Multiple VLAN traffic on one switchport

Good Morning all,
I would like some help with a switchport config on one of my VMware clusters.
Currently the live vDS sits with the below config on a Cisco 4500
switchport trunk encapsulation dot1q
switchport trunk native vlan 8
switchport mode trunk
spanning-tree portfast trunk
spanning-tree bpduguard enable
I require the hots to be able to communicate on multiple VLANs, it sits on VLAN 8 but needs to communicate on 200 and 201 and 8.
Any help would be greatly appreciated.
Thanks,
Hassan.

Hassan
The switch port that you show us is correctly configured as a trunk. You have not shown us whether these three vlans are correctly configured on the switch and active on the interface. The output of show interface trunk would be helpful in determining this. If the switch appears to be correctly configured then the other part of the question is whether your VMware cluster is correctly configured to use the three vlans on that interface.
HTH
Rick

Similar Messages

Multiple VLAN's, one SSID

I'm getting to the point where my campus wireless network is growing past the subnet size that I'm comfortable dealing with. I have a WiSM and WCS and am running the newest IOS on each. Is there any way to use multiple VLAN's on one campus-wide SSID?
Or, can I put the same SSID on the two controllers and map it to two separate VLAN's without causing roaming issues?
Thanks,
Eric

Hi Eric,
Yes we can do this and this feature is called AP Grouping on WLC... Here is the configuration example to do the same..
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008073c723.shtml
Regards
Surendra

Multiple Vlans on a single port.

hi,
Can i configure single port with multiple vlans on L2 2950 switch, if yes then what are the commands.
Thanks,
Vishal D.

Paresh,
i think i have not quoted the question properly.
see by doing 'switchport mode trunk' it will flow the traffic of all vlan right.
but if i want to give access of selected vlans then what to do,
i have tried the command 'switchport trunk allowed vlan 1,2,3'
do i have to give encapsulation on that port, but on 2950 encap cannot be configured.
now can u tell me wht is possible to do.
Thanks for ur reply.
Vishal.

Binding multiple VLANs to single SSID on WLC

I have a building with over 4000 users and would like to bind multiple VLANs for user access to a single SSID in WLC. Can this be done? I would rather not have 4000 wireless users on a single VLAN.

the question is tough. You can not use the SSID in on AP for multiple vlans. Once you assign the AP to the vlan then you will have to make all traffic in the vlan. With that being said. you could assign the AP's to specific vlans, but if you roam from one vlan to another you will have problems at L3. But you can use WDS to make that happen.
Here are a couple of links tha might help.
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_q_and_a_item09186a00804d4421.shtml
http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_guide_chapter09186a0080184ace.html

L2 Integration of Multiple VLANs

I have reviewed the ACI L2 and L3 Connectivity White Paper. Using the instructions, I have successfully integrated an a VLAN from from the outside into ACI. I used the Extend BD approach. In looking at the instructions, it appears that creating an External Bridge Domain is required for each L2 VLAN from the outside. Is there a way to use the same physical port (VLAN trunk port from downstream switch) to bring in multiple VLANs in to ACI.
I would like to use only one port for all VLANs to be imported.
Is this possible ? If so, what would be the configuration steps ?
thanks,

The question that should be asked is what are you trying to accomplish?
1. Either you have external endpoints that need to be members of the same EPG as fabric hosted endpoints
or
2. You have external endpoints that you need to apply policy between everything else inside the fabric.
If this is the first case what you should be extending the EPG, not the bridge domain. By extending the Bridge Domain you're essentially mapping all the external traffic for that BD into one VLAN which will be represented by an External EPG you'd create on the APIC. This is useful in the case where you have all external users coming into the fabric you want to treat together using contracts between external users and internal EPGs.
Ex.
External Users <C> Web_EPG <C> App_EPG <C> DB_EPG
C = Contract
If it's the second case above, and you have end points both inside the fabric and external that need to belong to the same EPG and have the same policies applied endpoints internal or external to ACI, you'll want to extend the EPG as detailed in the first method of the L2/L3 Connectivity guide.
Regards,
Robert

Multiple vlan on Access point

Hi,
I have three AP but one one is connected with a network cable and the other work on a repeater mode.
I need to create two vlans which will broadcast two ssid one for office and one for guest. I know you can't create multiple vlan on a repeater but is there any way round then with only one AP which connected to the network and other working in repeater mode?
Thanks

You can probably is you configure one radio as a repeater and the other radio for client access, but they will be placed on the same subnet which is your native vlan. I'm not 100% sure that would work anyways, but I know you can't separate the traffic.
Thanks,
Scott Fella
Sent from my iPhone

Inter-vlan routing issues (one device isn't pingable from one VLAN, is pingable from others).

Greetings network wizards,
I'm facing an interesting issue in our enterprise network.
There is management VLAN. There are various devices in management VLAN (e.g. WLC controllers, SVIs for management on our catalysts, interfaces for management of servers, ...).
There are also other VLANs (office100, office101, printers, technology, ...). I'm unable to ping one device on our management VLAN from office VLAN. From all other VLANs, the ping works fine.
In terms of CLI (where a.b.c.d is problematic destination addres in management VLAN):
ping a.b.c.d. source vlan 20 = success
ping a.b.c.d source vlan 50 = success
ping a.b.c.d source vlan 90 = success
ping a.b.c.d source vlan 101 = failure
The ping is launched from either of our two L3 switches and the a.b.c.d address belongs to computer shown in the bottom of the picture.
The excerpt of our physical topplogy can be seen below.
The L3 switches depicted above are our two 4506 catalyst switches with SVIs for our multiple VLANs. There is also HSRP group for each VLAN on our L3 switches.
I checked all the relevant data structures (arp, mac, fib, adjacency tables) and everything seems OK. What is also worth to mention, is the fact, that the IP address of the switch shown in the bottom of the picture is in same VLAN as the device represented by PC attached to the switch in the bottom. That management SVI of the switch is pingable and working regardless of the source VLAN.
Any help would be appreciated.
Best regards,
SZ

Hi,
I'm afraid, that the configuration you posted above won't solve my issues. It is so because of following packet flow:
Ping from VLAN 101 (office) to VLAN 900 (management) flows to either of my L3 switches. L3 switch takes a look at the destination IP addres and assumes, he should use VLAN900. Thus, he uses VLAN900 SVI, encapsulates the frame to VLAN900 802.1q frame and sends it out of the appropriate trunk (the appropriate trunk is identified by destination IP address and corresponding MAC address).
Please, keep in mind that the topology is only excerpt and other switches are physically present, too (but not shown here). These other switches have clients from VLAN101 attached and these clients can easily ping the access switch (VLAN900) shown in the picture, but they're unable to ping the PC (VLAN900) attached to the same access switch. PC's switchport is assigned to correct VLAN. The frame coming from VLAN101 from another switch (not shown in picture) is rerouted at L3 switch and is put on trunk as VLAN900 frame. Then it flows down to the access switch. STP and trunks are fine ... because:
If I had STP issue or trunk misconfiguration in place, I wouldn't be able to reach the access switch (from whatever VLAN). In my current situation, I'm able to reach it easily.
Best regards,
SZ

Need help configuring multiple VLANs and SSIDs

Hi,
We bought a Cisco SGE2000P 24Port switch and 10 WAP4410N access points. Our intent is to provide a secure network to our LAN, and a guest network to the Internet.
We are thinking 3 VLANs would be best for this: VLAN 100 connected to the LAN, VLAN 1000 for the Internet Router and Filter, and VLAN 1100 for the Guest Wireless access.
We have the switch configured for all three of these, and 1 initial access point configured for the VLANS, too.
We have not yet moved the current Internet connection to VLAN 1000 because we aren't sure how to setup routing between VLANS.
Here are some specifics on how the traffic needs to route:
1. We have the DHCP server, which is the PDC, handling both scopes for the LAN and Guest VLAN.
2. The web filter in VLAN 1100 needs to authenticate with the DHCP server as there are different filter rules based on authenticated user. Any users coming from VLAN 1100 will have a default filter rule without requiring any authentication.
3. Certain traffic coming in from the Internet needs to be able to get to VLAN 100. The router has a built-in firewall that handles NAT and port forwarding, so as long as traffic can be forwarded to VLAN 100 we should be good.
4. Traffic on VLAN 1100 (guest Wireless network) should only be allowed to go to Internet (VLAN 1000).
Right now I have the VLANs configured and the ports assigned to the Access Points are set for TAGGED and on VLAN 100 and VLAN 1100.
The SGE2000P has the following IP addresses assigned to the VLANS:
10.7.3.252 - VLAN 100
10.7.40.254 - VLAN 1000
192.168.254.254 - VLAN 1100
Has anyone been able to setup a similar configuration? We have scoured the Internet for documentation but it seems to be very difficult to find!
Thank you!
Gary Smith

Based on your description of a 'Hybrid Port' this sounds like Cisco's 'Multi-VLAN Port' that was a feature of the 2900XL/3500XL series switches. This feature has however long since gone......
With a Cisco switch an access port supporting an Access VLAN & a Voice VLAN is effectively a Trunk with only one Tagged VLAN and the Native VLAN:
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 100
This results in the same configuration as:
interface FastEthernet0/1
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport trunk allowed vlan 100
With the exception of CDP packets being sent advertising the Voice VLAN.
With regards to other IP Phone vendors and DHCP Vendor Options - the answer is it depends....
Nortel use Vendor Option 144 to inform the IP Phone of the Voice VLAN and Option 128 for the Server (PBX) to use. Ericsson uses Vendor Option 43 that can be configured to tell the IP Phone the VLAN and the Web server to read the config file from.
I don't think you will get this working automatically with your 3Com switches, you can however manually configure the VLAN on the Cisco IP Phones.
HTH
Andy

Multiple DHCP on Multiple VLAN not working

Hi there;
In my core network switch, I have multiple VLANs, I have these command to assign to DHCP pools. I configured a port on my core switch for DMZ_VLAN and when I connect my computer to this port, I can get the ip address from the dmz_vlan dhcp pool. Because I assigned an IP address to the interface of vlan 192, then I found that one of my server "192.168.0.100" connection dropped, I cannot ping this server on the dmz VLAN, and it cannot provide the http service as usual until I remove the "interface vlan 192" from the switch. Why? However; without this command, I cannot receive the 192.168.0.0 network IP from the pool.
ip dhcp pool data_vlan1
network 10.10.1.0 255.255.255.0
default-router 10.10.1.1
dns-server 10.10.1.100 10.10.1.101
domain-name company.local
lease 7
ip dhcp pool dmz_vlan
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 8.8.8.8 4.2.2.2
domain-name company.com
lease 7
interface vlan 10
ip address 10.10.1.254
interface vlan 192
ip address 192.168.0.254

Sorry for the delay as I got busy with work. If your layer 3 switch is the default gateway for VLAN 192 then the default-router for the DHCP scope should be the IP address of the layer 3 switch interface (192.168.0.254). With that being said, the FW DMZ_192 interface, the switch SVI for VLAN 192 and the DMZ server should all be in the same broadcast domain, thus they should be able to reach each other.
So, can you confirm with me exactly what does not work on the server configured with VLAN 192 and a static IP? For instance,
1. Can you ping the server from the L3 switch
2. Can you ping the server from the FW
3. Can the server ping 192.168.0.1 and 192.168.0.254
4. Can the server ping the outside world? For instance, www.google.com and 4.2.2.2
5. Have you tried taking a test PC, connecting to the switchport configured for VLAN 192 and see if you get an IP address from the DHCP scope

DHCP Setup across multiple VLANs on RV325 - DHCP Server only working on VLAN 1

I have multiple VLAN subnets defined on my RV325 - when I try and utilize a DHCP Server on each VLAN, it only seems to be issuing IP Addresses to clients on VLAN ID 1. When I first set this up months ago, I thought I had tested it providing IP Addresses via the other subnets. Now that I am trying to do so, it isn't working "as expected". Example - I am using VLAN 25 as the GuestWireless subnet utilizing a separate 802.11n WAP that is set to Bridge connections to the IP Address of the VLAN interface. Devices are able to connect to the WAP, but end up with a self-assigned IP Address 169.x.x.x address. There has to be an easy fix to this, but I seem to be "stuck" figuring out what it is…pointers/redirects appreciated. Thanks!

Thanks - I've already reviewed that information before I posted. I've been working with DHCP since the mid-90's, so I'm comfortable with the settings/configuration I need to leverage to make this work via other means using various Network-based OSes.
I'm wondering if there are other options in configuring this device that can impact the ability to dynamically serve IP addresses on a VLAN/subnet-by-VLAN/subnet basis.
As I did more testing, I discovered when I reserved an IP Address via the IP & MAC Binding option within the DHCP Settings, those devices would receive their static reservations and work as expected, so the problem seems to be leveraging the DHCP Pool for devices connecting to VLANs other that VLAN 1.
Any ideas as to why the DHCP Pool's are "non-functioning" for the other VLANs is greatly appreciated...
Each VLAN is setup with a separate DHCP Server configuration as shown below:
VLAN ID = 1 (Default, Inter VLAN Routing = Enabled, LAN1-6 = Untagged, LAN7=Tagged, LAN8=Excluded, LAN9-14 Untagged)
Device IP Address = 172.16.xxx.1
Subnet Mask = 255.255.255.0
DHCP Mode = DHCP Server
Remote DHCP Server = 0.0.0.0
Client Lease Time = 1440 min
Range Start = 172.16.xxx.100
Range End = 172.16.xxx.199
DNS Server = Use DNS as Below
Static DNS 1 = 208.67.222.222
Static DNS 2 = 208.67.220.220
WINS Server = 0.0.0.0
Correctly serving IP Addresses via DHCP (both static and dynamic) to Wired devices & Wireless devices connecting through WAP (set to Bridge)
VLAN ID = 25 (GuestWireless, Inter VLAN Routing = Disabled, LAN1-LAN7 = Excluded, LAN8 = Untagged, LAN9-14 = Excluded)
Device IP Address = 172.16.yyy.1
Subnet Mask = 255.255.255.0
DHCP Mode = DHCP Server
Remote DHCP Server = 0.0.0.0
Client Lease Time = 1440 min
Range Start = 172.16.yyy.100
Range End = 172.16.yyy.199
DNS Server = Use DNS as Below
Static DNS 1 = 208.67.222.222
Static DNS 2 = 208.67.220.220
WINS Server = 0.0.0.0
NOT serving dynamic IP Addresses via DHCP to Wired devices & Wireless devices connecting through WAP (set to Bridge)
Static DHCP Reservations setup via IP & MAC Binding settings DO WORK in terms of providing the assigned static IP Address to the client. Inbound/Outbound traffic to Internet works for devices with Static DHCP Reservations.
VLAN ID = 100 (Voice, Inter VLAN Routing = Disabled, LAN1-6 Excluded, LAN7 = Untagged, LAN8-14 = Excluded)
Device IP Address = 192.168.zzz.1
Subnet Mask = 255.255.255.0
DHCP Mode = DHCP Server
Remote DHCP Server = 0.0.0.0
Client Lease Time = 1440 min
Range Start = 192.168.zzz.100
Range End = 192.168.zzz.199
DNS Server = Use DNS as Below
Static DNS 1 = 208.67.222.222
Static DNS 2 = 208.67.220.220
WINS Server = 0.0.0.0
NOT serving dynamic IP Addresses via DHCP to Wired devices & Wireless devices connecting through WAP set to Bridge
Static DHCP Reservations setup via IP & MAC Binding settings DO WORK in terms of providing the assigned static IP Address to the client. Inbound/Outbound traffic to Internet works for devices with Static DHCP Reservations.

Encrypting Aironet 1410 bridge link using multiple VLANs

I've looked at the documentation available for Aironet 1400 series, and still would like to see a single document showing an example of
the best encryption/authentication available for bridge links using multiple VLANs.
As I understand it, 1400 series can support WPA-PSK using AES, which would work for me. I just can't picture how to integrate chapters 9 and 10 for the 'WEP and WEP Features' + 'Configuring Authentication Types' instructions.
I'm looking either for an example config, or a step-by-step that did all steps consecutively.
Thanks

What doc are you refering to? If you want to encrypt the link from root bridge to non-root bridge, then WPA/TKIP-PSK is what you should use. Here is a link to how to setup your link ssid to WPA: http://www.cisco.com/en/US/docs/wireless/bridge/1400/12.2_15_JA/configuration/guide/p15auth.html#wp1044935
Don't worry about the example they show on the WEP, just use the configuration from the above link for your encryption.
Configuring a VLAN
Configuring your bridge to support VLANs is a five-step process:
1. Create subinterfaces on the radio and Ethernet interfaces.
2. Enable 802.1q encapsulation on the subinterfaces and assign one subinterface as the native VLAN.
3. Assign a bridge group to each VLAN.
4. (Optional) Enable WEP on the native VLAN. <-- Use WPA-PSK
5. Assign the bridge's SSID to the native VLAN.
http://www.cisco.com/en/US/docs/wireless/bridge/1400/12.2_15_JA/configuration/guide/p15vlan.html
Here is an example of vlan 1 (native) will be your management and your wireless link. vlan 10 & 20 will pass through the link.
BR# configure terminal
BR(config)# interface dot11radio0.1
BR(config-subif)# encapsulation dot1q 1 native
BR(config-subif)# bridge group 1
BR(config-subif)# exit
BR(config)# interface fastEthernet0.1
BR(config-subif)# encapsulation dot1q 1 native
BR(config-subif)# bridge group 1
BR(config)# interface fastEthernet0.10
BR(config-subif)# encapsulation dot1q 10
BR(config-subif)# bridge group 10
BR(config)# interface fastEthernet0.20
BR(config-subif)# encapsulation dot1q 20
BR(config-subif)# bridge group 20
BR(config-subif)# exit
BR(config)# interface dot11radio0
BR(config-if)# ssid batman
BR(config-ssid)# vlan 1
BR(config-ssid)# infrastructure-ssid
BR(config-ssid)# end

AP1300 Bridging Multiple Vlans with Dot1q

I have a pair of AIR-BR1310G-E-K9 to do ptp bridging. Topology is like this:
host-switch-rootAP---nonRootAP-switch-host
We have multiple vlans and have followed this doco:
<http://www.cisco.com/en/US/docs/wireless/access_point/1300/12.3_7_JA/configuration/guide/b37vlan.html>
The native vlan is all good and can ping across end-to-end. However, the when I attach a host to the switch in another vlan i.e. user vlan - there is no connectivity. Essentially, we want to dot1q over the ptp bridge setup.
running version:
c1310-k9w7-mx.124-10b.JA1
appreciate any input.
Ajaz

yes. standard trunk config on both switches:
5SL_SWITCH#srif 0/24
Building configuration...
Current configuration : 186 bytes
interface FastEthernet0/24
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,100
switchport mode trunk
switchport nonegotiate
spanning-tree portfast trunk
end
5SL_SWITCH#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/24 1,100
Port Vlans allowed and active in management domain
Fa0/24 1,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/24 1,100
5SL_SWITCH#
11SL_SWITCH#srif 0/24
Building configuration...
Current configuration : 186 bytes
interface FastEthernet0/24
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,100
switchport mode trunk
switchport nonegotiate
spanning-tree portfast trunk
end
11SL_SWITCH#show interfaces trunk
Port Mode Encapsulation Status Native vlan
Fa0/24 on 802.1q trunking 1
Port Vlans allowed on trunk
Fa0/24 1,100
Port Vlans allowed and active in management domain
Fa0/24 1,100
Port Vlans in spanning tree forwarding state and not pruned
Fa0/24 1,100
11SL_SWITCH#
furthermore the vlans exist in the db and when i trunk between the switches - I can ping the SVI's.
Do you want me to post the AP config?

Creating multiple vlans across multiple switches

Hi All,
How should I create multiple vlans across multiple switches?
For instance, I have two (primary/redudant) layer 3 (core) switches and four layer 2 access switches (Cisco 2960) for the hosts, and given these are the vlans/subnets to be created. Should I do it in the core switches only and it would just propagate through the access via VTP? Just trying to practice and learn.. Any help will be greatly appreciated:)
VLAN 100: [DHCP-workstations]
172.26.4.0/24
172.26.5.0/24
VLAN 200: [Servers]
172.16.1.0/24
172.16.2.0/24
VLAN 300: [Printers]
192.168.129.0/24
192.168.130.0/24
VLAN 800: [Management for switches/routers]
10.160.1.0/24

Hi
You will have the SVI on the core. Set a VTP domain, make one of the cores as VTP server and rest of the switches as VTP clients. Once you do this, you won't have to login into each switch and create a vlan locally. The vlans will be automatically advertised from the VTP server to all the VTP clients.
Thanks
Ankur
"Please rate the post if found useful"

DLSW ethernet redundancy for multiple vlans

Can dlsw ethernet redundancy support mutliple vlans with the following configuration?
host dlsw router1 host dlsw router2
| |
local dlsw router 1 local dlsw router2
| |
ethernet switch1-------ethernet switch2
Ethernet switch1 and 2 are supporting multiple vlans and connected to local dlsw router1 and 2 through 802.1Q. SNA support is required for the vlans of ethernet switch1 and 2 .
We found that configuration of dlsw ethernet redundancy is not allowed on the 802.1Q sub-interface of the local dlsw router1 and 2. In this case, how can dlsw ethernet redundancy can be supported for SNA server attached to multiple vlans? Can you provide us some reference / sample for dlsw ethernet redundancy to support SNA servers attached to different vlans in a switch environment.
Thanks.

I think that I understand the problem. I am thinking the following:
dlsw local-peer peer-id 2.2.2.2 promiscuous
dlsw transparent switch-support
interface Ethernet0
mac-address 0000.3333.3333
dlsw transparent redundancy-enable 9999.9999.9999 master-priority 10
dlsw transparent map local-mac 0000.6666.0000 remote-mac 0200.eca2.0000 neighbor 0000.5555.5555
interface Ethernet1
mac-address 0000.4444.4444
dlsw transparent redundancy-enable 9999.9999.0001 master-priority 10
dlsw transparent map local-mac 0000.6666.0001 remote-mac 0200.eca2.0000 neighbor 0000.7777.7777
Of course, you need an ethernet interface per VLAN. If you need DLSw ER over dot1q interface, please contact the local Cisco Sales Rep or partner. You are not the first one to ask for it. Hope that there is a strong business case to initiate the new feature.

How to create multiple Vlan in Controller 4402

Please let me know step-by-step procedure to create multiple vlan in conroller 4402, In my topology we have vlan -1 for date and vlan - 11 for voice both are in different network, please light me detail config on controller and switch

Hi Balamurugan,
I don't want to sound rude, but, you have posted your issue three times. Each one, I recommended that you go through the WLC Configuration Guide. I recommended this because you are new to WLC and it's the best way for you to learn.
However, you recent post has led me to believe that you are reluctant to peruse the document and I am puzzled. Is there any reason of your reluctance and hesitance?
Cisco Wireless LAN Controller Configuration Guide, Release 6.0
http://www.cisco.com/en/US/docs/wireless/controller/6.0/configuration/guide/Controller60CG.html

Multiple VLAN traffic on one switchport

Similar Messages

Maybe you are looking for