Sg200-sg300 vlan help

I am experimenting with a setup carrying vlan's to other parts of a building through switches.
My current config doesn't work. Anyone care to lend some brainpower?
Here is a crude drawing. https://dl.dropboxusercontent.com/u/45775353/nc-vlan-lab.pdf
Basically I want to give devices access to Vlan's 10,20, and 30 on another side of the building. We have LAG groups tagged with each vlan going to each switch. On the final switch we are using general instead of trunk port settings for the last mile to the wap.
I tried it with access, and ingress filtering on/off. Nothing worked.
I am obviously missing something.

It would be nice if they showed you all the memberships in the same screen. It does look like that for the LAG group.

Similar Messages

SG300-28 & SG200-26 VLAN routing

I have a SG300-28 and a SG200-24. Both are running the latest firmware.
I am having some major issues getting mutliple vlans to route across the two switches.
On the SG300 I am in Layer 3 mode. I have configured 4 vlans 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 and 192.168.4.0/24 (vlan 1-4). Each vlan interface is configured with .1 of the respective vlan.
I have the SG200 connected to the SG300 via the last available port on each switch. They are set to trunk. I have created the VLANS on the SG200.
What I would like to do is set ports 1-4 on the SG200 to VLAN 2. Ports 7-12 on VLAN 3, and the rest on VLAN 4.
First off I am assuming this is possible. I have tried the configuration multiple ways, I've tagged ports, not tagged ports, etc. I'm not sure where to go from here.
Any help would be appreciated.

Hello Thomas,
I am assuming you have created these VLANs on the SG300 (not just Layer 3 interfaces) as well. Also, the ports are automatically in Trunk mode. But you need to manually add VLANs that need to be tagged on those ports.
http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=78
If you have done all these steps, can you please be more specific on the issues you are facing?
Regards,
Nagaraja

SG300 Vlan IP-Helper Address issues

hi,
I am trying to set a ip-helper address on my sg300 though getting the following.
DNSWITCH01#configure
DNSWITCH01(config)#interface vlan2
DNSWITCH01(config-if)#ip helper-address 192.168.1.1
% missing mandatory parameter
DNSWITCH01(config-if)#DNSWITCH01#
DHCP server is server 2008 R2 and the range is active for that vlan and can route to vlan and devices set statically fine

Hi Konrad, DHCP cannot be used for IP helper since the switch has a DHCP-RELAY service.
-Tom
Please mark answered for helpful posts

SG200 to SG300 VLAN

Hi All,
I have a customer with several SG300's providing VLAN1 for data and VLAN10 for voice. The PC's are piggy backing off the phones and showing up in the SG300 fine:
One department has recently employed more people so we have an SG200 switch to connect the computers and phones to. I don't seem to be able to get any connectivity between the new switch and the SG300 it is connecting to. I have setup VLAN1 and 10 as per the images below:
Am I (most likely) missing something obvious here?
Thanks in advance.

If all ports are 1u, 10t between both switches then there is a different problem.
I guess it's possible the new SX200 switch can be just acting wonky. Did you upgrade any firmware before installation?
I'd probably load the newest software and reset the switch to make sure it isn't being weird with you.
-Tom
Please mark answered for helpful posts

VLAN help SG300

I've successfully setup a VLAN but....
From 192.168.1.x I can ping everything on 192.168.50.x
Inside of VLAN 50 ports 5&6 both the laptop and the nas server can talk to 192.168.50.1.
From 192.168.1.x I can access all of the 192.168.50.1 resources.
Inside VLAN 50 I can ping 192.168.50.1 but cannot access anything else inside the VLAN or out.
From the laptop 192.168.50.100 I cannot ping 192.168.50.50 (NAS) but I can ping the 192.168.50.1 gateway. I cannot ping any internet addresses.
New guy learning VLANS here. Any ideas why this is happening?

Hello,
Im glad that you were able to get it to work.
In regards to your questions:
1- How do I benefit doing this layer 2 as you suggest as opposed to doing it layer 3? It depends on your configuration, the switch, even on layer 3 won't do NAT so it won't be able to take PC's out to the internet, which means that you have to do a lo more configuration than if you just use a router and the switches on layer 2.
2- My understanding is that layer 3 is more efficient than layer 2 unless that is wrong. I don't know. Again, this is not a "One size fits all" type of configuration, depending on the amount of traffic, you may want to keep the local traffic restricted to the switch, which usually is more powerful than the router and just send the internet traffic (more lightweight) to the router.
3-If I was using a 3rd party firewall that doesn't have the Inter VLAN setting and does not support VLANS wouldn't I be suck going layer 3 to make all of this work? Yes, if you have a router that is not VLAN capable, then you will definitely have to configure your switch on layer 3 to route the VLANS and only use the router as your Gateway to the internet.
I hope this was helpful.
Please remember to mark an answer as correct if it was helpful to you so that other members can benefit from it.

SLM2008 to SG200-08 VLAN

Hi,
I have the following setup:
Service Provider connected to SLM2008 port 2
SLM2008 connected to SG300-20 using LAG2
SG300-20 connected to SG200-08 using LAG1
SG200-08 port 1 connected to PC
I have configured VLAN 4 to isolate this (port-to-port) traffic from the rest of the network, however I can't obtain an IP address from the SP.
SLM2008 : port 2 PVID 4 all frame types accepted, VLAN ID 4 assigned to port 2 and LAG 2 (consisting of port 5&6)
on the SG300-20, the Port VLAN Membership Table shows LAG1 & 2 with 1UP, 4T (so supposed to transport VLANs 1 & 4, 1 being the default)
SG200-08 shows Port VLAN Membership Table port 1 in access mode with PVID 4 and operational VLAN membership 4U. I can't put it to 4T except in generic mode, but this doesn't work either.
What am I missing here ?
Any input/feedback would be highly appreciated.
Christophe

Hi chrebert,
Thanks for your answer. You're right in concluding the VLAN 1 is my default VLAN. The problem is that the switch should contact my DHCP server over VLAN 1 and since the traffic on port 1 is not tagged, the traffic DHCP request will never reach my DHCP server. As a consequence, the switch always ends up with its factory default IP address (192.168.1.254) instead of the IP address assigned by the DHCP server. And yes, that's a problem
So to summarize, when I configure tagged access for VLAN 1 on port 1 and write this to the startup config, it is indeed present in the startup config afterwards. However, the switch ignores this upon reboot, causing VLAN 1 on port 1 to feature untagged access.
By the way, I completely set up the switch from scratch after restoring the config to factory defaults. It would be great if you could try to reproduce the issue and hopefully come with a fix. In case you need more information, please don't hesitate to contact me.

SG300 VLAN ISE

Hello,
customer is using lots of 2960-Switches and plans to implement ISE for dynamic VLAN-Assignment. Should be no problem.
For lots of small offices he wants to purchase SG300 Switches. I recommended Cisco Compact Switches, but they are too expensive.
So the question is: Is it possible to configure the SG300 Switches to communicate with ISE to do allow dynamic VLAN-Assignemt?
Any response will be helpful.
regards
Hubert

Hubert,
Barry is absolutely correct. From the switch side, it is setting radius config in the switch to the ip for the ISE and supplying the key, 802.1x setup and ports will be next. Please refer to the sg300 admin guide. pg 391 and 392 specifically for radius-assigned-vlans. Please review Chapter 19 in total. It will inform you as to certain configuration parameters that will and will not work. For the ISE, it can be a location based rule or an attribute for particular users.

Voice VLAN Help Please

My customer has 2 SG300-52P and 5 SG300-28P. We installed a VoIP phone system earlier this year. At the time of install we placed the phone system on the native VLAN 1. Now they want to move the phone system to a new VLAN because their class C subnet is running out of addresses. DHCP is handled by their Active Directory and their router/firewall is an Untangle Box. The SG300 switches have a basic configuration only.
To move the phone system to a new VLAN I created VLAN 20 on every switch. I then turned Auto Voice VLAN on. I have every port on every switch set to trunk. Computers are plugged into back of phones. I then created a virtual interface on the Untangle Box for VLAN 20. The Untangle Box is also handling DHCP for the new VLAN. Active Directory is still handling DHCP for native VLAN.
From each switch I can ping the gateway of the new VLAN. From each computer I can ping the gateway and the phone system on the new VLAN. However, the phones will not grab an address on the VLAN and when they are set to static, they cannot communicate with other devices on the VLAN.
Any help would be highly appreciated. I am not sure what I am overlooking.

Here is an example of part of a working switch config with Zultys phones where voice VLAN is 100 and data VLAN is 10:
vlan database
vlan 10,20,100
exit
voice vlan id 100
interface fastethernet1
description "RCP and Voice"
switchport trunk allowed vlan add 100
switchport trunk native vlan 10
interface fastethernet2
description "RCP and Voice"
switchport trunk allowed vlan add 100
switchport trunk native vlan 10
In your case you need a trunk port with VLAN 20 tagged on your firewall (or an access port to a separate physical port on VLAN 20. The default gateway served to the phone (or put there statically) should be the interface on the IP. Then you may also want to allow inter-vlan routing for admin access or MXIE if you are using it.
One thing to note on Zultys is by default I think the device profile disables LLDP, but on the phones it is enabled out of the box. So the first time a phone downloads its config from the Zultys it may turn of LLDP unless you checked the box to keep it on.

Replacing 3COM 4500 switches with SG300-52 - help

I'm replacing 2 3COM 4500 Swithes with the SG300-52 Cisco switch. We have 3 VLANs, 10, 20, 100. The switch is set for Layer 3 and I have setup DHCP relay. I was hoping someone might know what settings i should set on the Cisco for the following setups:
3COM Setup
interface GigabitEthernet1/0/1
port link-type hybrid
port hybrid vlan 10 tagged
port hybrid vlan 1 20 100 untagged
port hybrid pvid vlan 100
My Cisco Translation
interface gigabitethernet1
switchport mode general
switchport general allowed vlan add 10 tagged
switchport general allowed vlan add 20,100 untagged
switchport general pvid 100
exit
and one other example i'm curious if i set right..
3COM Setup
interface GigabitEthernet1/0/48
port link-type trunk
port trunk permit vlan all
port trunk pvid vlan 100
My Cisco Translation
interface gigabitethernet51
switchport trunk allowed vlan add 10,20
switchport trunk native vlan 100
exit
Trying these settings I am not able to get any devices to work on the switch so i'm guessing i have something not setup correctly. Any help would be greatly appreciated..
THanks,
Chris

Chris,
Compared to your 3com switches yes the commands you currently ran are comparable. The reason it’s not working is a bigger question and we need a complete picture. First we need a topology(detailed as possible) of your network and details on how things need to work/setup? Then we can set up accordingly to the devices on your network. For quicker resolution call into the SBSC @ 1-866-606-18666 and open a support case .
Thanks,
Jasbryan

Cisco sg200 voice vlan dhcp issue

i have cisco sg200 50p connected to cisco 3750 switch. i just wanted to separate voice (vlan2) and data (vlan1) VLANS. I created vlan 2 as my voice VLAN and separate dhcp server for vlan 2 to give ip addresses to phones. however the ip phone connected to my voice vlan (vlan 2) is not receiving ip address from my dhcp server in vlan 2.
the dhcp server is connected to 3750 switch with an access port (vlan2-voice)
two switches are connected via trunk ports and allowed vlan 1&2
ip phone is connected to sg200 via access port (vlan 2) -
note - there is no pc connected to ip phone
I really appreciate if anyone can help me with this issue

Hi Tom
Thank you for the support. The phone is now getting the IP from the DHCP on its own VLAN (vlan2 ) according to your configuration. However i need to configure the auto voice VLAN based on OUI feature which is in SG200 switch.
The problem is, the switch not allowed me to configure auto voice vlan feature when the port connected to IP phone is in ACCESS mode (it has to be a trunk). I know according to cisco catlyst guidelines this is totally incorrect bcz they say "Voice VLAN is only supported on access ports and not on trunk ports, even though the configuration is allowed"
I think its not valid for Small business switches . Anyway, when i make the said port TRUNK it works (by assigning 1U & 2T- automatically).But the phone does not get an IP address from my DHCP server then.
Can you help me with this if I am missing some configuration. Thank you once again

Adsl and vlan help

hello, im new to ccna .
please any expert help me in this sinario,
router 1721 with one wic-1adsl ,i have adsl conection with irb static ip.
the router connect with mannaged switch through a trunk port.
the switch has 2 vlans one for the static IPs and the other for private lan.
i need the private lan to be able to go to internet please any ideas.
the router configuration is as follows:
Building configuration...
Current configuration : 1272 bytes
! Last configuration change at 16:50:18 pc Fri May 10 2013 by admin
version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname BELCO
boot system tftp c1700-k9o3sy7-mz.122-15.T17.bin 62.x.x.7x
logging queue-limit 100
username admin privilege 15 password 0 HES2010
clock timezone pc 0
ip subnet-zero
ip cef
bridge irb
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/35
encapsulation aal5snap
dsl operating-mode auto
bridge-group 1
interface ATM1
no ip address
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
interface FastEthernet0
no ip address
speed auto
interface FastEthernet0.1
description LAN
encapsulation dot1Q 1 native
ip address 192.168.1.10 255.255.255.0
interface FastEthernet0.2
description WAN
encapsulation dot1Q 2
ip address 62.x.x.7x 255.255.255.248
interface BVI1
mac-address 0000.0cc9.fa98
ip address 10.186.10.106 255.255.255.252
ip classless
ip route 0.0.0.0 0.0.0.0 BVI1
ip http server
ip http authentication local
bridge 1 protocol ieee
bridge 1 route ip
line con 0
speed 115200
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet
no scheduler allocate
end
so vlan2 can go to internet because it has the same subnet with provider but vlan 1 canot go internet.
so how i can make all vlans go internet(the router has only 1 fastethernet port)
thanks in advanced for any help.

OK, so you need to take IP from your public range and assign it to loopback interface.
OR you can use on both subinterfaces private addresses and entire public range use for PAT, statc NAT or what ever, it depends on your reqiurements. How many devices do you have on 62.135.115.72/29 subnet?
If I were you, I would choose second option because in first option you have to lower subnet mask on Fa0.2 from / 29 to /30 which leaves you with only 1 host on this LAN segment!!!
This configuration will ensure that subnet 192.168.1.0/24 will access internet with public IP 62.135.115.72 and subnet 192.168.2.0/24 will access internet with public IP 62.135.115.73.
And you still have 6 more free public IPs for what ever you will need them (static NAT, static portforward. VPN,....)
interface Loopback 72
ip add 62.135.115.72 255.255.255.255
ip nat outside
interface Loopback 73
ip add 62.135.115.73 255.255.255.255
ip nat outside
interface Loopback 74
ip add 62.135.115.74 255.255.255.255
ip nat outside
interface Loopback 75
ip add 62.135.115.75 255.255.255.255
ip nat outside
interface Loopback 76
ip add 62.135.115.76 255.255.255.255
ip nat outside
interface Loopback 77
ip add 62.135.115.77 255.255.255.255
ip nat outside
interface Loopback 78
ip add 62.135.115.78 255.255.255.255
ip nat outside
interface Loopback 79
ip add 62.135.115.79 255.255.255.255
ip nat outside
interface FastEthernet0.1
description LAN
encapsulation dot1Q 1 native
ip nat inside
ip address 192.168.1.10 255.255.255.0
interface FastEthernet0.2
description WAN
encapsulation dot1Q 2
ip nat inside
ip address 192.168.2.10 255.255.255.0
ip access-list extend NAT_ACL_1
deny ip 192.168.1.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 any
deny ip any any
ip access-list extend NAT_ACL_2
deny ip 192.168.2.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip 192.168.2.0 0.0.0.255 any
deny ip any any
route-map NAT_MAP_1
match ip address NAT_ACL_1
route-map NAT_MAP_2
match ip address NAT_ACL_2
ip nat inside source route-map NAT_MAP_1 interface Loopback72 overload
ip nat inside source route-map NAT_MAP_2 interface Loopback73 overload
Best Regards
Please rate all helpful posts and close solved questions

Cisco SG300 VLAN rate-limit

I have a Cisco SG300 small business switch and 541 APs. There are 2 VLANs in our network. One must be limited by bandwidth. Does anyone have an idea for configure vlan rate-limiting on SG300? And please describe CIR & CBS for me. Thanks.

http://www.cisco.com/en/US/partner/products/ps10898/prod_command_reference_list.html
Cisco Small Business 300 Series Managed Switches Command Line Interface Guide Release 1.3
Select CIR and CBS according to your design. You can use a larger CBS when performance is not ideal.
49.23 rate-limit (VLAN)
Use the Layer 2 rate-limit (VLAN) Global Configuration mode command to limit the
incoming traffic rate for a VLAN. Use the no form of this command to disable the
rate limit.
Syntax
rate-limit vlan-id committed-rate committed-burst
no rate-limit vlan
Parameters
• vlan-id—Specifies the VLAN ID.
• committed-rate—Specifies the average traffic rate (CIR) in kbits per second
(kbps). (Range: 3-57982058)
• committed-burst—Specifies the maximum burst size (CBS) in bytes.
(Range: 3000-19173960)
Default Configuration
Rate limiting is disabled.
Committed-burst-bytes is 128K.
Command Mode
Global Configuration mode
User Guidelines
Traffic policing in a policy map takes precedence over VLAN rate limiting. If a
packet is subject to traffic policing in a policy map and is associated with a VLAN
that is rate limited, the packet is counted only in the traffic policing of the policy
map.
This command does not work in Layer 3 mode. It does not work in conjunction with
IP Source Guard.
Example
The following example limits the rate on VLAN 11 to 150000 kbps or the normal
burst size to 9600 bytes.
switchxxxxxx(config)# rate-limit 11 150000 9600

VLAN Help - LRT214

So I thought I had VLAN configured properly, but my devices aren't getting IP addresses from the router. My goal is to setup a guest WiFi network with my LAPAC1750PRO WAP's.
I have a Linksys LRT214. My primary LAN is set as 10.0.1.1 for the router, reserved IP addresses from 10.0.1.2 - 10.0.1.99, and addresses for visitors, unassigned devices, etc. as 10.0.1.100-150.
I set up a separate VLAN (VLAN2) with the following config: Device IP 10.0.2.1, subnet 255.255.255.0 (same as primary LAN), DHCP server button checked, range start 10.0.2.100, range end 10.0.2.149, use DNS from ISP option enabled.
Under port management (802.1q settings): VLAN1 interVLAN routing disabled, device management enabled, LAN1-4 untagged. VLAN2 has interVLAN routing disabled, device management disabled, LAN1-4 tagged.
I have the SSID (VAP1) of the WAP assigned to VLAN2, the others VLAN1. Under the LAN settings of the LAPAC1750PRO, I have management VLAN ID 1, VLAN tagging untagged, untagged VLAN ID 1, connection DHCP, DNS dynamic.
With all my switches (LGS318P, LGS308P, LGS308), I have VLAN1 as default and VLAN2 as static.
I originally thought the WAP's LAN settings needed to have VLAN tagging set to tagged. However, when I do this, even the primary VAP won't connect.
Can someone help me out here? I've heard VLAN's are tricky, but didn't realize it would be this tricky. I want to isolate the guest WiFi network from my own network. Basically I just want the guest WiFi network to be able to access the internet and nothing on the intranet (I may allow printing later, but not right now).
Thanks for any help you can provide!

Sorry I don't have access to something to make a diagram right now, but here's how it looks:
LRT214 router connects to an LGS318P switch through ports 1 and 2 going to 17/18 on the switch (through link aggregation). Port 3 goes to my office and connects to an LGS308P.
The office LGS308P connects to an LAPAC1750PRO WAP, iMac computer, AT&T 3G MicroCell, Ooma Telo, and a Netgear GS105Ev2 switch (Brother MFC-9970CDW printer, Dymo Printserver, and occasionally my MacBook Air are connected to this switch). The LGS308P connects to the LAN via port 1. Ports 2 and 3 are for the WAP, but I don't have LAG enabled on the switch (yet).
The basement switch supplies:
1. Master bedroom (AppleTV currently, but soon to be LGS308P with another WAP)
2. Living room LGS308P (which connects):
a. LAPAC1750PRO WAP
b. TiVo Roamio
c. Apple TV
d. Samsung Blu-ray DVD player
3. Office second switch (LGS308)
a. Sonos Play:3
b. Sonos Play:3
c. Sonos Sub
4. ADT iHub
5. Synology DS212+ DiskStation
6. Sonos Connect:amp
7. LAPAC1750PRO WAP (2 ports reserved, but only 1 being used)
8. Empty runs to various rooms of the house that aren't yet connected)
All switches have STP (standard, modified) enabled. The LGS318P has root priority (4096), office LGS308 second (8192), and the others varying degrees of priority but none of the others have Sonos equipment connected. BDPU is set to flooding, port priority is 4 for gigabit connections and 10 for 100 Mbps connections (I've had to manually set these to 10 as they default to 19 and Sonos requires 10 to work).
Thanks for your help. Hopefully this helps.

SG200-08 VLAN-trunk setting ignored after reboot

Hi all,
The ports on my SG200-08 are configured as follows:
Port 1; VLAN 1+4; trunk
Port 2; VLAN 4; access
Port3-8; VLAN 1; access
The config for Port 1 looks as follows: "switchport trunk allowed vlan add 1,4". The problem I want to point out here arises right after rebooting the switch; in the running config, the aforementioned line is now present as "switchport trunk allowed vlan add 4", i.e., VLAN 1 is missing in the trunk. The problem is reproducible every time I reboot the switch. At this moment, I assume it to be a bug in the firmware. This is a problem for me, since the switch's management VLAN is 1 and it gets its IP address (DHCP) over VLAN 1 as well.
I have attached my startup config to this thread, as well as the running config exported right after reboot. In both of them, I've sanitized the rows on user accounts.
Does anyone recognize this problem? Any suggestions on how to fix it?

Hi chrebert,
Thanks for your answer. You're right in concluding the VLAN 1 is my default VLAN. The problem is that the switch should contact my DHCP server over VLAN 1 and since the traffic on port 1 is not tagged, the traffic DHCP request will never reach my DHCP server. As a consequence, the switch always ends up with its factory default IP address (192.168.1.254) instead of the IP address assigned by the DHCP server. And yes, that's a problem
So to summarize, when I configure tagged access for VLAN 1 on port 1 and write this to the startup config, it is indeed present in the startup config afterwards. However, the switch ignores this upon reboot, causing VLAN 1 on port 1 to feature untagged access.
By the way, I completely set up the switch from scratch after restoring the config to factory defaults. It would be great if you could try to reproduce the issue and hopefully come with a fix. In case you need more information, please don't hesitate to contact me.

VLAN Help!!! Please

Hello,
I have 2 cisco 3550 switches. I have 2 vlans, VLAn1 & VLAN3. I have 3 ports on vlan 3 & all others on vlan 1. I need to grant access to 2 ports that currently are on vlan1 access to vlan 3. In essence, I need to know the CLI commands to grant 3 ports access to vlan 1 & vlan 3. Can someone help me. Thanks in advance.

First, you need inter-VLAN connectivity (routing). You would typically do this by creating Switched Virtual Interfaces (SVIs) on one of the 3550's. If you want to restrict access between the VLANs then you could apply access-lists to the SVIs.
int vlan 1
ip add 192.168.1.1 255.255.255.0
no shut
int vlan 3
ip add 192.168.2.1 255.255.255.0
no shut

Sg200-sg300 vlan help

Similar Messages

Maybe you are looking for