After Enabling trunking and two VLANs on switchports - clients don't receive IP Addresses
Hello all and thanks for your help and expertise. Here's my scenario:
I have approximately 35 Ruckus APs in a building which has multiple VLANs. The switches are Cisco 3560G. I want to segment the wireless traffic onto a dedicated wireless VLAN (218). I created two scopes in DHCP to service the APs and wireless clients. The APs should get their IP addresses on VLAN 1 (VLAN 1 scope in dhcp.) The clients should get their IP addresses on VLAN 218 (VLAN 218 scope in dhcp). I utilized the following commands to accomplish this goal, unsuccessfully.
Example: on port gi0/5
1 - switchport trunk encapsulation dot1q
2 - switchport mode trunk
3 - switchport mode access
4 - switchport trunk allowed vlan 1,218
Problems: 1) The APs are not getting an IP address on the default or native VLAN 1 unless I configure an IP Helper. Please note we have another building where a consultant set this configuration up (and it works) but I don't see an IP helper set when I check the config for VLAN 1.
2) The wireless clients do not get an IP address on VLAN 218, even if I set an IP helper address. In the other building - there is an IP helper set on VLAN 218 so I'm not sure what I missing or if something else is configured.
I would greatly, greatly appreciate if someone could tell me what I'm missing here. Is there something else I have to do to ensure clients on vlan 1 and 218 are able to obtain dhcp addresses in the config of the switch? Do I have to further configure vlan 1 or 218? I'm enabling the correct encapsulation, trunking the ports, and setting the vlans. What am I missing here relative to APs and clients getting dhcp addresses. Anyway your help is much apprecaited.
You need vlan 218 on all switches and allowed on all trunks that need to pass traffic for that vlan.
You don't have to add it explicitly to STP as it should be run anyway but if you manually set STP priorities for other vlans you should probably do if for this vlan as well.
Shouldn't stop it working though.
If you manually assign a vlan 218 IP to a client can it ping the SVI IP ie. it's default gateway and if so can it ping devices in other vlans ?
Jon
Similar Messages
-
WLC526 and two AP521 problem. Clients keep loose connectivity
I have a UC520 in a building with several IP phones. We installed a WLC526 and two AP521's for seamless roaming of cordless phones. THe phones work great with no issues. When I am running a ping test on a wireless laptop, i keep loosing packets. It looses connectivity randomnly. DHCP is given via Windows 2008R2 server. Have a cisco 2948 switch also in the mix. THe AP's are connected directly to teh front of the UC520. Is there something in the configuration I am missing? Why do phones work perfectly and not data?
You do a ping from a laptop to another laptops?
The WLC and the APs you have are really old. It will not be strange if you find the client you are using having problem with the APs/WLC that you have. -
I send an email and he is sent but I don't receive him on my apple computer , why?
I send it twice and he is gone and sent, but I cannot find it by my e-mail in apple. Why? Thank you anyway
<Email Edited by Host>I have been having the same problem as well...I dont know whats going on?!
-
Why is trunk not showing vlan membership?
I setup corectly a LACP etherchannel with all VLANS allowed. This interface is called Po10.
Then I set up another one, Po20, consisting of interfaces 33 and 34, but this time restricting VLANs to only VLAN 20 (all config is below).
But when I do a sh int trunk and sh vlan brief, it only shows vlans for Po10. Is this because nothing is connected to the new port-channel, yet?
And what about the "no shut" command. I have not run this command. I thought I had to run this command, since all ports are shut per default in a Cisco switch? The config does not show this for any of my ports (I might have done this for the working port-channel).
Here is the config:
3750G-A#sh run int gi1/0/33
Building configuration...
Current configuration : 228 bytes
interface GigabitEthernet1/0/33
description iSCSI LACP interface
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20
switchport mode trunk
channel-group 20 mode active
spanning-tree portfast trunk
end
3750G-A#sh run int gi1/0/34
Building configuration...
Current configuration : 228 bytes
interface GigabitEthernet1/0/34
description iSCSI LACP interface
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20
switchport mode trunk
channel-group 20 mode active
spanning-tree portfast trunk
end
3750G-A#sh run int po20
Building configuration...
Current configuration : 202 bytes
interface Port-channel20
description LACP Port-Channel for VNX iSCSi
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20
switchport mode trunk
spanning-tree portfast trunk
end
3750G-A#sh int trunk
Port Mode Encapsulation Status Native vlan
Po10 on 802.1q trunking 1
Port Vlans allowed on trunk
Po10 1-4094
Port Vlans allowed and active in management domain
Po10 1,3,20,30,40,50,60,99
Port Vlans in spanning tree forwarding state and not pruned
Po10 1,3,20,30,40,50,60,99
3750G-A#sh vlan brief
VLAN Name Status Ports
1 default active Gi1/0/6, Gi1/0/7, Gi1/0/8
Gi1/0/9, Gi1/0/10, Gi1/0/11
Gi1/0/12, Gi1/0/13, Gi1/0/14
Gi1/0/15, Gi1/0/16, Gi1/0/19
Gi1/0/20, Gi1/0/21, Gi1/0/22
Gi1/0/23, Gi1/0/24, Gi1/0/25
Gi1/0/26, Gi1/0/27, Gi1/0/28
Gi1/0/29, Gi1/0/30, Gi1/0/31
Gi1/0/32, Gi1/0/33, Gi1/0/34
Gi1/0/35, Gi1/0/36, Gi1/0/37
Gi1/0/38, Gi1/0/39, Gi1/0/40
Gi1/0/41, Gi1/0/42, Gi1/0/43
Gi1/0/44, Gi1/0/45, Gi1/0/46
Gi1/0/47, Gi1/0/48, Gi1/0/49
Gi1/0/50, Gi1/0/51, Gi1/0/52
3 Management active Gi1/0/1, Gi1/0/2, Gi1/0/3
Gi1/0/4, Gi1/0/5
20 iscsi-A active
30 iscsi-B active
40 vMotion active3560-B#sh int status
Port Name Status Vlan Duplex Speed Type
Gi0/1 Management interfa notconnect 3 auto auto 10/100/1000BaseTX
Gi0/2 management vlan 3 notconnect 3 auto auto 10/100/1000BaseTX
Gi0/3 Mangement switch notconnect 3 auto auto 10/100/1000BaseTX
Gi0/4 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/5 VNX Management notconnect 3 auto auto 10/100/1000BaseTX
Gi0/6 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/7 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/8 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/9 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/10 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/11 notconnect 1 auto auto 10/100/1000BaseTX
Port Name Status Vlan Duplex Speed Type
Gi0/12 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/13 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/14 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/15 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/16 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/17 UCS FI-B uplinks connected trunk a-full a-1000 10/100/1000BaseTX
Gi0/18 UCS FI-B uplinks connected trunk a-full a-1000 10/100/1000BaseTX
Gi0/19 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/20 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/21 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/22 notconnect 1 auto auto 10/100/1000BaseTX
Port Name Status Vlan Duplex Speed Type
Gi0/23 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/24 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/25 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/26 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/27 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/28 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/29 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/30 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/31 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/32 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/33 iSCsi fra VNX notconnect 1 auto auto 10/100/1000BaseTX
Port Name Status Vlan Duplex Speed Type
Gi0/34 iSCsi fra VNX notconnect 1 auto auto 10/100/1000BaseTX
Gi0/35 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/36 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/37 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/38 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/39 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/40 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/41 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/42 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/43 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/44 notconnect 1 auto auto 10/100/1000BaseTX
Port Name Status Vlan Duplex Speed Type
Gi0/45 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/46 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/47 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/48 notconnect 1 auto auto 10/100/1000BaseTX
Gi0/49 notconnect 1 auto auto Not Present
Gi0/50 notconnect 1 auto auto Not Present
Gi0/51 notconnect 1 auto auto Not Present
Gi0/52 notconnect 1 auto auto Not Present
Po10 Port-channel for U connected trunk a-full a-1000
Po20 iSCSi LACP Port-ch notconnect unassigned auto auto -
1. when i use scvmm 2012 r2 sp1 ru2 to move a vm to another host(with no vlan trunk ) and change vlan 2 to vlan disabled. the network of vm was lost,when i check the network property on hyper-v management console ,i saw the vlan still the original setting,
but when i check the network propery on scvmm ,the vlan setting shows disabled,then i refresh the vm on scvmm console,the vlan setting shows vlan 2.
image 1, move a vm and change vlan settings to be disabled.
image 2. after vm was moved to another host ,the vm vlan settings shows on hyper-v console
yoke88
IM：[email protected]Hi,
in 2012 R2 UR2 there is already one bug fix regarding the vlan's. This can be a different problem. I would suggest to post this question to
https://connect.microsoft.com/WindowsServer/SC_Public
Regards,
Cengiz Kuskaya -
Macbook pro does not boot after enabling Filevault
macbook pro with OS 10.9.2 : after enabling encryption ran in to a problem and did not startup.
did the followings:
- loaded to recovery mode: command-R
- disk utility- verify disk> repair disk
- tried to reinstall OS : did not work
- re-partitioned the hard drive
- tried to install it from bootable Mac os installation : it worked but after running the software update it did not start up again....
- sent the mac to repair store to replace the hard drive with SSD hard : they setup the hard with mac os 10.9.5
- installed all the software update
- enabled the file-vault " this time it finished the encryption but when started up and tried to login with user account it got frozen and did not work and so on ...
- again tried to go to recovery mod and repair the hard and reinstall OS but it did not install the OS
- had to again repartition the hard ...
PS: the macbook loads fine with the OS on External hard disk .
this is really frustrating, can somebody tell me what's wrong with this mac why this issue happens after enabling encryption and why the issue is not gone even after reformatting the partition...I finally fixed the issue myself
The macbook had a RAM issue: Replaced the RAM and it is fine now. -
Remove music from iPhone after enabling iCloud/match
After enabling iCloud and iTunes Match, then after having some songs downloaded on my iPhone, I want to cycle some out and pull new ones down. However, I do not see how I can remove music from my iPhone. If I delete the playlist, the entire playlist is wiped from my master iTunes library, which removes it from all devices that use iCloud/Match.
How do I selectively control what stays on my iPhone?
Thanks,
DerekIf that is on, I highly recommend looking at th KB article: http://support.apple.com/kb/TS4054
Specifically:
Make sure iTunes Match is turned on.
Please see this article for information about turning on or adding a computer or device to iTunes Match.
If iTunes Match is already enabled on your computer or device, try turning iTunes Match off and then on again.
On your Computer choose Store > Turn Off iTunes Match, then Store > Turn On iTunes Match.
On your iOS device tap Settings > Music > iTunes Match Off, then Settings > Music > iTunes Match On.
And sadly, you apparently can delete a song from Match from your phone.
I am sorry, but no, you can't. If that were true, you would no longer see the song in your music library on your computer, and it would most likely be gone forever. The only way to remove an item from iTunes Match:
To delete an item from iCloud in iTunes
From a computer with iTunes Match enabled, open iTunes 10.5.1 or later on your computer. You can download the latest version of iTunes here.
Click Music on the left side of iTunes.
Select the item you would like to delete. Right-click the item and then choose Delete.
You will be asked to confirm this action.
If the item you want to delete exists in iTunes on your computer as well as in iCloud, click the checkbox to also delete the item from iCloud.
Match is a train wreck. They need to make it work simply and intuitively.
I don't disagree with you on this. -
How can I make my Introduction_mc automatically disappear after 10 Seconds and load Home_mc?
Hi,
How can I make my Introduction_mc automatically disappear after 10 Seconds and load Home_mc (automatically)? I don't want user to change by himself this Introduction page. It should be done automatically.
What is the procedure and code to achieve it, please?
Thanks.Hi,
I gues you are using AS2.0, then use setInterval, in AS3.0 user Timer Class.
AS2.0
var interval:Number = setInterval(doThis,10000);//in milliseconds
function doThis():Void{
//do something;
AS3.0
var timer:Timer = new Timer(10000, 1);
timer.addEventListener(TimerEvent.TIMER_COMPLETE, onTimerCompleteHandler, false, 0, true )
function onTimerCompleteHandler(event:TimerEvent):void{
//do something;
For details: http://blogs.adobe.com/pdehaan/2006/07/using_the_timer_class_in_actio.html
Warm Regards
Deepanjan Das
http://deepanjandas.wordpress.com -
How do I change my iCloud password after failing email AND security question?
I am trying to use an iCloud account I set up months ago. I cannot remember my password and when I select email, I don't receive anything on any of my other email accounts.
Is there another option?Contact Apple for assistance by going to https://expresslane.apple.com, then click More Products and Services>Apple ID>Other Apple ID Topics>Lost or forgotten Apple ID password.
-
I can't use Firefox because all I have at the top of the screen is the orange Firefox button, tabs, and my Yahoo toolbar. I don't have my address bar. I don't have the back and foreward buttons. I don't have the Home button or the Bookmarks button. I don't have my Google search bar. I don't have any the things that I should have and that I need to make it work. How do I fix this? Thank you.
I have been using 4.0 for about 2 months, and I know all of the new features and where everything is. But as of day before yesterday, the things that I mentioned '''are not there anymore'''! How do I get these things back? Thank you.
-
VLAN DOT1Q, SWITCHPORT TRUNK NATIVE VLAN, and VLAN1
Hi All,
L2 security documents suggest to avoid using vlan1 and tagging all frames with vlan IDs using the global configuration of vlan dot1q. Other Cisco non-security documents suggest using the switchport trunk native vlan # which removes any vlan tagging. It seems to me that the global vlan dot1q command and the interface switchport trunk native vlan # are contradictory; therefore, both should not be used. Furthermore, my understanding is to avoid using vlan 1 to tighten L2 security. When vlan 1 is removed from all trunked uplinks, user access ports are other than vlan 1, and no spanning-tree vlan 1 operations exists, what is the native vlan 1 actually used for?. The output of show interface gi0/1 trunk shows the native vlan as 1.
Thanks,
HCHi HC,
the command "switchport trunk native vlan" is used to define the native (untagged vlan) on a dot1q link. The default is 1, but you can change it to anyting you like. But it does only change the native vlan, all the others vlan on the trunk are of course tagged (and it only applies to dot1q, as ISL "taggs/encapsulates" all the vlans). The command "vlan dot1q tag native" is mostly used in dot1qindot1q tunnels, where you tunnel a dot1q trunk within a dot1q trunk. Thats something mostly service Providers offer to there customers. There it is important that there is no untagged traffic, as that would not work with dot1qindot1q. This command tagges the native vlan traffic, and drops all traffic which is not tagged.
Whatfor is the native VLAN? Switches send control PDU such as STP,CDP or VTP over the native VLAN.
If you don't happen to be a service Provider for L2 metropolitan Ethernet, you wan't need the "vlan dot1q tag native" command. For my part I'm trying not to use vlan 1 everywhere in my campus, because it gives a huge spanningtree topology and if you ever get a switch to blow a heavy load of traffic into it, you have your whole campus network degradet. I try to keep Vlan's a small as possible and to have as much L3 separaton as possible, that's good for the stability!
Simon -
How to configure a port channel with VLAN trunking (and make it work..)
We're trying to configure a port channel group with trunked ports to connect a NetApp HA pair. We want to create two data LIFs and connect them to the switch stack. We are trying to create 2 data lifs, one for cifs and one for nfs that are on different vlans.
We want the same ports to be able to allow multiple vlans to communicate. (trunked)
These data lifs should be able to fail over to different nodes in the HA pair and still be able to communicate on the network.
What this means is that we have to connect 4 ports each for each node in the NetApp HA Pair to the switches and create a port channel of some type that allows for trunked vlans. When we configure the ports, the configuration is as follows (below):
We are only able to configure an IP on one of the vlans.
When we configure an IP from another vlan for the data lif, it does not respond to a ping.
Does anyone have any idea what I'm doing wrong on the Cisco switch?
interface GigabitEthernet4/0/12
description Netapp2-e0a
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet4/0/13
description Netapp2-e0c
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/12
description Netapp2-e0b
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface GigabitEthernet6/0/13
description Netapp2-e0d
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
channel-protocol lacp
channel-group 20 mode active
end
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
spanning-tree portfast
spanning-tree bpduguard enable
endOur problem was fixed by the storage people. They changed the server end to trunk, and the encapsulation / etherchannel.
I like all the suggestions, and they probably helped out with the configuration getting this to work.
Thanks!
interface Port-channel20
description Netapp2-NFS
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
interface GigabitEthernet4/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet4/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/12
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active
interface GigabitEthernet6/0/13
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,20,511,519
switchport mode trunk
channel-protocol lacp
channel-group 20 mode active -
Trunking and the management VLAN
I have gotten my 5010's up and can get to them from mgmt0. The ip address for mgmt0 resides in VLAN 2 for me. I am getting ready to trunk my 5010's back to my 6500's. Do I need to make sure that VLAN 2 cannot be seen through the trunk ports since it resides on mgmt0?
I don't think this is technically right- the MGMT and the data-path aren't actually connected. The MgmT 0 port doesn't have any concept that it's on "vlan 2"- it's just an access port.
Similarly, if VLAN 2 is on the trunk port, the IP address you assigned to MGMT0 isn't going to respond.
If you configured "feature interface vlan" and then put an IP address on VLAN 2, you could mange this box that way- on two separate IP addresses, via the two separate connections.
With the current lack of ability to wrap ACLs around the Interface VLANs, I'm more comfortable NOT using interface-vlan commands, and using a single uplink to mgmt0. Loss of the mgmt0 port is now only loss of the ability to manage the switch, not a data-path impacting event. (unless you need to configure the switch to correct an data-path issue, in which case you've got problems.)
The shift to out-of-band is a nice feature, but it's going to require a big shift in thinking from an implementation standpoint. -
Two VLAN`s on Small Business 200(8ports) and 500 (24ports)
Hello,
Im having troubles enabling two different VLANs on a locally static network.
The entire network is setup with only static ips and no DHCP server or router on this network. The network has just been handling fire units so a central station can watch if the fire units are online.
Now we want to establish a second VLAN on theese switches for other units like security on doors etc. Is this possieble without a router? The two vlans does not need to reach eachother.
I have checked many videoes online and such, but i dont seem to get the interface enabled to two different ip vlans at once.
I have managed to create different vlans, and assigning them to ports. But not defining two different ip subnets on the vlans.
I have also trouble setting the system clock permanently. Everytime i reboot the switch, it seems to be going back to factory, even thou. ive updated firmware to latest and also applied the changes.
Anyway, would much appreciate a answer regarding the vlan configuration.
Thanks
ThomasLeo has given you some excellent advice ie. you cannot choose a kit list until you have a design. It just doesn't work the other way around. If you don't have the experience to design the solution then you can't really be choosing the kit. Otherwise when you do hire your consultant he might well be constrained by the kit already chosen and you will not get the best solution for your needs.
Please don't take any of this the wrong way. NetPro is a great forum for helping people out with technical and design issues with Cisco equipment but there are times when NetPro is not the best solution and this is one of them. We could each give you a kit list of what we "think" is the best solution but that really should come from the designer.
Jon
Leo - will you please stop losing your points oops, and now they are back again -
Configure Trunk carrying same Vlans on two separate uplinks on Cisco 3845
Hi,
I need to carry 2 vlans(x & y) in a trunk to two separate redundant devices uplinked to Cisco 3845 on Fa1/0 and Fa1/1. I know I can create sub-interfaces on one of the uplink interfaces(i-e Fa1/0) with 2 distinct 802.1q vlans(Fa1/0.x & Fa1/0.y). But is there a way I can carry same vlans(x & y) trunked to my 2nd redundant device uplinked on 3845 from Fa2/0 ? If not then how should I get the 2nd redundant device uplinked to this 3845 router.
Any tips.. ?
Thanks for your help and suggestions.IF both links are going to the same device then you can create a Layer 3 Etherchannel.
Maybe you are looking for
-
I've recently purchased a Spyder3 Print SR to calibrate my printer's color. In order to begin the calibration process, a page containing color patches must be printed WITHOUT COLOR MATCHING ENABLED in either the OS or the printer. The I have an HP C6
-
Needed: Short Code for my Business
I need to purchase a short code for my business so that moible phone users can SMS/MMS my short code and I can interface/reply to those messages using a custom program/app. Does Verizon Wirless offer the ability to purchase short codes?
-
If I've removed the app from the purchased how can I download again for free?
i mean that i removed for my computer and than on the Mac App Store in the purchased i saw a X and i pressed (but it was a mistake) and now i can't download it again for free, there is something that i can do??? thanks
-
Running a process prevent calling any service control in the application
I created a process project which chained a few web services. I also created a HelloWorld service which is not related to the process at all. I then created a pageflow in the web project. The pageflow calls the HelloWorld service control. The problem
-
Will photos synced by iTunes get pushed back by Photo Stream?
Having a hard time understanding how syncing with iTunes works with Photo Stream. I have Photo Stream shaing set up between a new iPadAir, iPhone 5. and iMac (10.8.5). As I read about Photo Stream Sharing ANY photo on the iPad or iPhone (taken or on