG300-52
  username privilege 15 c464af817287343305cbd6493c593885695df531 encrypted password cisco
  property intellectual ssh server
  Server SNMP Server
  The telnet server IP
  !
  interface vlan 1
  the IP 10.0.0.1 255.255.255.0
  no ip address dhcp
  !
  interface vlan 99
  name WAN
  IP 192.168.0.2 255.255.255.248
  !
  interface gigabitethernet49
  switchport mode general
  VLAN allowed switchport General add 99 unidentified
  switchport General pvid 99
  !
  output
  Default IP gateway 192.168.0.1

  You have an idea on the issue?

  Thanks in advance for your help.

  Hi Anthena1390

  My email is [email protected] / * /. When you reply to the email can let me know which devices need to communicate on VLAN 99. Is there a major reason for SG300 happen DHCP assumes that your router? Well I would like to add a few screenshots, they will show you how to properly set up a P2p link, assign DHCP pools, how to correctly add default routes. Send an email and lets get your problem is resolved.

• RV180 router: impossible to get Inter-VLAN routing to work.

  I've been hit in this now for two days and just can't get Inter-VLAN routing to work on this router.

  Here is the place is:.

  Updated to the latest firmware of Cisco (1.0.1.9).
  From default settings, I added 2 VLAN as follows:

  VLAN (id = 1) default: dhcpmode = port IP=192.168.1.1/24 from server 1
  VLAN vlan2 (id = 2): dhcpmode = port IP=192.168.2.1/24 from Server 2
  VLAN vlan3 (id = 3): dhcpmode = port IP=192.168.3.1/24 Server 3

  (without link)
  WAN port
  |
  Routing/NAT
  |
  --------------------------------------
  VLAN ip 192.168.1.1 192.168.2.1 192.168.3.1
  name of VLAN by default vlan2, vlan3
  VLAN id ID = 1 ID = 2 ID = 3
  Inter-VLAN only routing Yes Yes
  Excluded excluded unidentified 1 port
  2 excluded excluded Untagged port
  Port 3 unmarked excluded except
  Port 4 (not interest) without excluded tag excluded
  ---------      --------     --------
  1 2 3 Port port
  |              |            |
  AdminPC PC3 PC2
  192.168.2.191 192.168.3.181

  PC2 is assigned an IP address of 192.168.2.191 (DGW = 192.168.2.1) - OK
  PC3 is assigned an IP address of 192.168.3.181 (DGW = 192.168.3.1) - OK

  (IP 192.168.2.191) PC2 can ping 192.168.2.1 and 192.168.3.1 - OK
  (IP 192.168.3.181) PC3 can ping 192.168.3.1 and 192.168.2.1 - OK

  BUT...
  PC2 cannot ping PC3 - don't DO NOT WORK
  PC3 can not ping PC2 - don't DO NOT WORK

  (does not work in gateway and router Mode)

  CAN SOMEONE HELP ME UNDERSTAND WHY?

  Your help is very appreciated.

  I bought this unit specifically because she supported routing inter - VLAN!

  Vlaminck

  ---------------------------------------------------------------------------

  Support information:

  Screenshots:
  Belonging to a VLAN:
  VLAN ID Description Inter VLAN device Port 1 Port 2 Port 3 Port 4
  Routing Mgment
  1 default disabled enabled unmarked excluded excluded unlabeled
  2 active active VLAN2 excluded unmarked excluded excluded
  Unmarked 3 VLAN3 active active excluded excluded excluded

  Several subnets VLAN:
  VLAN ID IP address Subnet Mask DHCP DNS Proxy Mode status
  1 192.168.1.1 255.255.255.0 DHCP Server enabled
  2 192.168.2.1 255.255.255.0 DHCP Server enabled
  3 192.168.3.1 255.255.255.0 DHCP Server enabled

  Routing table (Bridge Mode)

  Destination Gateway Genmask Metric Ref use Interface Type flags
  127.0.0.1 127.0.0.1 255.255.255.255 1 0 0 static lo upward, gateway, host
  192.168.3.0 0.0.0.0 255.255.255.0 0 0 0 dynamic bdg3 to the TOP
  192.168.2.0 0.0.0.0 255.255.255.0 0 0 0 dynamic bdg2 upward
  192.168.1.0 0.0.0.0 255.255.255.0 0 0 0 static bdg1 to the TOP
  192.168.1.0 192.168.1.1 255.255.255.0 1 0 0 static bdg1 upward, gateway
  127.0.0.0 0.0.0.0 255.0.0.0 0 0 0 lo dynamic

  Routing table (router Mode)

  (Ditto)

  Hello

  It's not because the pings are allowed on the same subnet that they come from a different subnet.

  You probably have a firewall problem windows software because that by default, it removes a different subnet icmp echoes.

  Concerning

  Alain

  Remember messages useful rate.

• Catalyst 6500 Inter-VLAN routing

  I have a Cisco 6500 switch and I have a question about routing inter - vlan and the command "IP ROUTING".  I use dial-up virtual interfaces (I.e. int vlan 2, int vlan 3, etc.), but I noticed that I don't have the IP ROUTING enabled on my switch but I can route properly between the VLANS.  I have even a little ports that I have configured with the command "no switchport" and I assigned an IP address to these ports.  On routed ports, there is another switch on the other side configured with an IP address and I am able to ping and route traffic to the other network.

  I did some research on this and all the documentation I am able to find talk of how you must enable IP ROUTING to route between the VLANS.  I guess that this should only be done if you go to the road to other not directly connected networks.

  http://www.ccnpguide.com/CCNP-switch-642-813-inter-VLAN-routing/

  http://www.Cisco.com/c/en/us/TD/docs/iOS-XML/iOS/lanswitch/configuration/12-2Sx/lsw-12-2Sx-book/lsw-VLAN-cfg-RTG.html#GUID-F5181D47-F44E-4F01-92E4-9132097BA333

  Can someone clarify this for me?

  For the 6500 Series, IP routing is enabled by default, that so all VLAN can communicate with each other.  You don't need to activate as you do for other switches (IE 3560, 3750, 3850, etc...)

  HTH

• RV042G router - Inter VLAN

  RV042G router - Inter VLAN:

  Is this router supports 802. 1 q? Or do I have to connect to a router port by VLAN?

  for example. If I have 2 VLANS configured on a SINGLE SWITCH, do:

  (a) TRUNK VLAN switch and plug a port on the ROUTER?

  (b) connect a port on the ROUTER to VLAN1 and another port to VLAN2?

  Thank you

  Henrique

  Hello Henrique,

  The RV042G is not compatible 802. 1 q Trunking, so you would need a VIRTUAL local network connection.

  According to the switch, you may need to disable the tree covering both to make multiple connections to the same router work.

  Hope that helps,

  Christopher Ebert - Advanced Network Support Engineer

  Cisco Small Business Support Center

  * Please note the useful messages *.

• Inter vlan routing on a Cisco SF 300-24 port switch only no internet except when scanning with wireshark

  Hello

  I'm get inter vlan routing to work on a 300-24 ports switch DF.    I have a network of business existing on 192.168.111.0 and want to create a vlan on 192.168.1.1 which can talk to 192.168.111.0.    I activated the layer 3 routing on the switch through the console and also provided ip routing commands. I have the following VIRTUAL networks:

  Vlan1 - default 192.168.111.0

  VLAN2 - 192.168.1.0

  I turned on DNS and provided my two servers DNS 192.168.111.82 & 192.168.111.212.

  I updated the VLAN1 interface 192.168.111.217 and VLAN2 interface 192.168.1.1.

  The FE1 - FE15 ports are access ports and assigned to VLAN1 (unidentified)

  FE16 - FE24 ports are access ports and assigned to VLAN2 (unidentified)

  I put a default route for the switch to 0.0.0.0 0.0.0.0 192.168.111.254 (router Draytek 2600). I have connected a computer (A) at the port of VLAN1 FE3 and a computer (B) to VLAN2 FE16 port.   I put its IP address and computer default gateway has to 192.168.111.217 to 192.168.111.94.    I updated computer B default gateway 192.168.1.1 and 192.168.1.2 IP.

  Computer A has access to the Mdaemon Server files via the network grows but no internet (cannot ping google) and can ping computer B and RDP on computer B.

  Computer B can ping computer A and RDP on A computer but do not have access to the company network i.e. MDaemon, file server etc.   It can also access the internet.

  The console I can ping www.google.co.uk and all the ip addresses in the network of the company i.e. 192.168.111.82 (DNS server).   I do not understand what I am doing wrong and have been banging my head for staretd a few days a new job and desperately need to work so any help would be greatly appreciated

  If I have computer scanner a wireshark wirh internet starts working wheird!

  Show the configuration below:

  switch7c0a71 #show run

  database of VLAN

  VLAN 2

  output

  Add a voice vlan Yes-table 0001e3 Siemens_AG_phone___

  Add a voice vlan Yes-table 00036 b Cisco_phone___

  Add a voice vlan Yes-table 00096e Avaya___

  Add a voice vlan Yes-table 000fe2 H3C_Aolynk___

  Add a voice vlan Yes-table 0060 b 9 Philips_and_NEC_AG_phone

  Add a voice vlan Yes-table 00d01e Pingtel_phone___

  VLAN voice Yes-table add Polycom/Veritel_phone___ 00e075

  Add a voice vlan Yes-table 00e0bb 3Com_phone___

  interface vlan 2

  IP 192.168.1.1 255.255.255.0

  output

  interface vlan 1

  IP 192.168.111.217 255.255.255.0

  output

  IP route 0.0.0.0 0.0.0.0 192.168.111.254

  interface vlan 1

  no ip address dhcp

  output

  Hello interface range vlan 1

  hostname switch7c0a71

  No complexity of passwords allow

  No server snmp Server

  interface fastethernet1

  switchport mode access

  output

  interface fastethernet2

  switchport mode access

  output

  interface fastethernet3

  switchport mode access

  output

  interface fastethernet4

  switchport mode access

  output

  interface fastethernet5

  switchport mode access

  output

  fastethernet6 interface

  switchport mode access

  output

  interface fastethernet7

  switchport mode access

  output

  interface fastethernet8

  switchport mode access

  output

  interface fastethernet9

  switchport mode access

  output

  interface fastethernet10

  switchport mode access

  output

  interface fastethernet11

  switchport mode access

  output

  interface fastethernet12

  switchport mode access

  output

  interface fastethernet13

  switchport mode access

  output

  interface fastethernet14

  switchport mode access

  output

  interface fastethernet15

  switchport mode access

  output

  interface fastethernet16

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet17

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet18

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet19

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet20

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet21

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet22

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet23

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface fastethernet24

  switchport mode general

  VLAN allowed switchport General add 2 unidentified

  output

  interface vlan 2

  name of development

  output

  Hi Richard,

  43 - permit Protocol: any / all

  42 - Protocol deny EVERYTHING 192.168.2.0 0.0.0.255-> to 192.168.111.0 0.0.0.255

  41 - Protocol to deny ALL 192.168.111.0 0.0.0.255-> to 192.168.2.0 0.0.0.255

  40 allow the RDP Protocol TO ALL

  etc.

  To block everything, including MSSQL, with the exception of the RDP and other ports that you defined above.  The other defined are simply not the RDP Protocol and service work?

  Richard, do note useful messages and identify the right answers.

  Best,

  David

• Restricted Inter-VLAN with SG200-26 and SG300-10 routing

  Hi all

  My apologies if this has been covered elsewhere.

  My organization would like to organize a LAN game activity. The installation program I have in mind involves a switch 24 ports to connect all computers in player and saw that the switch connected to a smaller 'core' which has the connected the router and game server. I would like to know if I can put things up as follows...

  SG200-26 with 1 to 24 ports on VLANS separated so they can talk to eachother. I'd then ports 25 and 26 to be a trunk aggregated (for bandwidth and redundancy) port to carry all 24 VLAN more an additional management VLAN (VLAN 100 e.g.) that will be used to access the switch. I want these aggregated trunk ports to connect to a 'core' SG300-10 switch that is connected to the game server and a router for internet access.

  I would like to than the possibility of having two network connections of the server to the switch, one on the management of VLANS and the other on a VLAN different (e.g. 50 VLAN) which will be accessible by players (ports 1-24 of SG200-26). The power switch needs to be able to perform routing inter - VLAN restricted, because it does not VLAN 1-24 of eachother talk but they can talk to VLAN server, but only through specific service ports (e.g. 12345, 12346 port). Is this possible?

  Also how I configure the SG300-10 to enable the VLAN 1-24 of VLAN 50, but not to talk or VLAN 100. So, I will probably have the router on its own LAN VIRTUAL (VLAN 60 ex.) and allow for VLAN 1-24 for access, but only via HTTP port 80 for web access.

  What do you think?

  Thank you.

  Hi Marc, the default gateway of the computers will be the SVI to the switch.

  Router-> couche3-> SG300 layer 2 SG300

  router is 192.168.1.1

  VLAN 1 in 300 SG is 192.168.1.100

  2 VLAN on 300 SG is 192.168.2.1

  SG300 layer 2 has a 1u, 2 t trunk.

  My computer to connect to an access port 2 unidentified on the layer 2 SG300.

  I am able to ping 192.168.2.1

  I am able to ping 192.168.1.100

  I can not 192.168.1.1 pnig

  The reason is that the router has no idea on this subnet so cannot send the package to the source 192.168.2.x subnet.

  The ACL and the basic connection are 2 different animals. The ACL is to prevent intervlan communication. The basic connection must be tags trunk and vlan or static routes.

  -Tom
  Please mark replied messages useful

• RV110W inter-VLAN-routing is not possible

  In Cisco RV110W, I set up 2 VLANS, a 192.168.1.xxx (Green Net) and the second with only a fixed address 192.168.2.100 192.168.2.xxx (Server), which is configured in the DMZ area. I enabled in Cisco "inter-VLAN-Routing", described "routing between separate VLANs on Cisco RV110W" I can Ping the server in a direktion, the other I got an error. It is just expected and ok! All other abilities expected work well!

  Now, I want to see the Green network server. (firewall on the server is off)

  I configured the network/router with exactly the values of the index and has been an error: "destination LAN IP may not be the same as the router's IP subnet.

  Sorry, I don't understand this. Can anyone help?

  Thank you in anticipation

  Anton

  

  If I understand correctly, you have a second vlan, 192.168.2.x. The RV110W is a member of this subnet so that's why we do not have a static route for something that the router knows that she welcomes this subnet.

  -Tom
  Please evaluate the useful messages

• SG 300 - Inter VLAN

  Salvation of the forumers

  My problem statement

  a. how to let a single switchport to transport the vlan voice and data of vlan?

  say I had create and configure the vlan (20) voice and data of vlan (10)

  first of all, I do like this (join the voice vlan.png)

  What should I do

  A1. Management port for VLAN, VLAN

  (define the interface as General, but then should I check PVID, tag or remove the brand?)

  A2. Management VLAN-VLAN to the Port

  (is it leaves vlan 10 and vlan 20 to join the switchport?)  (Attach it VLAN to Port.png)

  b. is this done switch "ip Routing" for inter routing VLAN?

  say I create him VLAN, assign the IP address of the virtual interface for it. Have to do to activate routing inter - VLAN?

  I have check the static route only switch IPv4, is that it need a manual to create the static route to reach subnet each VLAN?

  can c. that be NTP server?

  Thank you

  Noel

  Hello!

  a. create a vlan 10 (data) and vlan 20 (voice). Set the switchport where you have an IP phone that is attached to the Trunk mode (management of Vlan-> settings of the Interface). Administrative PVID of the port should be 10. Go to the management of VLAN-> a Port VLAN membership, select the switchport and click Join VLANS. In the right column, you should have '10UP' (VLAN 10 Untagged, PVID: 10). In the left column select 20, labelling must be tagged, click the right arrow button to add 20 VLAN Tag to the port and click on apply.

  These settings will make switchport transfer VLAN10 traffic (data) as non-identified and VLAN20 traffic as added to the phone the voice. In each case, your phone, if it has a PC in the Appendix must be configured for voice traffic with the tag VLAN20 tag and move unidentified to the PC data traffic. Voice of preserve settings VLAN as shown on the screenshot - he let the switch to assign the optimal settings of QoS for traffic vlan voice.

  b. If you have the latest firmware installed routing Inter VLAN is enabled by default. Simply create interfaces SVI (assign an IP address to the VIRTUAL local area network interface) and if you have at least a host connected to the switchport member of the VLAN, the road to this subnet will automatically appear in the switch routing table. If you have multiple VLANs with the affected IP addresses and hosts active on these VLAN - all these networks appears in the table of routing as being directly connected and hosts all the VLANS will be able to communicate with each other. You must restrict the Inter-VLAN communication - use IP ACL.

  c. No, the switch can be SNTP client only.

• InterVLAN routing problem

  Hi friends,

  I have a question related to the Inter-VLAN routing. I have 2 switch a 3850 L3 and another is 2960 L2 (Pure L2). I even vlan on both switches and IP routing enabled on switch L3. But not woking switch l3 to L2 Intervlan Routing switching systems.

  Configuration as below:

  L3 switch:

  hostname L3

  !

  IP routing

  !

  pvst spanning-tree mode

  !

  interface FastEthernet0/1

  switchport access vlan 7

  spanning tree portfast

  !

  interface FastEthernet0/2

  !

  interface FastEthernet0/3

  !

  interface FastEthernet0/4

  !

  interface FastEthernet0/5

  !

  interface FastEthernet0/6

  !

  interface FastEthernet0/7

  !

  interface FastEthernet0/8

  !

  interface FastEthernet0/9

  !

  interface FastEthernet0/10

  !

  interface FastEthernet0/11

  !

  interface FastEthernet0/12

  !

  interface FastEthernet0/13

  !

  interface FastEthernet0/14

  !

  interface FastEthernet0/15

  !

  interface FastEthernet0/16

  !

  interface FastEthernet0/17

  !

  interface FastEthernet0/18

  !

  interface FastEthernet0/19

  !

  interface FastEthernet0/20

  !

  interface FastEthernet0/21

  !

  interface FastEthernet0/22

  !

  interface FastEthernet0/23

  !

  interface FastEthernet0/24

  Are connected to the L2 switch

  switchport trunk encapsulation dot1q

  switchport mode trunk

  !

  interface GigabitEthernet0/1

  !

  interface GigabitEthernet0/2

  !

  interface Vlan1

  no ip address

  Shutdown

  !

  interface Vlan2

  IP 1.1.1.1 255.255.255.0

  !

  interface Vlan3

  3.3.3.3 IP address 255.255.255.0

  !

  interface Vlan4

  4.4.4.4 IP address 255.255.255.0

  !

  interface Vlan5

  5.5.5.5 IP address 255.255.255.0

  !

  interface Vlan6

  6.6.6.6 IP address 255.255.255.0

  !

  interface Vlan7

  7.7.7.7 IP address 255.255.255.0

  !

  interface Vlan8

  8.8.8.8 IP address 255.255.255.0

  !

  interface Vlan9

  9.9.9.9 IP address 255.255.255.0

  !

  IP classless

  -----------------

  The L2 switch configuration:

  !
  hostname SwitchL2
  !
  !
  !
  !
  !
  pvst spanning-tree mode
  !
  interface FastEthernet0/1
  switchport access vlan 2
  !
  interface FastEthernet0/2
  !
  interface FastEthernet0/3
  !
  interface FastEthernet0/4
  !
  interface FastEthernet0/5
  !
  interface FastEthernet0/6
  !
  interface FastEthernet0/7
  !
  interface FastEthernet0/8
  !
  interface FastEthernet0/9
  !
  interface FastEthernet0/10
  !
  interface FastEthernet0/11
  !
  interface FastEthernet0/12
  !
  interface FastEthernet0/13
  !
  interface FastEthernet0/14
  !
  interface FastEthernet0/15
  !
  interface FastEthernet0/16
  !
  interface FastEthernet0/17
  !
  interface FastEthernet0/18
  !
  interface FastEthernet0/19
  !
  interface FastEthernet0/20
  !
  interface FastEthernet0/21
  !
  interface FastEthernet0/22
  !
  interface FastEthernet0/23
  !
  interface FastEthernet0/24
  switchport mode trunk
  switchport nonegotiate
  !
  interface GigabitEthernet0/1
  !
  interface GigabitEthernet0/2
  !
  interface Vlan1
  no ip address
  Shutdown
  !
  interface Vlan2
  1.1.1.2 IP 255.255.255.0
  !
  interface Vlan7
  IP 7.7.7.8 255.255.255.0
  !

  -------------------

  Note: I do not have any router.

  When I test the same setting on packet tracer then get error:

  1. the destination IP address is not the broadcast address, and it does not match the IP address of the port. The appliance ignores the packet.

  Please resolev question:

  Kind regards.

  Deepak Kumar

  I think that Reza questions 3 and 4 are more important than questions 1 and 2, but perhaps do not go quite far enough. The two switches to assign certain ports to a vlan specific and use the vlan by default for most of the ports. There are no statements on a switch which create the vlan but only statements that a port must Access a specified VLAN

  interface FastEthernet0/1

  switchport access vlan 7

  On some versions of switches that may be enough to create the vlan, but on other switches, it is necessary to create the vlan before using it. Maybe something like

  VLAN 7

  name server_vlan

  I would ask if the VLAN on each switch existence?

  There is another question in this config. The switches have created more than 3 VLANs (vlan 1 - the vlan by default and vlan 2 and vlan 7.) But the L3 switch configured more than one interface vlan (3, 4, 5, 6, 8, 9). Without a vlan underlying pertaining to these layer 3 interfaces vlan will not work.

  HTH

  Rick

• RV220W Inter VLAN firewall rules

  Hello

  I just bought RV220W Cisco router for our branch to replace Zywall 2 Plus.  Update to the latest firmware 1.0.5.8 device.

  I tried several different setting, but can not solve simple inter configuration of VLAN, that ZyWall resolves in a few clicks.

  I have a simple task: I need two VLAN isolated on my network (VLAN 1: 10.1.2.1 and VLAN10: 192.168.2.1). No movement between them VLAN is allowed. I have to configure several exceptions:

  1.) access of VLAN1 to Server (192.168.2.40) from VLAN10 port 3389 (RDP).

  2.) VLAN10 access to a network printer (10.1.2.10) on port 9100 VLAN1.

  I tried several settings and configurations of firewall that does not work.

  I tried inter VLAN (VLAN-VLAN) rules to block all traffic except permitted, but these rules don't change anything.  I have full access to one VLAN to another and vice versa.

  I tried to disable routing inter VLAN, which solve my task of isolation, but firewall interVLAN rules does not work for exceptions, I need.

  Thanks for all your help in advance.

  Hello

  For this configuration, you must first uncheck InterVlan routing for both VLAN (network > LAN > belonging to a VLAN). Also make sure that the ports are propely configured-tag/Untagged/excluded

  After that, he must create access rules 2 (Inter MELANIECARDENES (VLAN - VLAN))

  -from Defaul to VLAN10 - always allow - Source all - Destination 192.168.2.40

  -Since VLAN10 to Default - always allow - Source all - Destination 10.1.2.10

  There is no need to create rules to block, as it is by default and interVLAN routing is not enabled.

  If with this configuration you still do not have access to the server and printer, you can use Administration - diagnosis - capture the packets and Wireshark to track if the packets are routed properly through VLANs and where the string stops.

  Kind regards

  Bismuth

• Routing problem between the VPN Client and the router's Ethernet device

  Hello

  I have a Cisco 1721 in a test environment.

  A net 172.16.0.0/19 simulates the Internet and a net 192.168.1.0/24 simulates the net, the VPN tunnel must go to (intranet).

  The net 172.16.0.0 depends on the router 0 FastEthernet, Intranet (VPN) hangs on Ethernet 0.

  The configuration was inspired form the sample Configuration

  "Configuring the Client VPN Cisco 3.x for Windows to IOS using Local extended authentication"

  and the output of the ConfigMaker configuration.

  Authentication and logon works. Client receives an IP address from the pool. But there's a routing problem

  side of routers. Ping client-side - do not work (the VPN client statistics that count encrypt them packets, but not to decrypt).

  Ping the router works too, but decrypt and encrypt customer statistics in VPN packets count progressive

  (customer has a correct route and return ICMP packets to the router).

  The question now is:

  How to route packets between the Tunnel and an Ethernet device (Ethernet 0)?

  conf of the router is attached - hope that's not too...

  Thanks & cordially

  Thomas Schmidt

  -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- snipp .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

  !

  version 12.2

  horodateurs service debug uptime

  Log service timestamps uptime

  encryption password service

  !

  !

  host name * moderator edit *.

  !

  enable secret 5 * moderator edit *.

  !

  !

  AAA new-model

  AAA authentication login userauthen local

  AAA authorization groupauthor LAN

  !

  ! only for the test...

  !

  username cisco password 0 * moderator edit *.

  !

  IP subnet zero

  !

  audit of IP notify Journal

  Max-events of po verification IP 100

  !

  crypto ISAKMP policy 3

  3des encryption

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group 3000client

  key cisco123

  pool ippool

  !

  ! We do not want to divide the tunnel

  ! ACL 108

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  !

  map clientmap client to authenticate crypto list userauthen

  card crypto clientmap isakmp authorization list groupauthor

  client configuration address map clientmap crypto answer

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  !

  interface Ethernet0

  no downtime

  Description connected to VPN

  IP 192.168.1.1 255.255.255.0

  full-duplex

  IP access-group 101 in

  IP access-group 101 out

  KeepAlive 10

  No cdp enable

  !

  interface Ethernet1

  no downtime

  address 192.168.3.1 IP 255.255.255.0

  IP access-group 101 in

  IP access-group 101 out

  full-duplex

  KeepAlive 10

  No cdp enable

  !

  interface FastEthernet0

  no downtime

  Description connected to the Internet

  IP 172.16.12.20 255.255.224.0

  automatic speed

  KeepAlive 10

  No cdp enable

  !

  ! This access group is also only for test cases!

  !

  no access list 101

  access list 101 ip allow a whole

  !

  local pool IP 192.168.10.1 ippool 192.168.10.10

  IP classless

  IP route 0.0.0.0 0.0.0.0 172.16.12.20

  enable IP pim Bennett

  !

  Line con 0

  exec-timeout 0 0

  password 7 * edit from moderator *.

  line to 0

  line vty 0 4

  !

  end

  ^-^-^-^-^-^-^-^-^-^-^-^-^- snapp ^-^-^-^-^-^-^-^-^-^-^-^-^-^-

  Thomas,

  Can't wait to show something that might be there, but I don't see here. You do not have the card encryption applied to one of the interfaces, perhaps it was not copied. Assuming your description you do it, or should it be, applied to the fa0 and you are connected. Try how you ping? Since the router or a device located on E0? If you ping the router, you will need to do an extended ping of E0 to the ip address of the client has been assigned. If your just ping the router without the extension, you will get sales and decrypts that you declare on the client. Have you tried to ping from the client to interface E0? Your default route on the router is pointing to fa0? You have a next hop to affect? You have several NIC on the client pc? Turn off your other network cards to check that you don't have a problem with routing on the client if you have more than one.

  Kurtis Durrett

• configuration of VLAN and routing problem 6224 switch

  I, m having a problem accessing internet to vlan 10. I can ping everything of all the VLANS. My internet router/firewall is on ethernet 1/g11 and has an ip address of 192.168.5.254. I have no problem accessing internet to vlan 20. I add a static route to my router/firewall. What Miss me? This is my first configure a layer 3 switch.

  Configure
  database of VLAN
  VLAN 10.20
  output
  battery
  1 1 member
  output
  IP 10.10.10.1 255.255.255.0
  default IP gateway - 10.10.10.254
  IP routing
  IP route 0.0.0.0 0.0.0.0 192.168.5.254
  interface vlan 10
  Routing
  IP 192.168.100.1 address 255.255.255.0
  output
  interface vlan 20
  Routing

  192.168.5.1 IP address 255.255.255.0
  output

  !
  interface ethernet 1/g1
  switchport mode general
  pvid switchport General 10
  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 10
  output
  !
  interface ethernet 1/g2
  switchport mode general
  pvid switchport General 10
  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 10
  output
  !
  interface ethernet 1/g11
  switchport mode general
  switchport General pvid 20

  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 20
  output
  !
  interface ethernet 1/g12
  switchport mode general
  switchport General pvid 20
  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 20
  output
  !
  interface ethernet 1/g13
  switchport mode general
  switchport General pvid 20
  No switchport acceptable-framework-type general tag only
  VLAN allowed switchport General add 20
  output
  output

  Route ip console #show

  The traffic code: R - RIP derived, O - OSPF derived, C - connected, S - static
  B - BGP derived, IA - OSPF Inter zone
  E1 - OSPF external Type 1, E2 - OSPF external Type 2
  N1 - OSPF NSSA external Type 1, N2 - OSPF NSSA external Type 2

  S 0.0.0.0/0 [1/0] via 192.168.5.254, vlan 20
  C 192.168.5.0/24 [0/0], directly connected, vlan 20
  192.168.100.0/24 C [0/0], directly connected, vlan 10

  Console #.