SA540 VLAN Configuration Question

I need to connect 2 internal LANs to the SA540 but cannot work out how to set the IP addresses for the 2 VLANs on this device. Does anyone know how to setup the relevant IP addresses for the 2 VLANs? Example: VLAN 2 IP = 192.168.5.10 and the second VLAN IP = 192.168.10.10The WAN port will connect to a single Internet device. Any help will be greatly appreciated.

Hi Ratan,
The following steps apply to latest MR Firmware version 2.1.18.
1) The first thing you need is to enable VLAN (Networking ->LAN -> VLAN Configuration -> Enable VLAN? {check this}).
2) Next you have to create the second VLAN (Networking ->LAN ->Available VLANs ->Add...) Name it and use the ID to associate the VLAN to (2). If you want inter VLAN Routing to be enabled leave the box checked, otherwise uncheck it.
3) Next we specify/edit the subnet that your new vlan will use. (Networking ->LAN -> Multiple VLAN Subnets) Look for the VLAN ID created above (2), and Click the Edit button. Modify the subnet parameters as needed.
4) Finally we assign the SA 500 ports to use the VLANS. (Networking ->LAN ->Port VLAN) Setup the port's Mode as Access, General, or Trunk, and assign VLAN membership as well.
See screenshots for clarity. If you need to create more VLANs, repeat steps 2-4 as needed.
Hope this helps,
Julio

Similar Messages

Multi site, multi vlan configuration question

Hi Brian,Good questions.If the router connects to the switch on a VLAN 1 access port then it is a non-issue since the packets are not tagged.If there is a trunk between the router and the switch with tagged traffic, then I would recommend using inside and outside VLANs on the switch. Essentially this is just two VLANs, one for each Wanos interface so that it sits in the middle of the traffic flow. For example the gateway would say be in a VLAN 100 sub-interface on the router. Wanos wan0 would be in VLAN 100 and the lan0 interface remain in VLAN 1 along with the devices. The only way to the gateway is through the bridge. The bridge deployment is almost always the simplest way to get going, but where it is not possible, router mode is also available.Express will be ok for one remote location and if either direction across the WAN is...

Ok, I'm getting ready to setup Wanos for a test run at one of our remote locations. I'm seeing packet loss on the circuit to this specific site and I want to test the packet loss recovery capability of Wanos. Our network topology is point to multipoint with MPLS connections between our main location and each of our 7 remote offices. So at our main location if I read correctly I would have to add a bypass rule for all the other offices that do not have a Wan optimization device.I have to preface my question with this... we have VLAN tagging going on at the remote locations for data and voice. The switch is ultimately responsible for the tagging of the packets. The IP phones and computers are both on completely different networks. The devices are assigned their IP's from the router through DHCP with the data VLAN 1 as the default. The...
This topic first appeared in the Spiceworks Community

VLAN Configuration for Internal and Guest Wireless

Hello,
We are using the following hardware…
SG300-52MP switch -- latest firmware
ASA 5512-X firewall -- 9.1
Aironet AP1131AG WAP
We have the following networks…
10.252.4.0/24 = Internal = ASA-01 interface = VLAN1
10.252.6.0/24 = Guest = ASA-02 interface = VLAN6
10.252.6.0/24 = VOIP = ASA-03 interface = VLAN3
The Aironet supports two SSIDs, Secure (RADIUS) and Guest (WPA2), which are supposed to provide access to the appropriate interface on the ASA.
Relevant parts of the WAP configuration are…
dot11 ssid GUEST
vlan 6
dot11 ssid SECURE
vlan 1
interface Dot11Radio0
no ip address
ssid GUEST
ssid SECURE
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface Dot11Radio0.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface Dot11Radio1
no ip address
no ip route-cache
ssid GUEST
ssid SECURE
interface Dot11Radio1.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface Dot11Radio1.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface FastEthernet0
no ip address
no ip route-cache
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
interface FastEthernet0.6
encapsulation dot1Q 6
no ip route-cache
bridge-group 255
interface BVI1
ip address 10.252.4.4 255.255.255.0
no ip route-cache
ip default-gateway 10.252.4.1
We can manage the WAP through it’s Internal IP address (10.252.4.4).
And the “Guest” wireless network is working -- connecting to that SSID provides the client with the correct IP addressing (10.242.6.X from VLAN6/ASA-02). [Note: the VOIP DHCP and network access also works correctly.]
The “Secure” wireless network is not working however -- the client never receives an Internal DHCP address from ASA-01, and even if you hard-code the client’s IP, no IP4 traffic ever passes.
[Note: connecting a device to a SG300 port with the “Default” configuration provides the client with an Internal DHCP configuration, and it works as intended.]
While this may be a problem with the WAP configuration, I would like to confirm that it is not an issue with the switch not passing traffic correctly.
I have a feeling that I have configured the VLANs on the ports incorrectly.
Relevant parts of the SG300 configuration are...
v1.3.0.62 / R750_NIK_1_3_647_260
vlan database
vlan 3,6
ip dhcp snooping
ip dhcp relay address 10.252.4.1
ip dhcp relay enable
bonjour interface range vlan 1
interface vlan 1
ip address 10.252.4.2 255.255.255.0
no ip address dhcp
interface vlan 3
name VOIP
interface vlan 6
name Guest
interface gigabitethernet45 -- Access mode, Untagged VLAN6
description ASA-Guest
ip dhcp snooping trust
switchport mode access
switchport access vlan 6
interface gigabitethernet46 -- Access mode, Untagged VLAN3
description ASA-VOIP
ip dhcp snooping trust
switchport mode access
switchport access vlan 3
interface gigabitethernet47 -- Trunk mode, Untagged VLAN1 and Tagged VLAN6
description WAP1
switchport trunk allowed vlan add 6
interface gigabitethernet48 -- Trunk mode
description ASA-Internal
ip dhcp snooping trust
ip dhcp relay enable
Can someone who understands this switch better than I do please confirm the VLAN configuration? THANK YOU!

Welcome to the discussion area!
+PCI regulations do not consider VLAN a secure way of keeping the data isolated. Does anyone have any technical information on how the device creates the guest wireless network ?+
I spoke to Apple Support some time ago and was told that Apple uses VLAN to create the Guest network, and also that formal documentation was not available on this topic. I was referred to the AirPort Extreme Specifications for available information.
This was some time ago, so if you need more up to date info, you might want to try to contact Apple to see if they are willing to share more information about this feature. Although, since VLAN is used, your question may already be answered.
FWIW, to use the Guest Network feature in a home situation, the AirPort Extreme must be set up as the main router controlling DHCP and NAT on the network. If you were thinking of installing the AirPort Extreme behind another router, the Guest Network feature would not be available in this type of configuration.

FCoE Native VLAN Configuration

Hi
One question about FCoE Configuration
Is better to permit the Native VLAN (FIP VLAN) in the allowed trunk vlans or just left it in the native vlan configuration
Here the two choices showing my doubt
VLAN 1197
name FIP_VLAN
VLAN 1198
name FCOE_VLAN
fcoe vsan XX
01)
interface EthernetX/X
switchport
switchport mode trunk
switchport trunk native vlan 1197
switchport trunk allowed vlan 1197,1198
spanning-tree port type edge trunk
or
02)
interface EthernetX/X
switchport
switchport mode trunk
switchport trunk native vlan 1197
switchport trunk allowed vlan 1198
spanning-tree port type edge trunk

Hi,
Usually when you add it to the trunk as native, you don't to add again. So, option-2
HTH

SAP-JEE, SAP_BUILDT, and SAP_JTECHS and Dev Configuration questions

Hi experts,
I am configuring NWDI for our environment and have a few questions that I'm trying to get my arms around.
I've read we need to check-in SAP-JEE, SAP_BUILDT, and SAP_JTECHS as required components, but I'm confused on the whole check-in vs. import thing.
I placed the 3 files in the correct OS directory and checked them in via the check-in tab on CMS.   Next, the files show up in the import queue for the DEV tab. My questions are what do I do next?
1. Do I import them into DEV? If so, what is this actually doing? Is it importing into the actual runtime system (i.e. DEV checkbox and parameters as defined in the landscape configurator for this track)? Or is just importing the file into the DEV buildspace of NWDI system?
2. Same question goes for the Consolidation tab.    Do I import them in here as well?
3. Do I need to import them into the QA and Prod systems too? Or do I remove them from the queue?
Development Configuration questions ***
4. When I download the development configuration, I can select DEV or CON workspace. What is the difference? Does DEV point to the sandbox (or central development) runtime system and CONS points to the configuration runtime system as defined in the landscape configurator? Or is this the DEV an CON workspace/buildspace of the NWDI sytem.
5. Does the selection here dictate the starting point for the development? What is an example scenarios when I would choose DEV vs. CON?
6. I have heard about the concept of a maintenance track and a development track. What is the difference and how do they differ from a setup perspective?   When would a Developer pick one over the over?
Thanks for any advice
-Dave

Hi David,
"Check-In" makes SCA known to CMS, "import" will import the content of the SCAs into CBS/DTR.
1. Yes. For these three SCAs specifically (they only contain buildarchives, no sources, no deployarchives) the build archives are imported into the dev buildspace on CBS. If the SCAs contain deployarchives and you have a runtime system configured for the dev system then those deployarchives should get deployed onto the runtime system.
2. Have you seen /people/marion.schlotte/blog/2006/03/30/best-practices-for-nwdi-track-design-for-ongoing-development ? Sooner or later you will want to.
3. Should be answered indirectly.
4. Dev/Cons correspond to the Dev/Consolidation system in CMS. For each developed SC you have 2 systems with 2 workspaces in DTR for each (inactive/active)
5. You should use dev. I would only use cons for corrections if they can't be done in dev and transported. Note that you will get conflicts in DTR if you do parallel changes in dev and cons.
6. See link in No.2 ?
Regards,
Marc

Application Administrators can't see VLAN configuration on VMs in VMM 2012 R2

Hi, I have the following issue on my VMM 2012 R2 infrastructure.
I have created a cloud with a Hyper-V Cluster in it. Configured a Application Administrator Role (Self Service) and assigned all permissions related to this cloud and Hyper-V Cluster, including a couple of VM Templates and a VM Network.
They users can see the VMs, create VMs but they cannot configure the VLAN inside the VM.
If I go to the VM settings using the full VMM admin, I can do it, select the VM Network and then select the appropiate VLAN, but when I try to do this using the Application Administrator account I configured specifically to this Cloud and Cluster, I can
select the same VM Network but can't see any options related to VLAN configuration.
What am I missing? Is this the default behavior? Do I need an additional permission? Where?
Thank you for your responses.
Regards.
Eduardo Rojas

That is correct.
Application Admins 'consume' resources (compute and storage) and have no insight into the physical part. Especially if you are using the cloud abstraction. "Administrators" manage the physical layer of things - that is why you can see
/ set the VLAN ID directly.
I believe that you would need to create your Virtual Networks with the proper VLANs and the application admins can then choose based on the Virtual Network.
The worst case is that you define a Virtual Network per VLAN so that your application admins can select an item that correlates to a specific VLAN configuration.
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

Fwsm - active/standby - "Vlan configuration mismatch between peers"

Hi,
A FWSM pair fall in to active active sittuation due to a vlan configuration mismatch. What would be the best way to synchronize configurations and return to the normal active/standbay? There is a new vlan on the primary fwsm and at present both are in active state.
Thank you in advance.
Zdravko

Hi,
To my understanding the FWSMs (even though both active) have identical configurations?
Have you perhaps done so that on the core switch you have only issued the "firewall vlan-group only on the primary core device (to which the FWSM is attached) and not the secondary core device?
The only time I have witnessed the same situation is when configuring a new customer link and I have only configured the primary unit (and about to configure the same on the standby unit)
Hope it helps, not sure if the above was what you meant.
- Jouni

SF300-24P VLAN CONFIG QUESTION

Hi please excuse my ignorance and lack of knowledge in this field as I am a complete newbie when it comes to Cisco switches and VLANS etc. but trying to learn.
I have a Cisco 300-24P and need to create two separate networks (private and public) ports 1 - 10 for Private and ports 11 - 20 for Public. I then to need ports 21 - 24 for access points and that can access both private and public.
I am assuming that would need to create two vlans (e.g. VLAN100 for private and VLAN200 for public). After reading a little I think I need to set ports 1- 20 to "access" and ports 21- G4 to "trunk".
I have attempted this but don't think I have things quite right. Would it be possible for someone to either point me in the right direction or even send me a saved config that I could load and examine.
Many thanks in advance for your help.

Hello,
I think I can clarify a few things for you:
1- The ports that are going to connect directly to end stations will need to be configured as access ports with the respective VLAN as untagged.
2- The ports that are going to be connected to the AP's will need to be configured as trunks with VLAN 100 un-tagged and 200 tagged. The AP should be able to understand VLAN's, they should be configured with and IP address on VLAN 100.
3- By default, the un-tagged VLAN is the same PVID.
Notes:
A few things to keep in mind:
1- I see you already have a router on the network, this is the one that will determine if the VLAN's can talk to each other based on the Inter VLAN configuration. In general terms, if inter VLAN is enabled on the router then Public and Private will be able to share traffic, otherwise they wont.
2- When creating VLAN's on the SG300 make sure that you are not assigning IP addresses to any other VLAN than your management VLAN, otherwise you could have issues with the routing.
3- To make sure the connectivity between the VLANs is working as you expect, make sure to do all the testing from the hardwired PC's first, that way you will know if the issue is on the router or the switch.
I hope this was helpful.

Basic Vlan routing question

I am connecting a 4503 to a 2950. I have native Vlan 1 between them on the trunk. On that vlan 1 the subnet is 172.16.138.0. The default gateway on the 2950 is 172.16.138.1. There are devices attached to the 2950 that are all subnet 172.16.98.0. I need to be able to get those devices to talk to the 4503. The only vlan I had on the 2950 is vlan 1. I made another vlan on the 2950 but when I try to no sh it I get kicked out of the switch. Any ideas?

The 2950 is a L2 switch and can only have a single vlan interface for management. When you're creating a new vlan, it's kicking you out because the 4500 doesn't have the vlan configured to support the new vlan that you're creating. That being said, you should be able to do the following to route your other subnet:
If the 4500 vlan 1 subnet is 172.16.138.0/24, and you're wanting to create 172.16.98.0/24, you'll need to do it on the 4500.
4500: (Assuming you want to create vlan 10)
vlan 10
int vlan 10
ip address 172.16.98.1 255.255.255.0
Then you'll need to trunk the port that leads to the 2950 - assume that's fa0/1
int fa0/1
switchport trunk encaps dot1q
switchport mode trunk
Then on the 2950, you'll need to keep your vlan 1 interface:
int vlan 1
ip address 172.16.138.2 255.255.255.0
ip default-gateway 172.16.138.1 <-- this is to get to the management vlan interface above from another subnet
Then create your vlan that matches on the 4500 (vlan 10)
vlan 10
Trunk the port that leads to the 4500 (assuming f0/1)
int fa0/1
switchport trunk encaps dot1q
switchport mode trunk
Then the ports that you want on vlan 10, you'll put in the vlan:
int range fa1/2-48
switchport mode access
switchport access vlan 10
Your hosts will use 172.16.98.1 as a default gateway, but that traffic will be routed at the 4500 series switch. The 2950 cannot do the routing for you, but it can carry the vlan information that you need.
HTH,
John
*** Please rate all useful posts ***

CiscoWorks: VLAN creation failed via CM-VLAN Configuration

Hi,
I have trying to create VLAN on single switch via CM-VLAN Configuration and getting below message, although switch is configured with correct snmp and I can backup same device via RME and also delopy config to it via Netconfig.
Please advice. Thanks
I am using LMS 3.2.1; CM 5.2.2; RME 4.3.2
Creation of VLAN failed
"There were some errors during operation."
Failed to perform the operation on 10.*.*.* Cause:An error occured while performing SNMP operation.
Action:Examine and save the server log file and report the error to the product administrator for further action.

The credentials can be changed under Common Services > Device and Credentials > Device Management. Select the devices and click the Edit Credentials button. Fill in the correct username and password for these devices.

Multiple SSID With Multiple VLANs configuration on Cisco Aironet APs: Assotiated clients cannot obtain IP addresses

Hi Surendra,
I was just given this task to see how i can configure a second ssid for guest access in our environment.
this is our network setup prior to this request: Internet----Firewall (not ASA)---ce520---C1131AG and CME router is also connecting to the ce520 switch. we only have two vlans: one for voice and two for data.
Presently, there is no vlan configured on the AP because it on broadcasting ont ssid and wireless users gets IP from a windows DHCP server on the LAN. the configuration on the ce520 switch port for the AP and other switches say access vlan is the DATA vlan which automatically becomes the native vlan for all trunk port connecting the AP and other Stiches to the network.
Now with this new requirement, i have made my research and i have configured the AP to broadcast both the production and the guest Vlans. The two vlans are 20-DATA and 60-Guest. I made the DATA vlan on the AP the native vlan since the poe switch is using the DATA vlan as native on the trunk ports. I configured the firewall to serve as DHCP server for the guest ssid and i have added the ip helper-address on the guest vlan interface on all switches while the windows server remains the dhcp server for the production DATA Vlan. I have confirmed that the AP, switches can ping the default gateway of the guest dhcp server which is another interface on the firewall. I can now see and connect to all broadcasted ssids but the problem is I am not getting IP addresses from both the production dhcp server and guest dhcp server when i connected to the ssid one at a time.
My AP config is attached below.
Please tell me what am I doing wrong.
Do i need to redesign the whole network to have a native vlan other nthan the data vlan?
Does the access point need to be aware of the voice vlan?
Do the native Vlan on the AP need to be in Bridge-group 1 or can i leave it in bridge-group 20?
I will greatly appreciate your urgent response.
Thanks in advanced.

Hi,
As far as i know we dont set the ip helper address on the radio interface. It should be on the L3 interface of corresposding VLANs i.e.
int vlan 20
ip helper-address 192.168.33.xxx
int vlan 60
ip helper-address 130.20.1.xxx
I'm assuming that your using SVI's (int Vlan 20 and int Vlan 60) rahter than physical interfaces. Also hope you have configured switch port as trunk where this AP is connected.
Modify the AP config as below since you are using data vlan as the native vlan
interface Dot11Radio0.20
encapsulation dot1Q 20 native
interface FastEthernet0.20
encapsulation dot1Q 20 native
Ideally your AP fastethernet configuration should looks like below and not sure how you missed this as this comes by default when you have multiple vlans for multiple ssids.
interface FastEthernet0.20
encapsulation dot1Q 20 native
no ip route-cache
bridge-group 20
no bridge-group 20 source-learning
bridge-group 20 spanning-disabled
interface FastEthernet0.60
encapsulation dot1Q 60
no ip route-cache
bridge-group 60
no bridge-group 60 source-learning
bridge-group 60 spanning-disabled
Hope this helps.
Regards
Najaf

Configuration question on css11506

Hi
One of our vip with 4 local servers, currently has https. the http is redirected to https.
Now, my client has problem which a seriel directories need use http, not https. some thing like. quistion:
     1. If there is any possible, I can configure the vip to filter the special directories and let them to use http not https. and rest pages and directories redirect to https?
     2. If not, I can make another vip to use same local servers, but, is possible to only limited to special directories? and with wild code? some like the directories are partially wild coded, something like, http://web.domain/casedir*/casenumber?
     3. if not on both option, is any way I can fix this problem?
Any comments will be appreciated
Thanks in advance
Julie

I run my Tangosol cluster with 12 nodes on 3
machines(each machine with 4 cache server nodes). I
have 2 important configuration questions. Appreciate
if you can answer them ASAP.
- My requirement is that I need only 10000 objects to
be in cluster so that the resources can be freed upon
when other caches are loaded. I configured the
<high-units> to be 10000 but I am not sure if this is
per node or for the whole cluster. I see that the
total number of objects in the cluster goes till
15800 objects even when I configured for the 10K as
high-units (there is some free memory on servers in
this case). Can you please explain this?
It is per backing map, which is practically per node in case of distributed caches.
- Is there an easy way to know the memory stats of
the cluster? The memory command on the cluster
doesn't seem to be giving me the correct stats. Is
there any other utility that I can use?
Yes, you can get this and quite a number of other information via JMX. Please check this wiki page for more information.
I started all the nodes with the same configuration
as below. Can you please answer the above questions
ASAP?
<distributed-scheme>
<scheme-name>TestScheme</scheme-name>
<service-name>DistributedCache</service-name>
<backing-map-scheme>
<local-scheme>
<high-units>10000</high-units>
<eviction-policy>LRU</eviction-policy>
<expiry-delay>1d</expiry-delay>
<flush-delay>1h</flush-delay>
</local-scheme>
</backing-map-scheme>
</distributed-scheme>
Thanks
RaviBest regards,
Robert

Configuration Question on local-scheme and high-units

I run my Tangosol cluster with 12 nodes on 3 machines(each machine with 4 cache server nodes). I have 2 important configuration questions. Appreciate if you can answer them ASAP.
- My requirement is that I need only 10000 objects to be in cluster so that the resources can be freed upon when other caches are loaded. I configured the <high-units> to be 10000 but I am not sure if this is per node or for the whole cluster. I see that the total number of objects in the cluster goes till 15800 objects even when I configured for the 10K as high-units (there is some free memory on servers in this case). Can you please explain this?
- Is there an easy way to know the memory stats of the cluster? The memory command on the cluster doesn't seem to be giving me the correct stats. Is there any other utility that I can use?
I started all the nodes with the same configuration as below. Can you please answer the above questions ASAP?
<distributed-scheme>
<scheme-name>TestScheme</scheme-name>
<service-name>DistributedCache</service-name>
<backing-map-scheme>
<local-scheme>
<high-units>10000</high-units>
<eviction-policy>LRU</eviction-policy>
<expiry-delay>1d</expiry-delay>
<flush-delay>1h</flush-delay>
</local-scheme>
</backing-map-scheme>
</distributed-scheme>
Thanks
Ravi

I run my Tangosol cluster with 12 nodes on 3
machines(each machine with 4 cache server nodes). I
have 2 important configuration questions. Appreciate
if you can answer them ASAP.
- My requirement is that I need only 10000 objects to
be in cluster so that the resources can be freed upon
when other caches are loaded. I configured the
<high-units> to be 10000 but I am not sure if this is
per node or for the whole cluster. I see that the
total number of objects in the cluster goes till
15800 objects even when I configured for the 10K as
high-units (there is some free memory on servers in
this case). Can you please explain this?
It is per backing map, which is practically per node in case of distributed caches.
- Is there an easy way to know the memory stats of
the cluster? The memory command on the cluster
doesn't seem to be giving me the correct stats. Is
there any other utility that I can use?
Yes, you can get this and quite a number of other information via JMX. Please check this wiki page for more information.
I started all the nodes with the same configuration
as below. Can you please answer the above questions
ASAP?
<distributed-scheme>
<scheme-name>TestScheme</scheme-name>
<service-name>DistributedCache</service-name>
<backing-map-scheme>
<local-scheme>
<high-units>10000</high-units>
<eviction-policy>LRU</eviction-policy>
<expiry-delay>1d</expiry-delay>
<flush-delay>1h</flush-delay>
</local-scheme>
</backing-map-scheme>
</distributed-scheme>
Thanks
RaviBest regards,
Robert

EA6500 - VPN interface and VLan configuration feature?

Does EA6500 has any kind of built-in VPN interface and also built-in VLan configuration feature??

This particular router has VPN passthrough and you may open ports when needed for VPN to work behind it. As for VLAN configuration, this router is not designed for that. Everything that you would like to know about the router just click here

Getting past "Fetch VLAN configuration - Command failed" errors in Cisco Prime Infrastructure 2.0 - How?

I've got a handful of devices in Cisco Prime Infrastructure 2.0 which show up in the "Archive Failed Devices" view. The "Failure Reason" is some variation of "Fetch VLAN configuration - Command failed" sometimes including "TELNET: Failed to establish TELNET connection to x.x.x.x". What does this mean? How do I overcome this? In all cases, the device is configured to use SSH and has valid SSH credentials. In all cases, I can SSH from the command line of the NCS appliance to the devices listed in the "Archive Failed Devices" view.

Hi
I was able to fix the "Fetch VLAN configuration - Command failed" by allowing tftp from the device to PI server in firewall. See if this can help.

SA540 VLAN Configuration Question

Similar Messages

Maybe you are looking for