Setting up VLANS for WAPS on 3850 switches

This may not be the right forum to ask, but I have asked under LAN switching and routing and have not gotten any help, so maybe posting here will help - here is what I need help with:
Set up two SSID's on four autonomous 1600 series WAPs - one for employees wireless network access and one for customer guest access, both password protected. We have two 3850 switches, stacked. The WAPS are plugged into ports 41 and 42 on each switch. I know I need two separate VLANs - one for each SSID, but don't know how to do this on the switches - can someone help me with the syntax of the commands to apply to the switch?
Here is the configuration of the port now:
interface GigabitEthernet1/0/41
switchport trunk allowed vlan 1,10,11,1001-1005
switchport mode trunk
switchport voice vlan 11
trust device cisco-phone
spanning-tree portfast
service-policy input AutoQos-4.0-CiscoPhone-Input-Policy
service-policy output AutoQos-4.0-Output-Policy
end
Thank you

Hi Steve,
Here is the configs, try this & see. modify <> content as you want. I have shown one AP config. You can assign different IP/hostname to the 2nd AP. Make sure you erase AP current config & apply below.
conf t
hostname <AP-01>
dot11 ssid A4HS
vlan 10
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii <A4HS_PASSWORD>
dot11 ssid A4HS-Guest
vlan 20
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii <A4HS-Guest_PASSWORD>
interface Dot11Radio0
encryption vlan 10 mode ciphers aes-ccm
encryption vlan 20 mode ciphers aes-ccm
mbssid
ssid A4HS
ssid A4HS-Guest
no shut
interface Dot11Radio1
channel width 40-above
encryption vlan 10 mode ciphers aes-ccm
encryption vlan 20 mode ciphers aes-ccm
mbssid
ssid A4HS
ssid A4HS-Guest
no shut
interface Dot11Radio0.10
encapsulation dot1Q 10
bridge-group 10
interface Dot11Radio0.20
encapsulation dot1Q 20
bridge-group 20
interface Dot11Radio0.1
encapsulation dot1Q 1 native
bridge-group 1
interface Dot11Radio1.10
encapsulation dot1Q 10
bridge-group 10
interface Dot11Radio1.20
encapsulation dot1Q 20
bridge-group 20
interface Dot11Radio1.1
encapsulation dot1Q 1 native
bridge-group 1
interface GigabitEthernet0.10
encapsulation dot1Q 10
bridge-group 10
interface GigabitEthernet0.20
encapsulation dot1Q 20
bridge-group 20
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
bridge-group 1
interface BVI1
ip address 192.168.0.31 255.255.255.0
ip default-gateway 192.168.0.2
end
write memory
Here is the switch configs. I hope you have defined DHCP pools for vlan 10/20 on your DHCP server (192.168.0.101).
interface GigabitEthernet1/0/41
Description AP-01
switchport trunk allowed vlan 1,10,20
switchport mode trunk
spanning-tree portfast trunk
interface GigabitEthernet1/0/42
Description AP-02
switchport trunk allowed vlan 1,10,20
switchport mode trunk
spanning-tree portfast trunk
interface Vlan10
ip address <x.x.x.x> 255.255.255.0
ip helper-address 192.168.0.101
interface Vlan20
ip address <x.x.x.x> 255.255.255.0
ip helper-address 192.168.0.101
**** Pls do not forget to rate our responses if you find them useful ****
HTH
Rasika

Similar Messages

How to set up VLANs for Cisco SG500 - 28 switch

Hi,
First of all, this is my first post in here, I hope someone can help me, and please be patient since I am very little experienced.
OK, so let me explain you the scenarion that I am facing and hopefully someone will be able to help me.
We have a Cisco SG500 - 28 port gigabit switch in our workplace.
Our goal, is to create 3 VLANs and seperate the networks between different departements.
VLAN1 (which is the default VLAN in the switch) - will be used for IT department and the management.
VLAN100 - will be used for business .
VLAN200 - will be used for guests who need to connect to the internet through WiFi.
I have created VLAN100 and VLAN200, and VLAN1 is there by default.
I want to use port 13 for VLAN200 and to connect the Wifi access-point there.
The uplink is in port 25.
I would be glad if you could explain me the stuff first in a abstract more general level, and then we can look at the specific scenario that we have.
The Cisco SG500 - 28 gets internet from a Sophos UTM 9 router.
I will need to take care of inter-VLAN routing as well, and subnet, and DHCP
Thanks in advance,
Kindest regards,
D

Hello Desmond,
You have two different options:
Option 1:
Configure Sg500 switch as a Layer 2 switch and let the Sophos firewall do all the Layer 3 routing along with internet access. If you choose this option, then, you need to configure your uplink port as a trunk port and allow all 3 vlans to pass through. Also, you need to make sure that the Sophos device supports VLANs and trunking (or at least sub interfaces and create sub interfaces for each vlan). Also, all LAN devices will have the respective sub-interface/VLAN interface IP on the Sophos as their default gateway.
Option 2:
Configure SG500 switch as a Layer 3 device and configure intervlan routing to manage internal network traffic locally and send just the internet traffic to Sophos device.
You need to create Layer 3 interfaces for VLAN1, VLAN100, and VLAN200 on SG500 and then make those Layer 3 interfaces default gateway for respective VLAN.
You can configure the uplink port as an access port in one of the VLANs.
Make sure that the Sophos device has an IP on the same subnet as the VLAN you chose for the uplink port.
You also need to enter static routes on the Sophos device for the remaining two subnets on the SG500 (next hop address pointing to the IP address of the VLAN that the uplink port belongs to).
Also, on the SG500, you need to configure a default route, next hop address pointing to the Sophos interface IP address.
Hope this helps.
Nagaraja

I like to watch tvcatchup or sky go or I player on my iPad while falling asleep, the problem is that the iPad then stays on all night. I would like to find an app that allows me to set a timer for the iPad to switch itself off automatically.

I like to watch tvcatchup or sky go or I player on my iPad while falling asleep, the problem is that the iPad then stays on all night. I would like to find an app that allows me to set a timer for the iPad to switch itself off automatically, like the sleeper function on a TV.
Does such an app exist? Can anyone help me? Thanks

You can try the Sleep Timer.
https://itunes.apple.com/sg/app/music-sleep-timer/id320583424?mt=8

How to set up VLAN for DATA and VOIP on SRW248G4P switch?

Hi guys,
I am totally new and was given this task to complete. I really really need help.
We are using one network 192.168.1.0
Shared with data and voip.
CISCO C870, 5 switches LINKSYS SRW248G4P .
The email wrote:-
On the Linksys switch;
- create two different VLANs one for voice and one for data.
- put a firewall between the two VLANs (between voice and data) and only enable certain ports to flow to voice network (inbound tcp 8443 and ssh )
What should i do guys? I really need a dumb guide now.
I know its simple for you guys but i am not a smart IT fella. Whats the step by step?

If the switch is new or you have support on this, then you might try calling the support center. Here is a link:
https://www.myciscocommunity.com/community/smallbizsupport
On the right hand side you can find links to the support center.
Here is a link to the guide:
http://www.cisco.com/en/US/products/ps9967/prod_maintenance_guides_list.html
@ the bottom of this link you can find your switch model, you want the larger of the two. In this guide it shows you how to create a second vlan.
Will your router be the firewall between the two?
Kindest regards,
Andrew Lissitz

Xfce: Set Applikation icon for taskbar and task switcher

Hi Community,
I'm facing a Problem with icons in xfce: some applications don't seem to have the correct ones in the task switcher (alt+tab) and the task bar. A default icon is shown instead. This happens for example with gedit and urxvt.
Screenshot:
http://i.imgur.com/DsgNBRi.png
I use whisker menu as startmenu/appstarter and the icons are correct there. (They are also correct in Dockbarx)
How can I set icons for the taskbar/-switcher? Do I need icons with specific sizes in /usr/share/icons?
Thanks in advance!
-- mod edit: read the Forum Etiquette and only post thumbnails http://wiki.archlinux.org/index.php/For … s_and_Code [jwr] --
Last edited by ilike (2013-10-26 11:23:47)

Yeah, the problem seems to be quite common.
Similar Topics:
http://crunchbang.org/forums/viewtopic.php?id=14909
https://bbs.archlinux.org/viewtopic.php?id=167517
http://askubuntu.com/questions/292700/s … task-icons
http://forum.manjaro.org/index.php?topic=6432.0
Nethertheless, no solution suggested on these sites worked for me. ;(
I also reinstalled gedit (sudo pacman -Rns gedit && sudo pacman -S gedit) which didn't work and I created a new user account (and changed the themes) to preclude that something is wrong with the settings in my home directory. It's funny that xfce4-terminal displays the icon correctly in the taskbar/-switcher because it uses the same "Icon=utilities-terminal" setting as urxvt in its .desktop file in /usr/share/applications.
Edit: After reading this post I installed rxvt-unicode-patched (aur) instead of rxvt-unicode from community. The urxvt icon can be set now in the .Xdefaults-File:
URxvt*iconFile: /usr/share/icons/Moka/256x256/apps/utilities-terminal.png
The Icon-Setting in /usr/share/applications/urxvt.desktop seems to be applied only for the startmenu.
Last edited by ilike (2013-10-26 14:40:03)

RV082 - Vlans for guest access

Hello,
I have an RV082 router which supports port based VLANs. I have a WAP that I want to use to provide guest internet access which cannot see our production vlan. I plugged the WAP into port 8 and set the vlan for port 8 to vlan 2. Here's the part where I'm confused. I am unable to get an IP address when connecting to the WAP because our DHCP server is a windows box on vlan 1. So, I tried using the DHCP relay option and entering the ip address of the windows box DHCP server. I am still not able to retrieve an IP address when connecting to the WAP. Someone mentioned setting up an ip helper address. I connected to the CLI of the RV082 but could not figure out the syntax of how to set up the ip helper address. Any help with any of this would be much appreciated. I only have about a week to set this up so I have to figure something out.

Mr. MacKay,
Since the RV082 don't support vlan tagging, you could get a layer 3 switch and create the vlans there and setup a dhcp relay to a server for the vlan ip addresses.
Then it would be just setting up static routes in the switch pointing to the router as the default gateway and finally doing routes back from the rv082 for the vlan you created.
A quick solution would be get a wireless router and set it up by plugging the wan into your network and setting the lan on a totally different ip address scheme. Then only allow access to the rv082 on that network and deny the rest of the network access to the guest and vice versa.
Kind of a work around.
The quickest fix would be getting a vlan aware router like rvs4000 or the wireless version wrvs4400n and if you need dual wan with vlans and wireless you could go with the sa520w.

Vlan for dmz

Can anyone tell me how to do a simple dmz on my router, its got 2 ethernet interfaces, I have set up a vlan for this on my switches, its for a e-mail server, !!
Thanks
Carl

check out the following link :
http://www.cisco.com/en/US/products/sw/iosswrel/ps5413/products_feature_guide09186a0080235e23.html

Solarwinds Netflow products what will work with a 3850-switch

Does anybody know….what Solar winds product will do Net Flow with Cisco 3850-switches? I know Net Flow Configurator will not work….but what about Net Flow Real-time for a Cisco 3850 switch?

For a lot of people, it is not neccessary. I used to ask myself that question until I came across a need for things that iLife and the Finder would not do.
Toast is a great program with a lot of features that just are not standard on a Mac.
You can make music DVDs. You can span a HD backup over multiple disks. You can make hybrid PC/Mac disks. It has DVD compression tools to fit a 8.5GB dual-layer DVD onto a single layer 4.7GB DVD.It suppoprts OGG and FLAC audio formats. You can turn your iMovie and iDVD projects into DivX disks.
It also has lots of nice tools to clean up audio that is imported from a noisy source - like vinyl.
It is all in all a very useful program, but not unless you need any of those features of course.

How many Cisco Catalyst 3850 switches can make up a Cisco StackPower stack?

I know the number of Cisco 3850 switches for stacking is 9, so, if I make up a Cisco StackPower stack, MAX is 9, too?

Hi, emma, only 4 switches can become part of the same Cisco StackPower stack in a ring topology.
For the Cisco 3850 switches stack number,there are two types:
Up to 9 Cisco Catalyst 3850 switches can be stacked together to build single logical StackWise-480 switch since Cisco IOS XE Release 3.3.0SE. Prior to Cisco IOS XE Release3.3.0SE, up to 4 Cisco Catalyst 3850 switches could be stacked together.

Cisco Catalyst 3850 switches

How many Cisco Catalyst 3850 switches can stack into a single logical entity?

Hi, emma, only 4 switches can become part of the same Cisco StackPower stack in a ring topology.
For the Cisco 3850 switches stack number,there are two types:
Up to 9 Cisco Catalyst 3850 switches can be stacked together to build single logical StackWise-480 switch since Cisco IOS XE Release 3.3.0SE. Prior to Cisco IOS XE Release3.3.0SE, up to 4 Cisco Catalyst 3850 switches could be stacked together.

Setting Up VLAN and QoS for VOIP on SG200-18

We recently purchased the SG200-18 smart switch to replace a Netgear unmanaged switch. We're moving our phone service to VOIP through our local ISP as well.
I've currently got the VOIP phone plugged into Port 17 on the SG200-18 (it's a Grandstream cordless VOIP phone).
I want to put the VOIP phone on a separate VLAN from the rest of the network and optimize the QoS settings so that the VOIP phone has exceptional audio quality even during intense network traffic.
Here's my questions:
1. Do I need to adjust anything on the type of port for Port 17 (since it looks like some form of Combo port)?
2. How do I go about isolating the VOIP phone on it's own VLAN (I'm seeing VLAN and Voice VLAN settings, not sure which one to use; I tried setting a VLAN and broke Internet connectivity to the phone until I went in and removed it)?
3. Do I need to adjust any QoS settings on the switch to better optimize the VOIP phone?
A couple of additional questions about the GS200-18 in general:
1. Do I need to adjust any of the System Time Settings on the switch? I'm in Central Time.
2. Do I need to adjust any of the Green Ethernet/Energy Saving settings or should I stick with the defaults?
Also, a couple of "getting started" side questions to Cisco:
1. I've registered a My Cisco account. What do I need to do to register my switch with Cisco and associate it with my My Cisco account?
2. What are the benefits of taking out a Cisco Small Business Support Contract, and about how much would it cost on the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.
Here's my "specs":
Switch: SG200-18
VOIP phone: Grandstream DP715 and 710 expandable handsets
Plugged into: Port 17 on the SG200-18
ISP: Local ISP (Direclynx)
Connection type: 3M down/500k up DSL, moving to a wireless connection coming up which will give us faster speeds
VOIP backend provider: VOIP Innovations
Router: Apple Airport Extreme AC model (I run all Macs and iOS devices and OS X Server on the network, so using the Apple router makes setup easier, since it doesn't QoS, trying to QoS and VLAN at the switch level)
Thanks everyone!

Hello,
Lots of different questions here so I'll try to make sure I don't miss anything.
1. Do I need to adjust anything on the type of port for Port 17 (since it looks like some form of Combo port)?
The way the combo ports work is you can either use the SFP slot for a fiber connection or the copper ethernet port, but not both at the same time. Other then that they just function as normal network ports.
2. How do I go about isolating the VOIP phone on it's own VLAN (I'm seeing VLAN and Voice VLAN settings, not sure which one to use; I tried setting a VLAN and broke Internet connectivity to the phone until I went in and removed it)?
It sounds like you created the VLAN correctly and assigned the phone, however there wasn't anything doing any routing for that VLAN. You would need to have a VLAN capable router or a layer 3 switch so that something would act as the default gateway for the voice VLAN and route the traffic for you. Since there was nothing like this your phone lost it's connectivity to the internet when you placed it in the new VLAN. I don't think the Airport is VLAN capable, but we will come back to that.
3. Do I need to adjust any QoS settings on the switch to better optimize the VOIP phone?
Once you have a seperate VLAN setup for the phone properly you only have to tell the switch what your Auto Voice VLAN is going to be and it will automatically apply recommended QoS settings for the Voice VLAN and prioritize the voice traffic. There are ways to do this manually and even with the phone in the same VLAN however the are considerably more complicated.
1. Do I need to adjust any of the System Time Settings on the switch? I'm in Central Time.
The system time isn't always very important. You can set the correct time zone, however you should know the switch does not have a battery in it to keep track of time, so if/when it reboots or loses power the clock will reset. If you would like the switch to maintain accurate time you should setup an NTP server so the time is automatically updated from the internet. The switch will keep your timezone settings once you save them. Time is mostly important for logging and things like that, so you can configure it if you like but it is not necessary.
2. Do I need to adjust any of the Green Ethernet/Energy Saving settings or should I stick with the defaults?
Green ethernet simply reduces the power usage of the switch slightly, so unless you are having odd issues where ports are disconnecting, I would just leave them at the defaults.
1. I've registered a My Cisco account. What do I need to do to register my switch with Cisco and associate it with my My Cisco account?
There isn't really a way to associate your Small Business devices with your Cisco account. If you ever call in for technical support we will use your Cisco account and your serial number to create a support case, but even then they aren't linked together. If you decide to buy a support contract, that will be linked to your switch's S/N and your Cisco ID, so in a way that would associate them together. Devices being associated with Cisco accounts is something more common with Enterprise equipment, and mainly has to do with technical support cases.
2. What are the benefits of taking out a Cisco Small Business Support Contract, and about how much would it cost on the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.
There are a few advantages to a Support Contact. Your switch comes with a Limited Lifetime warranty that includes 1 year of technical support and return to factory hardware. With a service contract you get 3 years of technical support and next business day Advanced Replacement of the switch if it need to be replaced. I just did a quick google search, and it looks like a contract (part #CON-SBS-SVC2) costs about $50.
So there are a few other things to consider however.
As a frame of reference the average VOIP call uses about 64 - 128 kbps max.
Since you don't have a VLAN capable router or a layer 3 switch, a separate voice VLAN may not be an option. You also mention that the Apple Airport does not do QoS, meaning we will only be prioritizing the voice traffic while it is on the switch. When it is passed off to the Airport to be routed out to the internet all of the QoS settings will be lost, and normal network traffic will get the same priority as voice, since that is all up to the Airport.
With one phone the hassle of getting more equipment and setting up advanced QoS isn't really worth it, especially if the link to the internet isn't going to be participating in QoS.
One last thing I wanted to mention is you are switching to a wireless internet connection. I would ask them how their latency and jitter is, as these two network statistics greatly effect voice quality, and usually wireless performs worse when it comes to voice traffic.
I hope this information helps, if you have any more questions just let me know.
Thank you for choosing Cisco,
Christopher Ebert - Network Support Engineer
Cisco Small Business Support Center

Setting up a Test Voice VLAN for Lync 2013

I want to set up a second voice vlan to be a test vlan.
In the current situation the customer has voice and data running on vlan1. The customer insist on taking incremental steps to improve QoS. I have advocated separated vlans for voice and data. They just want to move everything (phase 1) to a different
vlan. They want to see how getting all traffic of vlan 1 will improve there performance. Again, I recommended the best practice, they want to try this approach first.
I am conducting a pilot test with just one cx600 IP phone. and a single switchport. I created a new vlan99 using VTP. I configured the switchports on the Cisco 2960-x switch as follows.
#switchport mode access
#switchport access vlan 99
The phone gets its correct vlan id, and pulls its IP from the correct dhcp scope. However the phone displays "connecting with the lync server" for a long time, then "connecting to download its certificates". This takes a long time then fails.
If I change the switchport back to vlan1 it works fine. What can be the problem? Does the vlan99 need to be defined on the lync server? How many vlans can be supported by Lync 2013?
Thank you,
gigiu

Did you set the VLAN Configuration for Lync Phone Edition?
You can check the following links:
http://blog.schertz.name/2011/01/manual-vlan-configuration-for-lync-phone-edition/
http://www.bricomp.com/blogs/post.cfm/dedicated-voice-vlan-for-lync-devices
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please
make sure that you completely understand the risk before retrieving any suggestions from the above link.
Lisa Zheng
TechNet Community Support

VLANs for multiple customers on the same switch accessing ISP

I have multiple customers accessing the Internet from the same ISP through the same SRW 2016. The switch is set completely at default, with all ports on VLAN 1. I want to separate all the (3) customers' traffic into 3 VLANs for security, but I want them to still access the ISP through port 1. Can I do that with this switch? How would I set port 1 so that all VLANs can send and receive packets through port 1 but still be isolated from each other on the LAN?

Hi,
I had a simular situation. In the past I didn't have a VLAN-capable modem/router and just connected the modem as a normal device to the layer2 switch (Cisco 3548XL at that time). In my setup, I gave all separated LAN's its own multi-VLAN port(s) in its own unique VLAN and the modem a single-VLAN port in its own VLAN. Next I made all the ports who needed internet access member of the modem's VLAN. A nmap scan and testing showed me that the seperated LAN's couldn't connect to eachother.
So, I don't know if i did something stupid (in security way), but it worked like a charm.
Sorry for my English ;-)

Question about setting vlan for Video Teleconference Equipment

We recently purchased some Video Teleconference equipment (Product called LifeSize). Initially we had configured a seperate vlan for VTC traffic and when a user needed to move the vtc equipment to a different room for a meeting, we would have to manually go in change the vlan assignment on the switch for that port to the VTC vlan. From my understanding, there is a way to set this up so that anytime the vtc is plugged into any switch port, the port would automatically update to the proper VTC vlan. Is there a way to configure the switch to change the vlan option anytime the VTC equipment is plugged into any switchport? We are using Cisco 3750G series switches. There is an option on the VTC equipment for vlan configuration where we can specify the vlan. However, we we set the vlan, we loose connectivity to the device. If the vlan is preconfigured on the VTC equipment, what is the proper configuration on the switch port?
Thx in advance for any help given.

You would need a radius server to do 802.1x authentication. The radius server can associate the vlan you want to use with the authentication. So basically the device connects to the switch port, the device is challenged for credentials by the switch, it responds and then the switch passes the authentication details to the radius server. If the authentication was succesful the radius server can then pass a number of attributes back to the switch one of which is the vlan the port is to be assigned to.
There is an additional issue with your setup in that generally 802.1x is used to authenticate clients which have an 802.1x supplicant on it but i suspect your equipment won't. So you can configure the mac authentication bypass feature. What happens here is the switch challenges your equipment but there is no response. Once the challenge has timed out you can configure the switch to then use the mac address of the connected device to authenticate it to the radius server.
Here is the link for configuring 802.1x on the 3750 switch -
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/sw8021x.html#wp1205506
Note the restrictions just in case they affect your setup.
As for the radius server the Cisco version is ACS. There are others but you would need to make sure they supported everything needed.
Final point. I have never used 802.1x to do dynamic vlan assignment so i can't guarantee anything.
Jon

I just recently purchased a mini iPad for my child. It was set up in the Apple store with my Apple id. I now want to create an Apple id for my child and switch it over, how can I go about that. I already downloaded some of the games from my account.

I just recently purchased a mini iPad for my child. It was set up in the Apple store with my Apple id. I now want to create an Apple id for my child and switch it over, how can I go about that. I already downloaded some of the games from my account.

With a new account, you'll need to rebuy the games.
Each user should have their own icloud account, otherwise they end up getting the same emails, contacts, calendars, notes, reminders, etc. - usually not what you want. But if all have been sharing the same itunes ID, keep it that way, you can have different IDs for itunes and icloud.
If you already have another icloud account, and want to set it up on a device, then go to Settings>icloud, scroll to bottom of screen and tap Delete Account. This only disconnects the device from that account, no data is lost on icloud. Then enter the account ID that you want to use.
To create a new icloud account, go to
http://www.apple.com/icloud/setup/

Setting up VLANS for WAPS on 3850 switches

Similar Messages

Maybe you are looking for