VLAN on 3750 switch

I am trying to create a SVI on a catalyst 3750 switch but when I do a show int vlan , it indicates the line protocol is down.What could ve the problem and how do I get it up?
Here is my config:
Switch#vlan database
Switch(vlan)#vlan 700 name Management
Switch(vlan)#exit
Switch#conf t
Switch(config)#int vlan 700
Switch(config-if)#ip address 172.16.1.1 255.255.255.0
Switch(config-if)# no shut
Switch(config-if)#^z
What did I do wrong and whatz the way forward ?

Hi Friend,
It will remain in line down state till the time you ceate any active port for that vlan.
Suppose you craete SVI for vlan 700 you have to assign any physical port to that vlan or else create a trunk port and allow that vlan on that trunl and the line protocl will come up.
So in short any SVI should have a physical port assignment or there should be an active trunk for that vlan.
HTH, if yes please rate the post.
Ankur

Similar Messages

Native vlan on 3750 switch

Is it possible to configure AAA and EAPFAST on a 3750G switch to use a vlan other than vlan1 for management/native vlan? We are working with RADIUS on Server 2008.

Hi John,
Yes, you can do that.
On 3750 you can take a look at the feature called 802.1x Authentication with VLAN Assignment:
http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst3750/software/release/12.2_52_se/configuration/guide/sw8021x.html#wp1289244.
Basically, you define on the RADIUS server what VLAN each User (or User Group) you want to assign, then when the user connects the PC to the port, it authenticates and the RADIUS server returns the required attributes for VLAN assignament to the switch. The switch interprets them and changes the switchport to the configured VLAN.
The switch will be a simple man-in-the middle during authentication and only processes the RADIUS Reject (if authe fails) or RADIUS Accept (if authe passes).
The authentication methods like EAP-FAST must be agreed between the RADIUS server (AAA Server) and the PC (AAA supplicant).
If you want to authenticate users based on certificates you have to use either EAP-FAST, EAP-TLS or EAP-TTLS.
The most widely spread (which comes by default on WinXP machines) authentication method is PEAP which uses MS-CHAP (username/password) to authenticate users.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Migration of users in different vlans of 3750 Switches

I have 30 switches of access (3750). I require To migrate 1200 users connected to this switches of vlan 1 (172.23.8.0 /22) to vlan 2 (172.23.52.0 /22). They changed in server DHCP the rank 172.23.8.0 /22 to 172.23.52.0 /22. ¿In this case the only solution is to change the ports of switches of vlan 1 to vlan 2?. Can i configure 2 vlans in the ports of switches 3750?. What you recommend to make this migration in the efficient form?

well you could use the command interface range fastehternet 0/1 - 48 (change the command according to your ports) and then execute the switchport access vlan 2 command.
Like this all the ports will be changed in one shot. When to do it.....well during a weekend.
The biggest problem is see is that the workstations have to get a new IP address from DHCP after the migration so i suggest that you put the lease expiration to one day. Like this all the workstations will ask for a new ip address every day and after the change to vlan 2 they will ask an ip and everybody will have connectivity and it should be transparent for the user than.
FYI A switch port can always only belong to a single vlan or it has to be a trunk port to support multiple vlans what is not recommended in your situation.
Yves
rate this post if it helped
Yves

Issues with using /31 mask on 3750 switch

I work for a large manufacturing plant that employes Cisco 3750 and 6500 series switches. We are having a problem in using 255.255.255.254 mask on point-to-point VLAN uplinks. Every time, the switch restarts, after the initial boot process, it locks up after the following error message:
"Warning: use /31 mask on non point-to-point interface cautiously".
The switch in question is a 3750-12 port fibre switch. IOS version: 12.2(25).SEB March 2005.
Any help would be greatly appreciated.
Thanks
Haroon

I believe you are seeing two different things.
1)The message is just a warning message introduced through
http://www.cisco.com/cgi-bin/bugtool/onebug.pl?bugid=CSCdw51648
It is not only during boot up but the message is printed even when the IP address is configured.
3750#
1w3d: %SYS-5-CONFIG_I: Configured from console by console
3750#conf t
Enter configuration commands, one per line. End with CNTL/Z.
3750(config)#int vlan 1
3750(config-if)#ip address 14.1.25.225 255.255.255.254
% Warning: use /31 mask on non point-to-point interface cautiously
3750(config-if)#do sh run int vlan 1
Building configuration...
Current configuration : 63 bytes
interface Vlan1
ip address 14.1.25.225 255.255.255.254
end
3750(config-if)#
The reason you are seeing after boot up is because start up config is applied to running config.
2)However, this should not lock up the switch.

802.1x "MachineorUser" Auth Mode strange behavior in 2950 & 3750 Switches

Good Day Support Team around the world,
Having started recently tests with 802.1x in a lab environment, I noticed a strange behavior related to authentication. First let me provide you with the network components I used.
supplicant:                    domain-joined laptop with Windows XP SP3 802.1x embedded client
authenticator1:              Cisco 2950-24
authenticator2:              Cisco 3750-24
authentication server:     MS NPS Windows Server 2008
1.     In the first scenario with 3750 switch when I connect the laptop to relevant port the machine authentication is successful. Then I try to login with a domain account and again the authentication is completed without any problem. Then I log off and user authentication is revoked and the machine authentication is used again without any issue. When I try to login again as local user the authentication fails as expected but the port remains disabled (port blinking amber) regardless the fact that port is configured for Auth-Fail Vlan. When I log off then the machine authentication is used again and the access is granted.
2.     In the second scenario with 2950 switch as authenticator, I follow the same steps as before and when I try to login as local user the authentication is failed and the port is assigned the Auth-Fail Vlan (as expected based on configuration). However when I log off it seems that the 2950 switch still use the Auth-Fail Vlan for that port and never authenticates again for machine authentication.
Could you please let me someone know if this is normal ( I suppose no). Please find attached the relevant debug output from the second scenario.
Thank you!!!

Hi,
basically what happens is that the maximum EAP packet size for communication between client and RADIUS server is negotiated. Therefore, in your case the switch notifies NPS that the client is capable of handling packets up to 9000 bytes in size.
EAP messages, especially those containing the server certificate, are usually bigger than 1500 bytes and arrive at the switch in multiple fragments:
Mar 6 15:50:11.881: RADIUS(0000002C): Received from id 1645/41
Mar 6 15:50:11.881: RADIUS/DECODE: EAP-Message fragments, 253+253+253+253+253+253+253+253+20, total 2044 bytes
Having learned that 2044 bytes is acceptable for the client, the switch forwards the full message in one chunk, but since your client is likely to have set the interface MTU to 1500, the packet is oversized and never reaches its destination.
And yes, I think changing the System Jumbo MTU to 1500 bytes would lead to the same result. If my memory serves me right, a new setting takes effect only after a reboot, so I'd suggest giving it a go in your lab first.
Best regards,
Josef

Question on ARP table on 3750 switch

Hi,
So I have a cisco 3750 switch directly connected to a 2851 router gig 0/0 interface.
Should the show arp command on the switch show an entry for the IP and mac address of the routers gig 0/0 interface?
I dont see one in there now and was just wondering.
Connectivity between the switch and router work fine right now.
thanks

HI Bill,
if u can ping from Swicth ro router,,,,then please check with this command: sh ip arp.
Just for Info;
To be able to ARP a device, you must have an interface (SVI) on that switch on that network. To ARP a device you must have an interface with a layer 3 IP on the same layer 2 vlan.
You will need to connect to a switch that has an interface on that vlan on it. I would traceroute to the host, and hopefully the next to last hop is the layer 3 switch, or if it's a router, connect to it and do a show cdp neighbors and see if you can find the switch that way. (If you do connect to the router, you'll find the ARP entries there, if it's a layer 3 switch, then it's both a router and switch in one box)
"sh mac address-table". This will give which MAC is connected to which port.
"sh ip device tracking interface gigabitEthernet ". This will give which IP is connectd to a port.
"sh ip arp" will give you a IP to MAC table
Regards
Dont forget to rate helpful posts.

WAAS Configuration for 3750 Switch

I am configuring a 3750 switch with 12.2(52)SE according to:
(from https://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_52_se/configuration/guide/3750_scg.pdf )
This example shows how to configure SVIs and how to enable the web cache service with a multicast group list. VLAN 299 is created and configured with an IP address of 175.20.20.10. Gigabit Ethernet port 1 is connected through the Internet to the web server and is configured as an access port in VLAN 299. VLAN 300 is created and configured with an IP address of 172.20.10.30. Gigabit Ethernet port 2 is connected to the application engine and is configured as an access port in VLAN 300. VLAN 301 is created and configured with an IP address of 175.20.30.50. Fast Ethernet ports 3 to 6, which are connected to the clients, are configured as access ports in VLAN 301. The switch redirects packets received from the client interfaces to the application engine.
Note Only permit ACL entries are being used in the redirect-list; deny entries are unsupported.
Switch# configure terminal
Switch(config)# ip wccp web-cache 80 group-list 15
Switch(config)# access-list 15 permit host 171.69.198.102
Switch(config)# access-list 15 permit host 171.69.198.104
Switch(config)# access-list 15 permit host 171.69.198.106
Switch(config)# vlan 299 WEB SERVER
Switch(config-vlan)# exit
Switch(config)# interface vlan 299
Switch(config-if)# ip address 175.20.20.10 255.255.255.0
Switch(config-if)# exit
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 299
Switch(config)# vlan 300 WAE
Switch(config-vlan)# exit
Switch(config)# interface vlan 300
Switch(config-if)# ip address 171.69.198.100 255.255.255.0
Switch(config-if)# exit
Switch(config)# interface gigabitethernet1/0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 300
Switch(config-if)# exit
Switch(config)# vlan 301 CLIENTS
Switch(config-vlan)# exit
Switch(config)# interface vlan 301
Switch(config-if)# ip address 175.20.30.20 255.255.255.0
Switch(config-if)# ip wccp web-cache redirect in
Switch(config-if)# exit
Switch(config)# interface gigabitethernet1/0/3 - 6
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 301
Switch(config-if-range)# exit
===================================================================
Question: How do I configure my WAE to play nicely with this switch?

Hi James,
Here is the link to WCCP config part on WAE:
http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v441/configuration/guide/traffic.html#wp1041742
In your case, if my understanding is right, VLAN300 is where you want to connect WAE and WAE is also L2 adjacent. if that is true, here is the config you need on WAE:
wccp router-list 1 171.69.198.100
wccp tcp-promiscuous router-list-num 1 l2-redirect mask-assign l2-return
wccp version 2
Please note that 3750 supports L2 redirection only with redirect IN statements on 3750 interfaces connected to servers and clients.
Hope this helps.
Regards.

How can I mirror all ports on CISCO 3750 switches to one Gigabyte port?

Hi,
I have a requirement to mirror all the ports on my 7 CISCO 3750 switches, which are in 3 separate stacks, to one single Gigabyte Ethernet port.
Does anyone know how I can do that?
Thanks in advance.

Vlad, thanks a heap for your response.
I want to apply to my sitation. Please let me know if I get them right in the following:
Catalyst A
vlan 901
remote-span
monitor session 1 source interface fastethernet 1-48 (I want to monitor all ports on the CISCO 3725)
monitor session 1 destination remote vlan 901
Catalyst B
vlan 901
remote-span (If I don't need to monitor this switch, do I still need to put anything into this switch at all?)
Catalyst C
vlan 901
remote-span
monitor session 1 source interface fastethernet 1-48 (I want to monitor all ports on this switch as well)
monitor session 1 source remote vlan 901
monitor session 1 destination interface gigabitethernet 3 (There are 4 Gigabit Ethernet Uplink in CISCO 3750, I want all the traffic to go to port 3, is this the right way to do?)
Thanks in advance.

Catalyst 3750 Switch

How many total Vlans can you create in Catalyst 3750 Switch ? I read a document about Catalyst 3750 Switch. This document is said that "Although the switch stack supports a total of 1005 (normal-range and extended-range) VLANs, the
number of routed ports". However, I am not sure. Can you confirm for me ? Thanks

this link should be of some help to answer your question.
http://www.cisco.com/en/US/products/hw/switches/ps5532/products_command_reference_chapter09186a00803ec324.html#wp1031710
HTH-Cheers,
Swaroop

Can a 2851 GEC to a 3750 switch?

Was trying to get g0/0 and g0/1 of a 2851 to form a GEC with a 3750 switch using VLANS.
I've looked to documentation on this but cannot seem to find any if anyone could direct me to a "how to" I be greatful.
BCT

Are you talking about making the link up between 2851 and 3750 on gigabitports and used etherchannel ?

Configure Private VLAN on 3750 & 2960

Hi All,
( R ) ------ [ 3750 ] ------- [ 2960 A ]
|------------ [ 2960 B ]
I had these VLAN on the 3750 & 2960:
- Vlan 8 (mgnt Vlan), Vlan 17, Vlan 34, Vlan 35
Basically I had already configure switchport protected on all the port on the 2960 except the uplink to 3750.
2960 Configure
On uplink to 3750
switchport mode trunk
On end device port
switchport trunk native vlan 35
switchport trunk allowed vlan 34,35
switchport mode trunk
switchport protected
spanning-tree portfast
How do I go about configure private VLAN on the 3750?
3750 Configure
On downlink to 2960
switchport mode trunk
Interface vlan8
ip address 10.8.0.1 255.255.255.0
Interface vlan17
ip address 10.17.0.1 255.255.255.0
Interface vlan34
ip address 10.34.0.1 255.255.255.0
Interface vlan35
ip address 10.35.0.1 255.255.255.0
What I want to achieve is to send all the VLAN 8, 17, 34, 35 from 2960 to 3750 and 3750 to 2960. But at the same time prevent 2960 A client from talking to 2960 B client on VLAN 35?

I believe that if both devices you want no to speak with each other are on 2960 the "switchport protected" should work.
But you can configure with private vlan.
let's say client A is in port f0/1 and client B in port f0/2
Parent (main) VLAN is 100 and child is 999
You would configure the VLANs in ALL switches.
vlan 999
private-vlan isolated
vlan 100
private-vlan primary
private-vlan association 999
Now you would need to configure the ports.
int range f0/1 - 2
switchport mode private-vlan host
switchport private-vlan host-association 100 999
If the interfaces will talk to other VLANs, you need to configure the SVI to understand it will serve the private VLANs.
interface vlan 100
private-vlan mapping 999
That's it, but notice that now interface f0/1 will not talk to f0/2 and to any other interface inside vlan 100, if you want a port to communicate to f0/1 or f0/2 this new port would need to be configured as a promiscuous one (In case it needs to talk to both of them) or create a community private-vlan and configure the ports desired on it. (F0/1 and F0/2 can't be on the same community VLAN or they'll be able to talk to each other).
If the intention is to prevent one specific port from talking to all the others, you can put only this interface in the private VLAN instead of both.
wrote too much, if this answers your question let me know, or we can create a practical scenario for it.

VLAN on 3750 Stack

I am in the process of getting a 3750 switch stack installed. The stack will use layer 3 and will replace a 5505 layer 2 switch. The 5505 has all ethernet ports set to vlan 110.
My 3750 stack will also have all fasethernet ports in vlan 110.
I wanted to do as much of the up front installation prior to cutover, but did not to cause any problems in my vtp domain, so for the moment I have shutdown vlan 110 on the 3750 stack
I noticed that as soon as I did it took the following off of every fastethernet interface in the stack:
switchport access vlan 110
switchport mode access
While I sort of understand why..it has caused a little trouble because I have recently added another 3750 to the stack and was planning on configuring the rest of my interfaces using port range.
I assume the commands will be added back as soon as the interface vlan 110 is taken out of shutdown.
I was just taken by surprise that it modified the configuration as such and has made it hard to configure the other fasethernet ports I have added.
Hope this clear. Can anyone explain this a little more for me. Thanks

I want to try and add some clarification
I have 2 3750-48POE's in a stack...so I had 96 ports
each fastethernet interface on both 48 port switches was configured like this:
interface FastEthernet1/0/1
switchport access vlan 110
switchport mode access
switchport access vlan 410
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
priority-queue out
mls qos trust cos
no mdix auto
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
after shutting down the vlan 110 interface..Here's the config currently:
JDC-3750S-12#sh run int vlan110
Building configuration...
Current configuration : 199 bytes
interface Vlan110
description 10th, 11th, 12th Fl - Data
ip address 10.4.110.1 255.255.255.0
ip helper-address 10.4.1.100
ip helper-address 10.25.192.7
ip pim sparse-dense-mode
shutdown
After shutting down the interface for vlan 110, each fastethernet interface became
JDC-3750S-12#sh run int fa1/0/1
Building configuration...
Current configuration : 388 bytes
interface FastEthernet1/0/1
switchport access vlan 410
switchport mode access
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
priority-queue out
mls qos trust cos
no mdix auto
spanning-tree portfast
spanning-tree bpdufilter enable
spanning-tree bpduguard enable
1.So you see that switchpot commands for vlan 110 got removed.
2. I have added another 3750-24 POE switch since doing this and wanted to use port range to make my additional set of ports like the ones in the original config.
I can't do that now because the vlan 110 info on the interfaces is gone.
I'm just trying to understand what this thing is doing to me. Hope this helps

VLAN on 3750

Hi,
Just a simple config help require.
I am having a Catalyst 3750 (L3). My 5 Servers are connected to this L3 Switch. This L3 swith is connected to 2950 (L2) and this 2950 is connected to my Router. I just want to create a VLAN on L3 only for these Servers. I don't want to create VLAN on L2 switch. Pls explain me a sample config as per this scenario. I'll be thankfull to u all.
Ip Address of Router 172.18.100.1/22 & Server are like 172.18.100.55/22 to 172.18.100.60/22
Pls explain the required IP Routes also.
Anis

In 3750,
interface GigabitEthernet1/0/1
description *** Server 1 ***
switchport access vlan 1100
switchport mode access
interface GigabitEthernet1/0/2
description *** Server 2 ***
switchport access vlan 1101
switchport mode access
interface GigabitEthernet1/0/3
description *** Server 3 ***
switchport access vlan 1102
switchport mode access
interface GigabitEthernet1/0/4
description *** Server 4 ***
switchport access vlan 1103
switchport mode access
interface GigabitEthernet1/0/5
description *** Server 5 ***
switchport access vlan 1104
switchport mode access
interface GigabitEthernet1/0/12
description *** Router ***
switchport mode trunk
In 2950,
interface FastEthernet0/1
description *** connected to router ***
switchport mode trunk
interface FastEthernet0/2
description *** connected to 3750 ***
switchport mode trunk
allow the default gateway to point router's interface ip address.

3750 switch not forwarding EAPoL to RADIUS server

I have a 3750 switch stack running version 12.2(53)SE2 IPBASEK9-M. I have dot1x configured on the switch and have a Windows 7 PC connected with 802.1x configured on the interface. I see the EAPoL start message from the PC, but I don't see any RADIUS packets from the switch to the RADIUS server. I have a simple dot1x config just to try to get it working prior to adding additional features such as guest-vlan...
Config and debug file attached.
I don't know if the ip dhcp snooping and arp inspection configuration is causing an issue with this or not. I see the EAPoL packet received on the switch as seen in the debug attachment, but I still never see the RADIUS packet. I did set both to trust on the interface but still the same outcome. I can't disable it since it is a production switch with a test interface.
Any ideas?
Thanks,
Mark

Hi Mark,
The config seems to be OK, nothing I would miss if I assume that mandatory
commands not shown in your config are in place
aaa-new-model is required for dot1x to function, I don't seee that command.
I have configured dot1x just a few times but I always used the commands
aaa authorization network default group radius
and
radius-server vsa send
(honestly, I'm not sure whether they are required, it's just a template which
I know as working)
Careful if this is a production system
AAA New-Model will radically change every authentication behaviour on the
switch if it is not already configured
The main issue seems that the catalys is not sending an "EAP-Request/Identity"
back, Radius-Packets will only be sent after the "EAP-Response/Identity":
(taken from http://www.cisco.com/en/US/docs/switches/lan/catalyst3750e_3560e/software/release/12.2_50_se/configuration/guide/sw8021x.html)
Do you have any other dot1x client?
You can use a cisco router for testing dot1x if you have
test system at hand:
conf term
dot1x credentials DOT1XTEST
username testuser
password testpassword
exit
interface [name-of-interface-connected-to-catalyst]
dot1x pae supplicant
dot1x credentials DOT1XTEST
Another approach:
use the classic config (not auth-manager but "dot1x syntax") you are
using a very new version of IOS, might be buggy:
Switch(config)# aaa new-model
Switch(config)# aaa authentication dot1x default group radius
Switch(config)# aaa authorization network default group radius
Switch(config)# radius-server host [IP-address] auth-port [port] key [port]
Switch(config)# dot1x system-auth-control
Switch(config)# interface [interface]
Switch(config-if)# switchport mode access
Switch(config-if)# dot1x port-control auto
Hope something is helpful
Additional debug hints:
use
show dot1x all
show dot1x interface [interface-name] detail
show dot1x interface [interface-name] satistic
Do see something like "RxResp = x" with x>0?
rgds, MiKa

Two VLANs on one switch port?

Currently we have the following
Cat 4003 with VLAN trunking turned on to multiple switches. Each port in those exterior switches is assigned to a vlan(we have about 60 different vlans).
What I would like to do is on those exterior switches have two vlans assigned to it.
We'd like to create a single IP Phone VLAN(let's call it 999) that can span our entire enterprise and would have dhcp deployed on it.
Each port is connected to an IP phone which has a 2 port switch in them. One port to the wall, one to the pc.
The switch ports on those phones support vlan tagging
How would setup an exterior switch to access 2 vlans that connect to 2 port switch on an IP phone?

To facilitate ease of deployment, use VTP so that you can centrally create the vlans and propagate to each exterior switch. Now I believe you already do have a layer 3 engine or router that does routing between all these vlans. What switches are used on teh exterior ? This is to find out if voice vlan support is available.
In cat switches, voice vlan is created using command,
set port auxiliaryvlan vlan
In IOS based switches,
int fa0/1
switchport mode trunk
switchport trunk encap dot1q
switchport trunk native vlan
switchport voice vlan
switchport priority cos extend 0
or
int fa0/1
switchport mode access
switchport access vlan
switchport voice vlan
I am not sure about support of voice/aux vlan in 4003. We will have check your other switch models/ software versions to determine support for this command.

VLAN on 3750 switch

Similar Messages

Maybe you are looking for