RV220W - VLAN 2 VLAN single port access

Hi
I just bought Cisco RV220W router, and i have some problems connecting VLANs.
I have 2 vlans on my network. Now i would like to leave those 2 vlans seperate, so that nobody can go from one vlan to another.
But i want 3 exceptions.
1.) access from VLAN1 (default vlan) to a server (192.168.10.2) on VLAN10 port 3389 (RDP).
2.) access from VLAN10 to a server (10.10.10.3) on VLAN1 (default vlan) port 62000.
3.) allow ping from VLAN10 to a server (10.10.10.3) on VLAN1 (default vlan).
Thanks for all your help in advance.
Bostjan

cool
and when can we expect the next firmware release?
(can i get a beta version of this firmware?)
Bostjan

Similar Messages

Port Access mode allow tagged frames ?

Hello,
From my understanding Cisco Catalyst switch port access mode only allow untagged frames to be received and proceeded. Tagged frames received on access mode port should be discarded.
But I have found in BCMSN course Student Guide following phrase
If a non-802.1Q-enabled device or an access port receives an 802.1Q frame, the tag data is
ignored, and the packet is switched at Layer 2 as a standard Ethernet frame.
Is in this case term access related to non Cisco equipment ? Or where are some Cisco Catalysts HW/SW combinations in which access mode port accept also tagged frames ?
With Best Regards
Tomas

Hello Tomas,
802.1Q tagged frames with a vlan-id = access vlan of the port are accepted on Cisco Catalysts.
for Sure it was in 2004-2005 when I did L2 security tests and read about the following:
This is the basis for one of the L2 security attack that is called vlan hopping:
if you send a frame with two 802.1Q tags and:
a) the external tag vlan-id = port access vlan
b) the same vlan is used as native vlan in a inter-switch trunk
the attacker can send a frame from vlan X to vlan y bypassing L3 security and routing devices.
the recommendation is to use as native vlan a dedicated vlan for all trunks that is never used on access ports.
Hope to help
Giuseppe

Multiple Vlans on a single port.

hi,
Can i configure single port with multiple vlans on L2 2950 switch, if yes then what are the commands.
Thanks,
Vishal D.

Paresh,
i think i have not quoted the question properly.
see by doing 'switchport mode trunk' it will flow the traffic of all vlan right.
but if i want to give access of selected vlans then what to do,
i have tried the command 'switchport trunk allowed vlan 1,2,3'
do i have to give encapsulation on that port, but on 2950 encap cannot be configured.
now can u tell me wht is possible to do.
Thanks for ur reply.
Vishal.

RV220W VLAN

Hello,
I have a RV220W router and vlans set up on switches.
The goal is to allow access to a device on a 172.17 network (VLAN) to be forwarded to the internet so external users can access it. Primary IP subnet and subnet router uses is 192.168.16 network.
Any help would be great!
Thanks

Rhys,
What you need to do is create the 172.17... network on the RV220W, then create a trunk port to the switch with that VLAN Tagged. Create a trunk port on the switch with that VLAN tagged as well. Once the device is able to reach the internet you can use Port Forwarding to pass WAN to LAN traffic to it for specific services.
This is a simple explanation, please reply with any questions you have.
- Marty

Is it better to use router port versus vlan member port?

Hi CSC,
This is more of a philosophical or "best practices" question.
I have a Cisco 3550 at the home office. Connected to the 3550 is a number of branch offices by way of T1 circuits or VDSL modems. They all come to the home office, where we have a central internet connection and server farm for our entire organization.
Except for one special case branch office, we don't forsee the need for appearances of the home office vlan at the branch office sites. In that case, we bring it into a trunk port at the home office, and at the special case branch office we have a dell 3024 switch and tag some ports as vlan 18 (the home office) or vlan 27 (the special case branch office).
We also do not forsee a need for the vlan from one branch office to appear at another branch office.
They are all (except for the special case mentioned above) currently configured something like this:
interface FastEthernet0/1
description home office
switchport access vlan 18
switchport mode access
interface FastEthernet0/2
description t1 to branch office 1
switchport access vlan 19
switchport mode access
interface Vlan18
description subnet for home office
ip address 192.168.18.1 255.255.255.0
interface Vlan19
description subnet for branch office 1
ip address 192.168.19.1 255.255.255.0
Is it better, in terms of reduced network complexity or performance on my 3550, to do something like this instead?
That is, to make the interfaces router ports as opposed to vlan member ports?
Of course, if we ever DID need to have appearances of the home office vlan at branch office sites, or appearances of one branch office's vlan at another branch office, we would lose that flexibility.
interface FastEthernet0/1
description home office
switchport access vlan 18
switchport mode access
interface FastEthernet0/2
description t1 to branch office 1
ip address 192.168.19.1 255.255.255.0
interface Vlan18
description subnet for home office
ip address 192.168.18.1 255.255.255.0
no vlan 19

Hello,
In my opinion there is no 100% right answer here. I think it depends also about network forecast. I'll try to add here some thoughts:
- if you use trunk interfaces from home to branch and SVI for L3 connection, in terms of scalability is much easier to expand (you have now only one p2p L3 link, but in future you'll need another one; if the port is a trunk one, you just configure another SVI interface, allow vlan on trunk and your good to go)
- trunk interfaces involve more configuration (L2 interface and SVI L3 interface)
- if you add in the home office another switch to existing one, and for some reason you have misconfiguration in STP / VTP, then you can run into problems like loops, vlan database modification (e.g. VTP server mode and the new added switch has a higher revision number than existing one)
- L3 physical interfaces are easier to configure and less complex, but in case you want to scale to additional p2p link will be harder
- L3 configuration is easier to troubleshoot as you avoid the L2 complexity
- in terms of packet exchange a L3 interface will exchange less packets than a L2 trunk with SVI (I'm talking here about control traffic, not user traffic)
- with L2 trunk you can have other problems like if somebody is "smart enough" to add a new switch into the existing switch (if you have a switch there) at the branch location; imagine that the new switch due to misconfigurated STP became root bridge; you have a large STP domain.
As I said, there is no good or bad approach. You have to guide yourself about forecasts in your network. For example if you know that a branch location will not be extended in the next 2 years, then go ahead with L3 interface and that's it. On the other hands if you have doubts you can add for another location L2 trunk with SVI. You can mix this two solution to obtain the best results for your network characteristics.
Cheers,
Calin

802.1x Guest Vlan and Routed access layer design

Hi!
For many reasons, I have to re-design my campus network in a more ISP like way. The plan is to move to a routed access layer in the next two years. I have 802.1x with guest vlan on my access ports(3750). I was reading on the subject and I found that the guest vlan feature was not availeble with internal vlan(routed port).
Is this limitation realy there, is there a way I can get around it without complicating my design even more. Do cisco have plan to lift this???

You cannot use/configure 802.1X on a routed port today. Typically, 802.1X is to be used for LAN edge ports.
The Guest-VLAN should work with a routed access design though. If your Guest-VLAN is chosen to be separate from say otherwise statically configured access VLANs, you would need to configure it via separate SVI with corresponding IP info (in a routed access model).
Hope this helps,

RV082 - Vlans for guest access

Hello,
I have an RV082 router which supports port based VLANs. I have a WAP that I want to use to provide guest internet access which cannot see our production vlan. I plugged the WAP into port 8 and set the vlan for port 8 to vlan 2. Here's the part where I'm confused. I am unable to get an IP address when connecting to the WAP because our DHCP server is a windows box on vlan 1. So, I tried using the DHCP relay option and entering the ip address of the windows box DHCP server. I am still not able to retrieve an IP address when connecting to the WAP. Someone mentioned setting up an ip helper address. I connected to the CLI of the RV082 but could not figure out the syntax of how to set up the ip helper address. Any help with any of this would be much appreciated. I only have about a week to set this up so I have to figure something out.

Mr. MacKay,
Since the RV082 don't support vlan tagging, you could get a layer 3 switch and create the vlans there and setup a dhcp relay to a server for the vlan ip addresses.
Then it would be just setting up static routes in the switch pointing to the router as the default gateway and finally doing routes back from the rv082 for the vlan you created.
A quick solution would be get a wireless router and set it up by plugging the wan into your network and setting the lan on a totally different ip address scheme. Then only allow access to the rv082 on that network and deny the rest of the network access to the guest and vice versa.
Kind of a work around.
The quickest fix would be getting a vlan aware router like rvs4000 or the wireless version wrvs4400n and if you need dual wan with vlans and wireless you could go with the sa520w.

Cisco switch 300 configure vlan and ports

Hi i need help
i cant see the vlan on port vlan membership
i did create the vlan and i did configure the port the access
but when i try to port vlan membership to tell which port to wich vlan i cant see the vlan i have created in the list
thanks to help

Hi,
This forum is focusing on the issues related Windows Server.
To get better help, please post your question on the forum of cisco.
Here is the address,
https://supportforums.cisco.com/
Best Regards.
Steven Lee
TechNet Community Support

RV220W VLAN issue

Hi there,
I am having an issue with my VLAN configuration on my RV220W router. I want a default VLAN for all office users, and a guest VLAN for non-office workers that visit, and a mobile VLAN for phones to connect to. Currently all devices attached to the default VLAN have WAN access and access to printers etc. that are on the same VLAN. However any device that connects to the guest VLAN has no WAN access at all.
I have setup the router as below:

Good morning
Thanks for using our forum
Hi mate, my name is Johnnatan and I am part of the Small business Support community. To add to Tom´s post you could “Isolate”, your networks enabling this feature, and disabling the Broadcast SSID of your Network1.
I hope you find this answer useful, *Please mark the question as Answered or rate the answer so other will know when an answer has been found.
Greetings,
Johnnatan Rodriguez Miranda.
Cisco network support engineer.

Supported VLANs per port 6500

Hello,
I need to know what is the number of supported vlans per port for a Cisco 6500 with sup 720?
Thank you.

On a port configured as access port, it can only belong to one and one vlan only. On a trunk port configured as dot1q iith software release 8.3(1) and later releases, instead of reserved VLANs, we now have only user and internal VLANs. VLAN manager no longer permanently sets aside VLANs for features that require them; they are now dynamically assigned as needed. The entire VLAN range (1 to 4094) is now available for user (and internal) VLANs.
With ISL I believe it's 1005 vlans.

Srw2008 snmp vlan to port

Hello,
I need to know is there any option to get ports that some vlan is added to with snmp? I found with snmpwalk that oid 17.7.1.4.5.1.1. gives information of port and vlan id's. So far so good, but thats the way to see only untagged vlans on ports. I was not able to found any data about tagged vlans on ports. There are some OID with hex codes that changes by changing port tagging but i cant understand them.
Solved!
Go to Solution.

Configuration is vlan id 3333 name "test" tagged on port 4 and port 8. Output differences :
17.7.1.4.2.1.4.0.3333 = Hex: 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
17.7.1.4.3.1.2.3333 = Hex: 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
17.7.1.4.3.1.3.3333 = Hex: F6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ifMIB.ifMIBObjects.ifStackTable.ifStackEntry.ifStackStatus.103332.4 = active(1)
Configuration is vlan 3333 name "test" tagged on port 5 and port 8 . Output differences:
17.7.1.4.2.1.4.0.3333 = Hex: 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
17.7.1.4.3.1.2.3333 = Hex: 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
17.7.1.4.3.1.3.3333 = Hex: EE 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ifMIB.ifMIBObjects.ifStackTable.ifStackEntry.ifStackStatus.103332.5 = active(1)
There is more of hex code as result but the rest is zero's ...

REQ: VLAN Support for Access Connections

hi,
i would like to see VLAN support for access connections. i have a thinkpad t400
cheers

VPN-User wrote:
What can be understood wrong with "VLAN support in Access Connections"? If you want to know what VLAN stands for, just google.
I know perfectly well what VLAN is since i work with networking every day and that's why i asked because i still cannot understand what maharaja mean by AC VLAN support. I asked because i might be able to help since i use VLAN with AC a lot so don't understand exactly what he find to be missing. I'm pretty sure what he is looking for is already there.
Not sure why you felt it necessary to post such a arrogant reply which is not helpful for anyone, but asking for VLAN support could be several things so that's why some further explaination would be necessary to understand what exactly the request is about. I guess you made you point to tell everyone you know what VLAN is, but then you should also realize that the question in the first post might need some further explanation since the feature might already be there.
Message Edited by gan on 04-13-2009 12:33 AM

WRT350N unable to forward single port to VPN.

I set up a PPTP (VPN) server on my network so that I could access stuff at home when I am not. I went to the router to configure router to forward the port for VPN -- 1723 -- to the IP of the the server and got the following error:
Port overlap occured! Please change your entry!
I am running firmware version 1.04.3 and have tried 1.03.7 without any luck. I originally configured with a previous version of the firmware and have haven't had a need to change the configuration. I tried to save the settings without any changes and got the same message. The current port forwarding is:
SMTP                                              172.16.0.2      enabled
POP3                     172.16.0.2 enabled
FTP                                      172.16.0.2      enabled
HTTP                                  172.16.074      enabled
None
Braindead       2525   25        Both    172.16.0.2       enabled
IMAP              143     143      Both    172.16.0.2       enabled
Print                515      515      Both    172.16.0.240   enabled
WebMail        3000    3000    Both    172.16.0.2       enabled
MailAdmin     1000    1000    Both    172.16.0.2       enabled
VNC                 5900    5900    Both    172.16.0.2       enabled
VNC+1            5901     5900 Both    172.16.0.51 enabled
VNC+2            5902     5900    Both    172.16.0.74     enabled
VNC+3            5903     5900    Both    172.160.3        enabled
Blank
I dont' have any port overlaps. I have changed everything and nothing works. It was working perfectly under the original firmware. This router is less than a year old. I have looked at other threads that are serveral months old without a new post and without a resolution. I am going to need to change the web server as the machine that was running the web server is now dead and I CANNOT change the address. I wish there was a way to go back to original firmware.   I even tried to reset the router to factor defaults and could not change the port forwarding.
HELP
George Worley

ridcully wrote:
Yes, you are right you don't have any port overlaps...Well, you should check the subtabs "Port Range Forwarding" and "Port Range Triggering" and check if you have any port overlaps there...Also did you reset your router after the last firmware upgrade ? If not you must reset your router and re-configure it from scratch...
Do not have anything under either one of those tabs until now because I need to get VPN established. That is under "Port Range Forwarding" and it is just a single port -- 1732 (VPN).
Steps
Backed up configuration to a file.
Flashed with 1.03.7
Power Cycled WRT350N
Tried to add a single port forward for VPN.
Got Error
Followed the same with the above steps.
Got the same error.
Pushed in the "Factory Defaults Button" for about 45 seconds.
Now with Factory Defaults
Configured for ISP.
Tried to add in just a POP3 server with no other ports defined.
Got the same error.
Flashed with 1.04.3.
Power Cycled
Set back to factory defaults.
Configured for ISP.
Tried to add POP3 server with no other ports defined.
Got the same error.
Flashed with 1.03..
Power Cycled
Set back to factor defaults.
Configured for ISP.
Tried to add POP3 server with no other ports defined.
Got the same error.
Flashed back to 1.04.3.
Restored back up. Old ports are still defined and still can not map new ones.
I think that the firmware version that was on it when I bought it was 1.03.2 -- wish that I had never upgraded it.
Thank you,
George Worley

How to block a single port 1841

Hi,
I need to block a single port on my wan side fa0/1 .. my telnet port 23 as it is open and im not going to use it and want to close it ?
thank you

This example shows how to allow telnet from an internal network, ssh from any but deny anyone else while logging all activity
ip access-list extended TerminalAccess
permit tcp host 10.0.0.2 any eq telnet log
permit tcp any any eq 22 log
deny tcp any any log
line vty 0 4
access-class TerminalAccess in
You could also use the line "transport input none"
The best option is to have some secure means to remotely manage the device.

How do I allow all users on a single computer access to music without duplicating songs?

There has got to be a way to allow all users on a single computer access to a single -shared- directory without DUPLICATING the songs, but I can't figure it out. Tried Edit | Preferences | Advanced | Change, but the songs do not show up. Tried Sharing the folders. Tried Public Folders. Just want all my songs in one place to save space, prevent duplicates. Please advise.

Move the iTunes folder from its current location to, say, C:\iTunes.
With each account in turn press and hold down shift and click the icon to start iTunes, keep holding until asked to Choose or create a library.
Choose the library at C:\iTunes, or wherever you put it.
Job done.
tt2

RV220W - VLAN 2 VLAN single port access

Similar Messages

Maybe you are looking for