VLAN between two routers

Similar Questions

• Public static IPsec tunnel between two routers cisco [VRF aware]

  Hi all

  I am trying to configure static IPsec tunnel between two routers. Router R1 has [no VRF] only global routing table.

  Router R2 has two routing tables:

  * vrf INET - used for internet connectivity

  * global routing table - used for VPN connections

  Here are the basic configs:

  R1

  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  ISAKMP crypto key 7V7u841k2D3Q7v98d6Y4z0zF address 203.0.0.3
  invalid-spi-recovery crypto ISAKMP
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  !
  interface Loopback0
  10.0.1.1 IP address 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.34 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 203.0.0.3
  ipv4 ipsec tunnel mode
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP 102.0.0.1 255.255.255.0

  !

  IP route 203.0.0.3 255.255.255.255 FastEthernet0/0 102.0.0.2

  #######################################################

  R2

  IP vrf INET
  RD 1:1
  !
  Keyring cryptographic test vrf INET
  address of pre-shared-key 102.0.0.1 key 7V7u841k2D3Q7v98d6Y4z0zF
  !
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  invalid-spi-recovery crypto ISAKMP
  crypto isakmp profile test
  door-key test
  function identity address 102.0.0.1 255.255.255.255
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac TRSET_AES-256_SHA
  transport mode
  !
  Crypto ipsec TUNNEL-IPSEC-PROTECTION profile
  game of transformation-TRSET_AES-256_SHA
  Test Set isakmp-profile
  !
  interface Loopback0
  IP 10.0.2.2 255.255.255.255
  IP ospf 1 zone 0
  !
  interface Tunnel0
  IP 192.168.255.33 255.255.255.252
  IP ospf 1 zone 0
  source of tunnel FastEthernet0/0
  tunnel destination 102.0.0.1
  ipv4 ipsec tunnel mode
  tunnel vrf INET
  Ipsec TUNNEL-IPSEC-PROTEC protection tunnel profile
  !
  interface FastEthernet0/0
  IP vrf forwarding INET
  IP 203.0.0.3 255.255.255.0

  !

  IP route 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  #######################################################

  There is a router between R1 and R2, it is used only for connectivity:

  interface FastEthernet0/0
  IP 102.0.0.2 255.255.255.0
  !
  interface FastEthernet0/1
  IP 203.0.0.2 255.255.255.0

  The problem that the tunnel is not coming, I can't pass through phase I.

  The IPsec VPN are not my strength. So if someone could show me what mistake I make, I'd appreciate it really.

  I joined ouptup #debug R2 crypto isakmp

  Source and destination Tunnel0 is belong to VRF INET, the static route need to be updated.

  IP route vrf INET 102.0.0.1 255.255.255.255 FastEthernet0/0 203.0.0.2

  crypto isakmp profile test

  VRF INET

  door-key test
  function identity address 102.0.0.1 255.255.255.255

• IPsec VPN between two routers - mode ESP Transport and Tunnel mode

  Hi experts,

  I have this question about the Transport mode and Tunnel mode for awhile.

  Based on my understanding of 'Transport' mode is not possible because you always original "internal" private in the IP headers or IP addresses. They are always different as public IP on interfaces enabled with Crypto Card addresses. When encapsulated in the VPN tunnel, the internal IP addresses must be included or the remote VPN router won't know where to forward the packet.

  To test, I built a simple GNS3 with three routers laboratory. R1 and R3 are configured as VPN routers and the R2 must simulate Internet.

  My configs are also very basic. The R2 is routing between 1.1.1.0/24 and 2.2.2.0/24. It is defined as the gateway of R1 and R3.

  R1:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 2.2.2.2
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 2.2.2.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  ip permit 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255
  !

  R3:

  crypto ISAKMP policy 100
  BA aes
  preshared authentication
  Group 2
  ISAKMP crypto key 123456 address 1.1.1.2
  !
  !
  Crypto ipsec transform-set ESP_null null esp esp-sha-hmac
  !
  10 map ipsec-isakmp crypto map
  defined peer 1.1.1.2
  transformation-ESP_null game
  match address VPN

  !

  list of IP - VPN access scope
  Licensing ip 10.0.0.0 0.0.0.255 192.168.1.0 0.0.0.255

  I configured transform-"null" value, while it will not encrypt the traffic.

  Then I tried the two 'transport' mode and mode "tunnel". I ping a host in the internal network of the R1 to another host in the internal network of the R3. I also tried 'telnet'. I also captured packets and carefully compared in both modes.

  Packets encapsulated in exactly the same way!

  It's just SPI + sequence No. + + padding

  I will attach my screenshots here for you guys to analyze it. I would be grateful for any explanation. I confused maybe just when it comes to the NAT...

  I guess my next step is to check if the two modes to make the difference when the GRE is used.

  Thank you

  Difan

  Hi Difan,

  As you point out the mode of transport is not always applicable (i.e. applicable if IP source and destination is equal to corresnpoding proxy IDs).

  A typical scenario in this mode of transport is used:

  -Encryption between two hosts

  -GRE tunnels

  -L2TP over IPsec

  Even if you set "transport mode" this does not mean that it will be used. IOS routers and I blieve also ASA will perform backup even if the mode of transport is configured but does not apply in tunnel mode.

  I can take a look at your traces to sniff, but all first can you please check if you transport mode on your ipsec security associations? "See the crypto ipsec his" exit you will show the tunnel or transport mode.

  HTH,

  Marcin

• VLAN between two hosts ESXi

  Hello

  I have two virtual machines based on VMware and some configuration of VLAN

  VM1 - VLAN 130 on ESXi01

  VM2 - VLAN 135 on ESXi02

  For example, a machine of vlan ESX1 130 cannot ping a VM one another in the vlan ESX2 130. But if I move the ESX1 second VM, it works.

  VM1 im going through vSwitch 130 VLAN via the ESXi01, what's happening than ESXi via vmnic11 port Vethernet910 on FABRIC

  FABRIC-001-B # connect nxos
  Operating system (NX - OS) Cisco Nexus software
  TAC support: http://www.cisco.com/tac
  Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
  The copyright in certain works contained in this software are
  owned by others and used and distributed under
  license. Some components of this software are licensed
  the GNU Public License (GPL) version 2.0 or GNU
  Lesser General Public License (LGPL) Version 2.1. A copy of each
  This license is available at
  http://www.opensource.org/licenses/GPL-2.0.php and
  http://www.opensource.org/licenses/LGPL-2.1.php
  Fabric-001-B (nxos) # sh ver

  Operating system (NX - OS) Cisco Nexus software
  TAC support: http://www.cisco.com/tac
  Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_h...
  Copyright (c) 2002-2014, Cisco Systems, Inc. All rights reserved.
  The copyright in certain works contained in this document are the property of
  other third parties and are used and distributed under license.
  Portions of this software are covered by the GNU Public
  License. A copy of the license is available at
  http://www.gnu.org/licenses/gpl.html.

  Software
  BIOS: version 3.6.0
  Charger: version N/A
  Kickstart: version 5.2 (3) N2(2.21c)
  system: version 5.2 (3) N2(2.21c)
  power-seq: Module 1: version v2.0
  Module 2: version v1.0
  Module 3: version v2.0
  uC: version v1.2.0.1
  SFP UC: Module 1: v1.1.0.0
  Compile of the BIOS time: 09/05/2012
  kickstart image file is: bootflash:///installables/switch/ucs-6100-k9-kickstart.5.2.3.N2.2.21c.bin
  Kickstart compile time: 05/02/2014 11:00 [05/02/2014 19:47:41]
  filesystem image is: bootflash:///installables/switch/ucs-6100-k9-system.5.2.3.N2.2.21c.bin
  compile time: 05/02/2014 11:00 [05/02/2014 21:42:39]

  Material
  Cisco UCS 6248 series fabric of interconnection ("O2 32X10GE/Modular universal platform supervisor")
  Intel Xeon CPU with 16553964 k of memory.
  Processor Board ID

  Device name: FABRIC-001-B
  bootflash: 31266648 kB

  The availability of the core is 147 day (s), 15 hour (s), 15 minute (s), 46 second (s)

  Last reset
  Reason: unknown
  The system version: 5.2 (3) N2(2.21c)
  Service:

  plugin
  Core Plugin Ethernet, Fc Plugin, Plugin, Plugin of virtualization
  Fabric-001-B (nxos) #.

  on NXOS, I see

  See the fabric-001-B (nxos) # run interface vethernet 910

  interface Vethernet910
  Description 1/3 Server, VNIC VNIC9
  switchport mode trunk
  switchport trunk allowed vlan 1 108-109 115-119 150 - 151
  pinning Server sticking border-interface port-channel13
  pinning of pinning-down server drop down link
  queues of default entry - type service-policy policy
  bind the interface port-channel1282 910 road
  no downtime

  and information portchannel

  Fabric-001-B (nxos) # sh port-channel summary
  Flags: D - low P - Up in the port-channel (members)
  I - individual H - standby (LACP only)
  s suspended r - Module-removal
  S - Dial R - routed
  U - up (port-channel)
  M not in use. Min-links not met
  --------------------------------------------------------------------------------
  Group-Type Port Protocol Ports members
  Channel
  --------------------------------------------------------------------------------
  11 Po11 (SU) Eth LACP Eth1/15 (P) Eth1/16 (P) Eth1/31 (P) Eth1/32 (P)
  13 Po13 (SU) Eth LACP Eth1/14 (P) Eth1/30 (P)
  1280 Po1280 (SU) Eth NO Eth1/1/13 (P) 1/Eth1/14 (P) 1/Eth1/15 (P) 1/Eth1/16 (P)
  1281 Po1281 (SU) Eth NO Eth1/1/1 (P) Eth1/1/3 (P)
  1282 Po1282 (SU) Eth NO Eth1/1/9 (P) Eth1/1/11 (P)
  1283 Po1283 (SU) Eth NO Eth1/1/5 (P) Eth1/1/7 (P)
  1284 Po1284 (SU) Eth NO Eth2/1/1 (P) Eth2/1/3 (P)
  1285 Po1285 (SU) Eth NO Eth3/1/1 (P) Eth3/1/3 (P)
  1286 Po1286 (SU) Eth NO Eth3/1/5 (P) Eth3/1/7 (P)
  1287 Po1287 (SU) Eth NO Eth3: 1/9 (P) Eth3/1/11 (P)
  1288 Po1288 (SU) Eth NO Eth3/1/13 (P) Eth3/1/14 (P) Eth3/1/15 (P) Eth3/1/16 (P)
  1289 Po1289 (SU) Eth NO Eth4/1/1 (P) Eth4/1/3 (P)
  1300 Po1300 (SU) Eth NO Eth1/1/17 (P) Eth1/1/19 (P)

  I have lack of VLAN, how can I edit and update the information of vlan?

  Of UCS Manager? I don't have 1000v.

  Hello

  To add VLANs, you must go to the LAN tab, create them and after that, add them to the vNIC of blades you want to pass traffic for that/those support VLAN.

  You have configured a VLAN in UCSM native?

  The two, ESXi01 ESXi02 & use the same fabric for interconnection to pass traffic?  If a host goes through A traffic and the other through B, traffic will need to visit the switch upstream as cause of tissue switches do not switch traffic between them.

  Try the commands below and paste it here:

  * show circuit of service X Server profile / Y< chassis/server="" in="">

  * Connect nxos one | b< first="" try="" "a"="" then="" "b"="" and="" the="" output="" of="" the="" below="" command="" for="">

  * sh pinning border-interfaces

  * See the platform flexible NHS inter vlandb of info id #.< "#"meaning="" the="" vlan="">

  -Kenny

• How to make a route between two routers (networks) connected to the same switch?

  Hello guys, how are you?

  In my company, we have 2 internet routers more dsl router of data connected to 1 switch line

  the data row is used to connect the branches of our company together for network problems.

  the router 192.168.2.1 IP data

  internet routers IP 192.168.1.1 - 57.194.97.1

  We have 3 accesspoints wireless taking their internet of 192.168.1.1 oky guy

  what I want to do is when I connect to any wireless network to connect to the data line dsl with router 192.168.2.1

  When I use the ethernet on my pc I have IP addresses 192.168.2.222 for router data line and 192.168.1.222 for internet

  but the wireless is DHCP n that it is connected only to 192.168.1.1, which is the internet router, how can I do 192.168.1.1 192.168.2.1 when I connect

  using the wireless?

  I hope that you understand me ^_^

  Thanks in advance.

  Hello

  The question you posted would be better suited to the TechNet community. Please visit the link below to find a community that will provide the support you want.

  http://social.technet.Microsoft.com/forums/en/category/w7itpro/

  Hope this information is useful.

• ASA balancing to two routers

  Hi all

  Is there anyway that I can balance workloads on both routers.

  I have an ASA with two attached routers each router has two instances of HSRP runs on each with its own IP address, each router is the main for one of the instances of HSRP. If there was no ASA in the way that I would set DHCP to browse through all of the functions of server through another hey presto (of sort) load balancing. However, I can't do what the ASA has only a single internal IP address. Routers treat natting because they are on different IP ranges on different Internet service providers.

  I can't use GLBP as the external IP evolution would break VPN RDP and SMTP connections.

  Is it possible that I can make the road ASA based on the source IP address, or any other means to separate the traffic between two routers?

  Thanks in advance,

  Scott

  You cannot route based on ip source with only firewall with router possiable by ACB

  You can give each of them point to router deffrent with metric deffrent from the static routes

  in this case, it will make the topology as active standby, which is not good in your case

  but you can use sub interfaces on your case make the ASA NRTIs each subinterface in deffrent subnet and deffrent security level

  and let each subinterface use deffrent hsrp instance

  or there is another way

  IF you are not using VPN on your ASA you can reach in the context of multiple

  in the context of several you're going to separate your firewall virtually

  so if you have two VLAN in your network (two subnets deffrent)

  then each subnet use almost deffrent firewall

  goona u divide the internal interface to two subinterfaces

  and you can use a shred of interface between the context outside or separate for two subinterfaces

  and assign these interface for each context

  If you go to each context as firewall deffrent

  and you can use the HSRP deffrent on each context instance

  but the multiple context, you can use VPN on the firewall

  Use the following method *.

  The OTHER WAY THAT ALSO I have SUGIST YOU to TRY, this IS THE Transparent firewall

  in the case your firewall works in L2 mode

  so you can use routers in HSRP IPS AS there is no firewall in the path

  which i thnk useful for you case also

  in transperant mode the way to defaultgate for your customer will be the hsrp IP because the firewall will not have everything except IPs management

  the useres will also be in the same IP subnet as the gateway in your case HSRP VIP

  and also, you can control the security of the network through the firewall normally

  try this way and let me know

  See the following link for the configuration

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008089f467.shtml

  Please, note useful

• Two routers on the same network wireless?

  Last night I bought a WRT160N, to replace my old WRT54G. The 160N is now in my room, connected to a cable modem. The 160N ethernet ports, I have a cable that goes from my room, through my attic and comes out in my living room. In my living room, I'm willing to hang the cable that comes from my 160N to my WRT54G. Then ports ethernet on my WRT54G, I want to connect my Playstation 3 and Xbox 360. I have this connected physically this way, but the PS3 does not connect to the internet through this wired connection. (Have not tried the Xbox 360)

  Basically, I'm eager to share the connection from my wall between my PS3 and the Xbox 360 so that they both have wired connections. Also, I would like to know if I can have both routers broadcast wireless on the same channel, so they appear as two wireless networks. Is this possible?

  Looks like you will get almost everything on your wish list.  You can have two wireless routers, and they can both diffuse.  Normally, you would use the same SSID for both routers, but different channels.  Your wireless computer automatically selects the channel harder, so you can "roam" between two routers.  However, this "roaming" is not as good as with cell phones, then you should only "roam" when your wireless connection is idle (i.e. not an active download).

  See my post on this topic for more information on the configuration of your system:

  http://forums.Linksys.com/Linksys/board/message?board.ID=Wireless_Routers&message.ID=108928

• How backup VPN configuration between two universities?

  Hello, I am a student of the Greece and I have a graduation project to configure Backup VPN between two universities. Principal of communication made with leased lines. I study a lot, but now that it's time for implementation I have some thoughts:

  -What hardware and software IOS do I need? Cisco 1841 it is ok for A & D routers?

  -Use GRE IPSec transport mode or IPsec Tunnel mode?

  -What will be the failover mechanism for switching traffic lines leased to IP VPN Backup and opposite? A teacher told me something about the Interface Prioritys. I read somewhere that this is done with the such as EIGRP routing protocol. who was right the Professor or the book?  :-D

  -In the same place, they have Firewall and NAT, I need to do any action for this?

  The attached file contains topology I want to implement

  'My' talk site 1

  2 a Central Site

  E communicates with A, but no traffic is to A of E with normal circumstances. Subnet on E access Internet through F, then press D.    VPN will be implemented on the LAN but the specific source E traffic will pass through the Backdoor VPN (I think that the solution to this is ACL on the router). They have no routing protocol in 'my' site A directly connected routers and the default routes.

  How imlement this?

  I think the first thing to do is A to D connectivity

  I will try to do this to tracers package first, but how can ' I imitate the SP network?

  I need help I can get!

  Hi John,.

  In our scenario, given that our main connection is a direct leased line between E and F, so I guess there is no other network between the two routers. In this case we do not need to configure SLA monitoring or any interface a priority. We can simply enter two default routes:

  IP route

  IP route 254

  In this scenario, if the leased line interface goes down, the second default route is used and the traffic should be routed by A router.

  SLA monitoring monitors connection (using the ping tests) by one of the interfaces of the router, and when we are not able to ping from one server (specified in the configuration of the SLA) through the interface, then we change the default track to track traffic through some other interface.

  So, in your scenario, we can monitor the connection between E and F, and when the link goes down, we can change the default route to point a.

  This is useful in the scenario where we have another ISP connection as our primary connection.

  Here is a link on how to configure SLA monitoring on the router:

  http://www.Cisco.com/en/us/docs/iOS/12_4/ip_sla/configuration/guide/hsicmp.html

  After you have configured the SLA followed by using the link above, you can bind it to the default route by using the following command line:

  track road IP / / default main route

  IP route 255 / / default route with a metric of higer that comes into play when the main default route goes down

  In addition, the sample configuration that you give in the doc is almost correct, defined transformation is missing just a hashing algorithm. Here is a link with an example for a tunnel from lan-to-lan between two routers:

  http://www.Cisco.com/en/us/partner/products/HW/routers/ps221/products_configuration_example09186a008073e078.shtml

• The way of writing to a wireless bridge between two different routers.1:broadband and dir 2:dlink 605 l

  I want to bridge.and wireless I can't do that... Please send me how to write to a wireless bridge between two different routers.

  1:broadband
  and
  2:Dlink dir 605 l,

  Hi Mohammed Ehsan Jourah,.

  Thanks for posting the request in the Microsoft community forums.
  I understand that you need to know how to make a wireless bridge between two different routers

  What version of the operating system is installed on the computer?

  To connect multiple computers, install a network adapter in each and run a network CAT5 cabling to connect each one to a hub (and thus the other.) The computer that will serve as a transition will have a standard network card for wired and a wireless network adapter that will connect to the wireless (WAP) access point or gateway on the second network.

  A network bridge is software or hardware that connects two networks or more so that they can communicate. You can create only a single bridge network on a computer, but a bridge can handle any number of network connections.

  You can try the steps at the bridge between two different routers wireless.
  a. determine the coverage area. When using two or more routers, the coverage area should be divided, and each router should be placed in a central location in each subdivision. If you add a wireless router to an existing network, this may mean moving the first router.
  b. decide which router is the main router. The main router is connected to the Internet, a LAN cable or other networks. It should be as close to the wired network connections or who has the best line of sight to another wireless network. In addition, the main router should be a high range router, allowing large tables of State and more users.
  c. buy a spare antenna, as the antennas that come with most routers do not have very good range. Quality omnidirectional antennas can push the range and signal strength of each of the routers, which, in turn, will reduce the cost by allowing routers less cover more space overall.
  d. deploy the primary router carefully. This router is the most important and requires most of the time of installation and options. Set the WEP (Protocol) encryption Service Set Identifier (SSID) and wireless, set up the Internet connection and test the router with some clients (computers). Once you get the main router deployed, deploy other routers should be easy.
  e. deploy the secondary routers, which must be configured to operate in "mode of transition." Secondary routers should be deployed around the perimeter of a large area or 'hot spots' where users placed - for example, will convene a bench Park or the table.

  Links:
  Create a network bridge:
  http://Windows.Microsoft.com/en-us/Windows7/create-a-network-bridge

  Add a connection to a network bridge:
  http://Windows.Microsoft.com/en-us/Windows7/add-a-connection-to-a-network-bridge

  Hope this information helps you. If you need to get help or information with decision-making wireless bridge between two different routers, I'll be happy to help you.

• VLAN in two Cisco routers

  Guys,

  A pleasant day!

  We have two ISP in our society. Each has a Cisco router as a bridge. I think that if it is possible to create VLANs in these two routers.

  Let's say I VLAN100 in ROUTER1 (192.168.100.253) and VLAN200 in ROUTER2 (192.168.100.254). Is there a conflict in the network?

  I have observed that, once that I have create a VLAN in a router, it will be automatically its internet access path.

  Enjoy an idea about it. Thank you.

  Kind regards

  Chris

  Hi Chris,

  You can put the routers in different VLANS. On connect it directly the switch (assuming that you have just 2 VLAN), put the ROUTER1 is vlan 100 and ROUTER2 in vlan 200. You can then choose which ISP you want computers out by what vlan put you in. If you want the computers to talk to each other, you cannot superimpose the address however ranges.

  Another option would be to have all you computer gateway to ROUTER1 and then configure Policy Based Routing to redirect traffic to the other router. It should look like this:

  ispselect extended IP access list

  permit ip host Computer2_IP all

  route allowed isp2 10 map

  ispselect match ip address

  set the default ip next hop 192.168.100.254

  This applies to the inside interface of ROUTER1

  political intellectual property map route isp2

  In this configuration, you would be able to leave everything in the same network without having to statically vlan PCs.

  Josh

• Routing VLANS on multiple routers

  Hello

  I'm trying to get a vlan to share more than two routers, but I'm stuck. I read on tons of things, but nothing seems to fit. I was wondering if someone could help me.

  I have attached both the packet trace and the jpeg of topology. It is 20 of VLANS I try to share, my goal is that PC13 on VLAN 20 (independent) should be able to request an IP address from the router 0 (which is the DHCP server) as well as all communication between other hosts on VLAN 20.

  Thanks in advance.

  Hi Ben,

  In principle, it is not possible between 2 routers. Packet tracer does not support this kind of thing between routers - as Gregory mentioned you could use L2TP that is not supported in packages or other tracers improved protocols. You may not use the same network range i.e. 192.168.3.0 IP on both sides without switch / switches catering to transport frames across on the other side.

  I had a go at your laboratory - was great fun! I enclose my version in this post.

  I had the same vlan on both sides, BUT:

  one side had the 192.168.3.0 rank - on vlan 20 but inaccessible from the other side, because there is no layer 2 connectivity.

  the other side had 20.20.20.0 rank - even once again, on the vlan 20, but nothing to cary managers through - where another IP subnet

  Things I changed were:

  • deleted the servers (not sure what purpose they were sailing - maybe it was for DHCP?)
  • OSPF changed between R0 and R1 for contiguity on the network 1.1.1.0/30
  • installation of new pools the 192.168 dhcp R0 and R1 20.20.20.0's
  • VLAN 20 exist in both places, but with different intellectual property regimes
  • everything is able to ping everything else.
  • changed the configuration of switches so they trunking VLAN relevant (which was not the case in your example)
  • some configurations of the trunk on the switches and sub interfaces.

  R0 on the left:

  DHCP excluded-address 192.168.2.1 IP 192.168.2.100

  DHCP excluded-address IP 192.168.3.1 192.168.3.100

  DHCP excluded-address IP 192.168.4.1 192.168.4.100

  !

  IP dhcp SALES pool

  network 192.168.2.0 255.255.255.0

  default router 192.168.2.1

  IP dhcp ADMIN pool

  network 192.168.3.0 255.255.255.0

  default router 192.168.3.1

  pool IP dhcp STUDENTS

  network 192.168.4.0 255.255.255.0

  default router 192.168.4.1

  !

  interface GigabitEthernet0/0

  no ip address

  !

  interface GigabitEthernet0/0.10

  encapsulation dot1Q 10

  IP 192.168.2.1 255.255.255.0

  !

  interface GigabitEthernet0/0.20

  encapsulation dot1Q 20

  address 192.168.3.1 IP 255.255.255.0

  !

  interface GigabitEthernet0/0.30

  encapsulation dot1Q 30

  192.168.4.1 IP address 255.255.255.0

  !

  interface GigabitEthernet1/0

  IP 1.1.1.1 255.255.255.252

  !

  router ospf 1

  Log-adjacency-changes

  1.1.1.1 to network 0.0.0.0 area 0

  network 192.168.0.0 0.0.255.255 area 0

  R1 on the right side:

  DHCP excluded-address IP 20.20.20.1 20.20.20.100

  !

  dhcp VLAN_20 IP pool

  network 20.20.20.0 255.255.255.0

  router by default - 20.20.20.1

  !

  !

  interface GigabitEthernet1/0

  no ip address

  !

  interface GigabitEthernet1/0.20

  encapsulation dot1Q 20

  IP 20.20.20.1 255.255.255.0

  !

  interface GigabitEthernet2/0

  IP 1.1.1.2 255.255.255.252

  !

  router ospf 1

  Log-adjacency-changes

  1.1.1.2 network 0.0.0.0 area 0

  0.0.0.0 network 20.20.20.1 area 0

  Hope that this is of interest to us

  Please note the useful messages and don't forget to mark resolved all questions answers. Thank you.

• Traffic is failed on plain IPSec tunnel between two 892 s

  Have a weird case and you are looking for some suggestions/thougs where to dig because I have exhausted the options.

  Note: I replaced the Networkid real to a mentined below.

  Topology: a classic IPSec VPN tunnel between two 892 s of Cisco, with pre-shared key and no GRE. A 892 (branch_892) has access to the Internet using PPPoE and has three network / VLAN behind it. A VLAN is coordinated to the PPPoE internet access. Access to the other two VLAN - VL92 (100.100.200.0/24) and VL93 (100.100.100.0/24) is performed via the VPN tunnel.

  Second 892 (892_DC) has just one interface - WAN on Gigabit enabled/connected and a static route to the default GW. It doesn't have any defined interal network. If the router is strictly used to send traffic to VL92/VL93 to the domestic 892 via IPSec tunnel.

  Here's the problem: access to VL93 (100.100.100.0/24) works, however for VL92 (100.100.100.0/24) - does not work.

  Devices in VL92 I ping IP address of 892_DC through the VPN tunnel. The 892_DC router I can ping devices in VL92. However, I can't VL92 ping any device beyond the 892_DC and at the same time the packets arriving on 892_DC for VL92 are not sent through the VPN tunnel.

  I took the package trace on 892_DC using capture point/buffer to nathalie caron to VL92 packages and saw that the traffic coming to the 892_DC. I run the nathalie caron even on Branch_892, and there was not a single package.

  So... What's the problem? More interesting, I modified the way left on VL92 access list and still - no packets are sent through the tunnel.

  Any idea? Two routers config are below

  -------

  892_DC #show ru

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 1.2.3.4

  ISAKMP crypto keepalive 10 periodicals

  !

  address of 1.2.3.4 crypto isakmp peers

  Description of-COIL-892

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 1.2.3.4

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match a lists 101

  market arriere-route

  QoS before filing

  !

  interface GigabitEthernet0

  IP 10,20,30,40 255.255.255.240

  IP 1400 MTU

  IP tcp adjust-mss 1360

  automatic duplex

  automatic speed

  card crypto IT-IPSec-Crypto-map

  !

  IP route 0.0.0.0 0.0.0.0 10.20.30.41

  !

  access list 101 ip allow any 100.100.100.0 0.0.0.255 connect

  access list 101 ip allow any 100.100.200.0 0.0.0.255 connect

  -------------------------------------------------------------------------------------

  Branch_892 #sh run

  !

  crypto ISAKMP policy 10

  BA aes 256

  hash sha256

  preshared authentication

  Group 2

  isakmp encryption key * address 10,20,30,40

  ISAKMP crypto keepalive 10 periodicals

  !

  address peer isakmp crypto 10,20,30,40

  !

  !

  Crypto ipsec transform-set IT-IPSec-Transform-Set esp - aes 256 sha256-esp-hmac

  Crypto ipsec df - bit clear

  !

  map IT ipsec - IPSec crypto - Crypto - map 10-isakmp

  defined peer 10,20,30,40

  disable the kilobytes of life together - the security association

  86400 seconds, life of security association set

  the transform-set IT-IPSec-Transform-Set value

  match address 101

  market arriere-route

  QoS before filing

  !

  FastEthernet6 interface

  Description VL92

  switchport access vlan 92

  !

  interface FastEthernet7

  Description VL93

  switchport access vlan 93

  !

  interface GigabitEthernet0

  Description # to WAN #.

  no ip address

  automatic duplex

  automatic speed

  PPPoE-client dial-pool-number 1

  !

  interface Vlan1

  Description # local to #.

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  interface Vlan92

  Description fa6-nexus e100/0/40

  IP 100.100.200.1 255.255.255.0

  !

  interface Vlan93

  Description fa7-nexus e100/0/38

  IP 100.100.100.1 255.255.255.0

  !

  interface Dialer0

  no ip address

  No cdp enable

  !

  interface Dialer1

  IP 1.2.3.4 255.255.255.248

  IP mtu 1454

  NAT outside IP

  IP virtual-reassembly in max-pumping 256

  encapsulation ppp

  IP tcp adjust-mss 1414

  Dialer pool 1

  Dialer-Group 1

  Authentication callin PPP chap Protocol

  PPP chap hostname ~ ~ ~

  PPP chap password =.

  No cdp enable

  card crypto IT-IPSec-Crypto-map

  !

  Dialer-list 1 ip protocol allow

  !

  access-list 101 permit ip 100.100.100.0 0.0.0.255 any

  access-list 101 permit ip 100.100.200.0 0.0.0.255 any

  !

  IP route 0.0.0.0 0.0.0.0 Dialer1

  Yes correct sounds - so another possible problem is the routing is routing 100% correct on both sides? Can you put the two sides config for review?

• E1000 - two routers come... 1 network leaves...

  Yes, he stole from Thunderdome, but he's not going to my question. I have 2 e1000s and bring them all to two internet are relatively simple. What is not so simple, for me, is to see these two places (each router & computers) as a major network, I can do the little file sharing. Two routers are connected via a CAT5 cable long enough. However, I will use different operating systems with them (Liunx, Windows, OS x, Android, XBox360, etc.) and I need them all see each other at both ends. I want them to leave with a nice, clean for the first router 192.168.1.1 and ask the second associated as 192.168.1.2 (using MAC address... reservations IF possible). I guess that the installer on the second router will have to be done manually and the DHCP should 'probably' be disabled so the first router can assign all IP # s. problem is, I'm not on my period on the manual configuration of the second router. I have tried setting up and had this message on the IP address of the router in router subnet 1 s 2. The last time I did any 'real' network has more than ten years and I'm rusty on all this. Basically I have not sat down and read the books involving all this because that, even if I am amazing on learning by example, I have a bit of a learning issue with books... she sucks and I am one of those who simply cannot get certain techno-jargon to stay in my brain, unless someone it simplifies a bit. Can someone point me in the right direction to sorta? PS - until I get all these answers to 'use the search engine', I already did. But a search engine can be one of two things, useful or useless depending on the person knowing the right words to use (and I obviously didn't). Again, it is a problem for me in some cases. If someone knows the answer, I'll be very grateful and I'll be more than happy to say 'thank you '. If you don't know the answer, just be an adult and leave that would be.

  1. follow the number 1.  LAN - LAN

  http://www6.nohold.NET/Cisco2/UKP.aspx?VW=1&articleid=3733

  2. in addition, I click on the Security tab of the secondary router and uncheck "filter anonymous internet requests".  You will probably have to do it, but for some reason, I have to do this on an older linksys operate between main router and router secondary file share.

  The above configuration is that I use and I have no problem sharing files between computers.

• Vs LACP LAG between two PowerConnect 5448 s

  Hi all.

  Just got a switch configuration quad for our infrastructure EqualLogic SAN using PowerConnect 5448 s.  One thing I never did before her configuration of aggregation of links.

  If I wanted to set up an aggregate of 4-port connection between two switches, say on ports 1 to 4, and our iSCSI VLANS is 1000, the below will work?

  serial interface ethernet g(1-4)

  channel-group mode 1 on

  interface port-channel 1

  switchport general

  switchport General pvid 1000

  I've seen documentation on how to get the ports-working channels between a 5000 or 6000 switch and a Cisco Catalyst switch, but not just any what docs on how to connect two switches PowerConnect.  The doc of interoperability for Cisco <->Dell seems to want to use LACP on the side of Dell.  I wonder, should I configure and link LACP on the two 5448 aggregate s I have are running?

  Thanks for in advance for any advice or assistance!

  Joe

  
  

• Want to use internet to share WRV210 router between two LANs

  Hello

  I have the following scenario:

  A LAN has access to internet via ADSL through a Fortigate 50B (192.168.100.0)

  A new LAN (different segment) that should have access to the internet. (192.168.102.0)

  Two local networks need to have shared access resources among themselves.

  We have a WRV210 router between two LANs (192.168.100.0 WAN, 192.168.102.0 on LAN) configured in router mode.

  Resources work very well, but internet does not work.

  We receive answers internet addresses on 192.168.102.0 ping and tracert works very well, but we cannot navigate or connect to Skype, msn msg, etc..

  We made on fortigate 50B routes this way:

  192.168.102.0/255.255.255.0 192.168.100.102 internal

  192.168.100.102 is an address WAN WRV210

  We tried the gateway mode and internet works fine on 192.168.102.0, but 192.168.100.0 cannot contact 192.168.102.0 resources (obviously)

  What can be wrong in case of ping and tracert works very well, but nothing else works?

  Hi Willy,.

  You need the WRV210 in not the router mode gateway mode.

  Gateway mode active Stateful inspection, which will address translation from private to public IP addresses and NAT....

  "But I think that the VLAN on the router segments members to talk to other members on the other vlan, so your comment.

  Two local networks need to have shared access resources among themselves. "creates a problem.

  .

  A community previous publication says "with Port Based VLAN on the WRV210, there is no VLAN tagging and so on." It's more like say port 1 not to talk to port 2, because they are on separate physically designated VLAN (even if on the same subnet) and it is far as it goes. But with your configuration you want also to have the 2nd SSID do not talk to any wired client based on the RVS4000 as well? If so, this facility would not work because all wireless clients would be able to talk to cable customers and vice versa. But if you primary concern is simply to prevent the SSID 1 speaking with 2 SSID, it's doable in the page VLAN for the WRV210.

  So if you want the WRV210 to allow switching between the VLAN port basis, it won't work the way it is set up now...

  If you want to restrict access between IP hosts, I suggest using the list feature to access a managed switch that focuses on the PC or servers.  A switch may be as a series of 200 or 300 small businesses switch, see URL below...

  http://www.Cisco.com/en/us/products/ps10898/prod_models_comparison.html

  But then allow all ports to be a member of the VLAN by default.  I hope that I read your question correctly

  Best regards, Dave