Vlan toip and pc

Hello erverybody
Recently I buy 6 cisco switch to make a new configuration in my entreprise i would like to use the toip but i would like to separe the Vlan pc of vlan pc. And i think to prapre my switch in L3 but i do not now to correctly separate my Vlan pc of my vlan Toip
Thank you in advance

Is this:
1.for example I use PC Suite backup and restore function and backup W995 all can backup the project, then I do export operation, format for *. DBK, so I put this *. DBK format file copy out and PC connected to reintroduce companion, W995 or Satio on whether it is feasible to mobile phones? Will certain functions cannot fully restored to another one mobile phone.
2. "for example, I use PC companion backup and restore function and backup W995 all can backup the project and then I do export operation, format for *. DBK, so I put this *. DBK format file copy out and PC connected to reintroduce Suite, W995 and Satio on whether it is feasible to mobile phones? Will certain functions cannot fully restored to another one mobile phone.

Similar Messages

  • What is VLAN 0, and how do I get a workaround for this problem?

    To make a long story short, we have a 6500 L3 switch as our core switch for our corporate LAN. There is a 3550 connected to it by fiber, and a 3750 is connected to the other side of it also by fiber. I can go to the 3550 in the middle and ping/telnet either way, but can't do a complete ping or telnet from either end to the other end.
    This afternoon I tried a L2 traceroute back to the gateway of the vlan, and came up with this output --
    switch#traceroute mac ip 10.121.1.77 10.121.1.1
    Source and Destination arped on different vlans (source on vlan 0 and destination on vlan 1).
    Layer2 trace aborted.
    Nothing shows up regarding Vlan 0 on the 3550 when I execute 'show vlan'. VTP is set correctly, all vlans are populated, and L3 routing is turned off. Where does VLAN 0 come from, and how do I get the switch address on Vlan 1?
    Thanks,
    Jim

    Where are you issuing the L2 traceroute.
    Understanding Layer 2 Traceroute
    The Layer 2 traceroute feature allows the switch to identify the physical path that a packet takes from a source device to a destination device. Layer 2 traceroute supports only unicast source and destination MAC addresses. It determines the path by using the MAC address tables of the switches in the path. When the switch detects a device in the path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
    The switch can only identify the path from the source device to the destination device. It cannot identify the path that a packet takes from source host to the source device or from the destination device to the destination host.
    Switches Supporting Layer 2 Traceroute
    The Layer 2 traceroute feature is available on these switches:
    * Catalyst 2950 switches running Release 12.1(12c)EA1 or later
    * Catalyst 3550 switches running Release 12.1(12c)EA1 or later
    * Catalyst 4000 switches running Catalyst software Release 6.2 or later for the supervisor engine
    * Catalyst 5000 switches running Catalyst software Release 6.1 or later for the supervisor engine
    * Catalyst 6000 switches running Catalyst software Release 6.1 or later for the supervisor engine
    But the above might not be the issue as you said from 3550 you can ping either 3750 or the 6500, the traceroute looks like you did from 3550. What you need to do is make sure that the 3750 and the the vlan for 10.121.1.1 are in the same vlan.

  • VLAN Override and Web Auth: How to overcome issues?

    Hello
    I have been investigating if we can deploy vlan override and assign a user vlan via RADIUS, post authentication on a WRD SSID. Having read around the discussions, I can see that there are others who have wanted similar, but have been told that it is not possible:
    "Marucho, the particularity of how Web authentication works on the WLC  is that it is carried over HTTP between Client and WLC. So the Wireless  Client has to already have an IP address prior to starting the web  authentication. Since the Wireless Client already has an IP address then  you cannot override it anymore.
    Unlike  dot1x, which takes place over EAPOL and then when you have eap success,  client moves to get an ip address from the sent by Radius VLAN."
    However, we still have a problem that we would like to overcome and wonder if anyone has any experience or suggestions they could share?
    We are a University with a large number of devices grabbing an IP address whilst only remaining associated and not actually going on to authenticate through the WRD. This creates a situation where we have a large number of IP addresses deployed unnecessarily and we would like to tackle this.
    We are unable to use private IP for authenticated users (Policy decision) but could use them for associated users and so were hoping we might be able to deploy a private subnet on the WRD SSID prior to authentication and then use VLAN override to assign authenticated users onto the correct VLAN. In order to try and achieve this we were planning on using a very short DHCP lease on the private subnet, so that post-authentication the client device requests a public IP address almost instantly.
    Is there any way of achieving this that someone could suggest or would we be knocking our ehads against a brick wall?
    thanks
    Bryn

    Just giving 2 ideas :
    -How about using a WPA PSK on your webauth ssid ? Just give the PSK in the SSID name. This prevents non-intended connections (no automatic association because it's open ssid) and still allows anyone with an intention, to connect to it and you still have the webauth behind. This reduces number of ip addresses.
    -How about modifying the webauth successful authentication page to give the credentails to access a private network (PSK or dot1x) where credentials would regularly change ?
    Those are workarounds.
    Nicolas

  • Management VLAN Design and Implementation

    Greetings, friends.  I'm having trouble getting a clear picture of how a management VLAN ought to look.  I just installed a Catalyst 6509-E as my core switch, and as soon as they arrive I'm going to be replacing all of our other (HP) switches with Catalyst 3560X switches.  I understand the reasoning behind segregating traffic, not using VLAN1, etc., but I've never actually implemented a management VLAN--I've always just accessed the switches via the IPs assigned to them where all the client traffic flows (not VLAN1, by the way).
    Is "management VLAN" simply what we as humans call a VLAN we dedicate to management activities, or is there something official in these switches to designate a "management VLAN?"
    Is it best practice to include SNMP, netflow, syslog, and NTP as "management" traffic?
    There's a lot of documentation talking -about- management and management VLANs, but unless I'm blind or not looking hard enough I can't seem to find any implementation whitepapers or best practices whitepapers that demonstrate setting one up on a campus LAN.  Are you able to point me in the right direction to find such documentation?  Is it perhaps buried in a manual somewhere that isn't explicitly labeled "Management VLAN Design and Implementation" or somesuch?
    What is the best practice for accessing the management VLAN?  Inter-VLAN routing + ACLs?  Multi-homed PCs or servers?  Additional PCs to be used as access stations?
    Thank you for your wisdom, experience, and advice!
    Kevin

    1. Yes, you may want to keep this traffic separate of the other traffic limiting device management access to just this vlan, as this prevents eavesdropping.
    2. Indeed all other housekeeping goes via this VLAN altough you could limit it to the interactive or session traffic.
    3. On a campus you could think of one big VLAN spanning the campus, one a multi-site environment or where you use L3 to go to you datacenters you probably need multiple management lan's. I've seen implementations where the management traffic was kept separate and even didn't use the routing protocol in use. The whole management lan was statically routed and would work even if OSPF or BGP was down.
    4. I feel a situation where the people providing support are connected on the lan giving access to the devices is probably best. A dual homed pc is a good solution I think, other customer feel the management lan should be treated as a DMZ accessible via a firewall,  but the hardcore customer insist on a second pc connected to the management lan.
    Points to consider are as always,
    Find the single point of failure. Any device, L2 L3 firewall that could cut off management from accessing a part of the network.
    Find the right balance between security, costs, easy of access for the business your in.
    Cheers,
    Michel

  • Dynamic VLAN assignment and Layer 3 switching on 300 series

    I have a SG300-28P switch. I just read in the Administration Guide that, when in Layer 3 mode, the switch doesn't support MAC-based VLAN or Dynamic VLAN Assignment.
    So, in order to assign a client to a VLAN based on their MAC or based on the response of a RADIUS server, we have to disable layer 3 features. Without layer 3 switching, the switch is unable to act as a default gateway and forward packets between VLANs. As a result, the VLANs can't communicate in any way, or access the internet, unless a separate router is connected to every VLAN. Right?
    I'm new to VLAN configuration and layer 3 switching so I wanted to check my understanding. Doesn't this limitation significantly reduce the usefulness of the DVA feature?
    I may well be confused and missing something regarding how this is typically used..

    Hello Glenn,
    Your concept about packet forwarding is correct. With a layer 2 switch, there must be something directing traffic with multiple subnets for intervlan communication or something that provides an IP route to give the request a path back for the request.
    The usefulness for the DVA feature, is not particularly limited to the switch as the switch will correctly assign the VLAN for you, as VS the L3 switch mode, you're dealing with IP addresses. In any scenario, you're going to require a router to get to the internet since the switch does not support NAT.
    Additionally, if you're router does not support VLAN, the L3 switch feature would still be the solution since you should be able to make a static route pointing back to the switch to allow any subnet to traverse the single media. It would still beg the question, how to assign VLAN dynamically.
    The answer, although (in my opinion is terrible) would be GVRP.  But, this application would require ALL of your network cards to be GVRP Enable / Capable which most likely is not the scenario for you (or most anyone else for that matter).

  • Vlans, voice and data

    I am implementing voip, we want to plug the pc into the phone and make both see the network but yet they are on different vlans, how does the port know which data is for voice and what data is for the pc ? do you enable the port to see both vlans by the swithport mode command, or does the port only go into 1 vlan ? At the moment we have vlan 200 and vlan 1, We have just plugged the phones in vlan 200 and pc's in vlan 1 but at the moment they are in seperate ports, I want to know what we will have to to when we plug both phone and pc into one port ?
    thanks
    Carlos
    thanks

    Hi Carl,
    Nops not at all this is not the normal way to configure ip phone and pc together to a switchport. Infact on switches with current code and mostaly all the switches you cannot configure 2 dats vlan on same port like you are doing now.
    If you give switchport voice vlan 200 and switch port access vlan 1 then they are 2 different kind of vlans and will work on same port.
    Now when you give switchport access vlan 1 means there will be no tag and it is justa frame without any tagging and saying it belongs to vlan 1 as as it reaches the switchport it gets pvid of vlan 1.
    When you configure switchport voice vlan 200 it will be a tagged vlan. Because ip phones are switches itlsef as soon as you give voice vlan command it will form an internal trunk and start sending voice data on tagged with vlan 200 and switchport will understand that tagged traffic and will come to know it is for vlan 200 and voice traffic,
    HTH
    Ankur

  • Vlans up and down

    I have a Cisco 2950 on which I have configured vlan3 and vlan4. I've assigned half the ports to vlan3 and the other half to vlan4. When I do a "show int vlan3" and "show int vlan4", one of the vlans is up and other is down. I go to the interface that is down and issue a "no shut" command. That interface comes up, but the other automatically goes down. I can't seem to have both up simultaneously. Any ideas as to what is going on with this? Thanks.

    Hi Andy,
    Yes you are perfectly right. On the 2050 switch only one management interface up because it is layer 2 switch and managmenet interface is only used for manageremt purpose.
    Rest on royter you can configure subinterfaces with encapsulation command and can get vlans talk to each other.
    Make sure the connection from the switch to the router should be trunk connection to carry inf for more than one vlan which is vlan 1 and vlan 2 in your case.
    HTH
    Ankur

  • VLAN's and IP's

    Hi Gurus,
    Below are the three VLAN's I have created on my First Switch for the first time ion my lift after watching couple of videos.I am connected to the switch using a serial to usb cable via console.
    sw1#show vlan
    VLAN Name                             Status    Ports
    1    default                          active    Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                                    Fa0/21, Fa0/22, Fa0/23, Fa0/24
    101  lab1                             active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                                    Fa0/5
    102  lab2                             active    Fa0/6, Fa0/7, Fa0/8, Fa0/9
                                                    Fa0/10
    103  lab3                             active    Fa0/11, Fa0/12, Fa0/13, Fa0/14
                                                    Fa0/15
    1001 VLAN1001                         active   
    1002 fddi-default                     act/unsup
    1003 token-ring-default               act/unsup
    1004 fddinet-default                  act/unsup
    1005 trnet-default                    act/unsup
    VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
    1    enet  100001     1500  -      -      -        -    -        0      0  
    101  enet  100101     1500  -      -      -        -    -        0      0  
    102  enet  100102     1500  -      -      -        -    -        0      0  
    103  enet  100103     1500  -      -      -        -    -        0      0  
    VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
    1001 enet  101001     1500  -      -      -        -    -        0      0  
    1002 fddi  101002     1500  -      -      -        -    -        0      0  
    1003 tr    101003     1500  -      -      -        -    -        0      0  
    1004 fdnet 101004     1500  -      -      -        ieee -        0      0  
    1005 trnet 101005     1500  -      -      -        ibm  -        0      0  
    Remote SPAN VLANs
    Primary Secondary Type              Ports
    OS Version and type of Switch(L2)
    sw1#show version
    Cisco Internetwork Operating System Software
    IOS (tm) C2950 Software (C2950-I6K2L2Q4-M), Version 12.1(22)EA14, RELEASE SOFTWARE (fc1)
    IP address assigned;;
    interface Vlan1
     no ip address
     no ip route-cache
     shutdown
    interface Vlan101
     ip address 10.0.1.1 255.255.255.0
     no ip route-cache
    interface Vlan102
     ip address 11.0.10.10 255.255.255.0
     no ip route-cache
     shutdown
    interface Vlan103
     ip address 15.0.10.10 255.255.255.0
     no ip route-cache
     shutdown
    IP address on my computer;
    Wireless LAN adapter Wireless Network Connection:
       Connection-specific DNS Suffix  . : Home
       Pv4 Address. . . . . . . . . . . : 192.168.0.12
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 192.168.0.1
    Now I cannot ping any of the IP's assigned to the VLAN's. What to do with the VLAN's I've created [stupid and dumb question]. I want to play around the switch and connect it to a Cisco router(I have 5 routers and 5 switches, all different) and create my own lab.
    please advise.

    The most important part of this issue is that you are using a layer 2 switch and have created multiple vlans. To route between vlans you need a layer 3 device (could be a router or could be a layer 3 switch).
    The other part of the issue is that you have created 3 vlans and associated addresses with them. Your PC is in a different subnet so logically it should be in a fourth vlan. And you need a layer 3 device to route between your PC and the switch subnets/vlans.
    HTH
    Rick

  • Help with inline VLAN Pair and switch configuration

    Hello,
    I'm new to IPS and IDS in general, but I have an IPS-4255 and a couple of Catalyst 2900 switches to experiment with. I'm currently trying to enable an Inline VLAN Pair configuration on the IPS and have a simple setup.
    SW1 and SW2 have vlans 100 and 200 configured. PC1 and PC2 are on the same IP range (no routing). PC1 on vlan 100 connects to Sw1. PC2 on vlan 200 connects to SW2. The IPS connects to a SW2 trunking port, and SW1 and SW2 are connected together on another trunking port.
    I know that my trunking is working because PC1 and PC2 can ping each other whenever they are on the same vlan of either switch. But, they can't ping when on the separate vlans.
    From what I've read, the IPS with an Inline VLAN Pair acts as a bridge between the two vlans and should forward the traffic if it passes inspection. However, the IPS does not appear to see any traffic at all.
    My IPS is configured with inline VLAN pair 100->200 and associated to vs0.
    Have I missed something in my config somewhere? Or am I misunderstanding how inline VLAN Pairs are supposed to work?
    Below are my configs for the switches and the IPS.
    Any help would be appreciated. Thank you!
    IPS Config
    service interface
    physical-interfaces GigabitEthernet0/0
    no description
    admin-state enabled
    duplex auto
    speed auto
    alt-tcp-reset-interface interface-name GigabitEthernet0/3
    subinterface-type inline-vlan-pair
    subinterface 1
    description test
    vlan1 100
    vlan2 200
    exit
    exit
    service analysis-engine
    virtual-sensor vs0
    physical-interface GigabitEthernet0/0 subinterface-number 1
    inline-TCP-session-tracking-mode vlan-only
    exit
    exit
    SW1 and SW2 config
    interface FastEthernet0/1
    switchport access vlan 100
    interface FastEthernet0/9
    switchport access vlan 200
    interface FastEthernet0/18
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface FastEthernet0/24 (Sw 2 only)
    description IPS port
    switchport trunk encapsulation dot1q
    switchport mode trunk

    It has been awhile since I've dealt with a 2900 switch to I am just trying to guess at what may be wrong with your setup.
    I noticed that neither of your trunk port configuration are specifically stating which vlans are allowed on the trunks.
    It is possible that for the trunk between the 2 switches there may be some protocol negotiation so the switches can determine which vlans to trunk, BUT no such negotiation will happen with the sensor. If I remember right you will need to specifically state which vlans the trunk to the sensor should carry. If I remember right the commmand would be something like:
    switchport trunk allowed-vlan 100,200
    You will want to find the show command on your switch that will show you which vlans are actually being trunked by the port. It might be something like "show switchport trunk"
    And you will want to verify that the switch is actually trunking vlans 100 and 200 to your sensor.
    On your sensor you will want to execute "show interfaces" and look at the statistics for Gig0/0 to see if it is receiving packets on vlan 100 and 200.
    You can also run "packet display GigabitEthernet0/0" to see if any packets are making it to your sensor.
    You will also want to check Link status and make sure your sensor is linking up properly with your switch. A common mistake is to connect the wrong ports, as some sensors do not have the port numbers clearly marked.
    NOTE: If the above doesn't help, then take the additional step of eliminating the second switch. Attach both pcs to the same SW2 switch (1 in each vlan). The second switch isn't necessary to test the inline vlan pair functionality. Connecting both PCs to the same switch will help eliminate any possibility of misconfiguration between the 2 switches.

  • Private Vlan, Etherchannel and Isolated Trunk on Nexus 5010

    I'm not sure if I'm missing something basic here however i though that I'd ask the question. I recieved a request from a client who is trying to seperate traffic out of a IBM P780 - one set of VIO servers/clients (Prod) is tagged with vlan x going out LAG 1 and another set of VIO server/clients (Test) is tagged with vlan y and z going out LAG 2. The problem is that the management subnet for these devices is on one subnet.
    The infrastructure is the host device is trunked via LACP etherchannel to Nexus 2148TP(5010) which than connects to the distribution layer being a Catalyst 6504 VSS. I have tried many things today, however I feel that the correct solution to get this working is to use an Isolated trunk (as the host device does not have private vlan functionality) even though there is no requirement for hosts to be segregated. I have configured:
    1. Private vlan mapping on the SVI;
    2. Primary vlan and association, and isolated vlan on Distribution (6504 VSS) and Access Layer (5010/2148)
    3. All Vlans are trunked between switches
    4. Private vlan isolated trunk and host mappings on the port-channel interface to the host (P780).
    I haven't had any luck. What I am seeing is as soon as I configure the Primary vlan on the Nexus 5010 (v5.2) (vlan y | private-vlan primary), this vlan (y) does not forward on any trunk on the Nexus 5010 switch, even without any other private vlan configuration. I believe this may be the cause to most of the issues I am having. Has any one else experienced this behaviour. Also, I haven't had a lot of experience with Private Vlans so I might be missing some fundamentals with this configuration. Any help would be appreciated.

    Hello Emcmanamy, Bruce,
    Thanks for your feedback.
    Just like you, I have been facing the same problematic last months with my customer.
    Regarding PVLAN on FEX, and as concluded in Bruce’s previous posts I understand :
    You can configure a host interface as an isolated or community access port only.
    We can configure “isolated trunk port” as well on a host interface. Maybe this specific point could be updated in the documentation.  
    This ability is documented here =>
    http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_1170903
    You cannot configure a host interface as a promiscuous  port.
    You cannot configure a host interface as a private  VLAN trunk port.
    Indeed a pvlan is not allowed on a trunk defined on a FEX host interface.
    However since NxOS 5.1(3)N2(1), the feature 'PVLAN on FEX trunk' is supported. But a command has to be activated before => system private-vlan fex trunk . When entered a warning about the presence of ‘FEX isolated trunks’ is prompted.
    http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/layer2/513_N2_1/b_Cisco_n5k_layer2_config_gd_rel_513_N2_1_chapter_0101.html#task_16C0869F1B0C4A68AFC3452721909705
    All these conditions are not met on a N5K interface.
    Best regards.
    Karim

  • How to configure a port channel with VLAN trunking (and make it work..)

    We're trying to configure a port channel group with trunked ports to connect a NetApp HA pair. We want to create two data LIFs and connect them to the switch stack.  We are trying to create 2 data lifs, one for cifs and one for nfs that are on different vlans.
    We want the same ports to be able to allow multiple vlans to communicate. (trunked)
    These data lifs should be able to fail over to different nodes in the HA pair and still be able to communicate on the network.
    What this means is that we have to connect 4 ports each for each node in the NetApp HA Pair to the switches and create a port channel of some type that allows for trunked vlans. When we configure the ports, the configuration is as follows (below):
    We are only able to configure an IP on one of the vlans.
    When we configure an IP from another vlan for the data lif, it does not respond to a ping.
    Does anyone have any idea what I'm doing wrong on the Cisco switch?
    interface GigabitEthernet4/0/12
    description Netapp2-e0a
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    channel-protocol lacp
    channel-group 20 mode active
    end
    interface GigabitEthernet4/0/13
    description Netapp2-e0c
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    channel-protocol lacp
    channel-group 20 mode active
    end
    interface GigabitEthernet6/0/12
    description Netapp2-e0b
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    channel-protocol lacp
    channel-group 20 mode active
    end
    interface GigabitEthernet6/0/13
    description Netapp2-e0d
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    channel-protocol lacp
    channel-group 20 mode active
    end
    interface Port-channel20
    description Netapp2-NFS
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    spanning-tree portfast
    spanning-tree bpduguard enable
    end

    Our problem was fixed by the storage people.  They changed the server end to trunk, and the encapsulation / etherchannel.
    I like all the suggestions, and they probably helped out with the configuration getting this to work.
    Thanks!
    interface Port-channel20
    description Netapp2-NFS
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    switchport mode trunk
    interface GigabitEthernet4/0/12
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    switchport mode trunk
    channel-protocol lacp
    channel-group 20 mode active
    interface GigabitEthernet4/0/13
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    switchport mode trunk
    channel-protocol lacp
    channel-group 20 mode active
    interface GigabitEthernet6/0/12
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    switchport mode trunk
    channel-protocol lacp
    channel-group 20 mode active
    interface GigabitEthernet6/0/13
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 10,20,511,519
    switchport mode trunk
    channel-protocol lacp
    channel-group 20 mode active

  • SG-300 28P switches problem with VLAN Data and Voice, working all the time as Voice VLAN

    Hi Everyone,
    Thank you very much for your help in advance. I’m pulling my hair to fix the problem.
    I  just got the new SG-300 28P switches. My Bios ordered for me. I did not  know how it runs until now... not an IOS based. I really do not know  how to configure it.
    I have 2 VLAN are Data and Voice.
    -          Data VLAN ID is 2 IP 192.168.2.X/255.255.255.0
    -          Voice VLAN ID is 200 IP 192.168.22.X/255.255.255.0
    -          I created two vlans, in switch, Data and Voice.
    -          On the port number 28, it is trunk by default, so I add Data vlan ID 2 tagged.
    -          On the port number 26, it is trunk by default, so I add Voice vlan ID 200 tagged.
    -          On the port number 27, I add Data vlan ID 2 tagged for Data vlan out.
    -          Port settings No.1
    I set it up as Trunk with Data vlan 2 untagged, and  200  Tagged (voice vlan). I plugged in a phone with a pc attached. But the  PC will get to the vlan 200 to get the DHCP address, but no from vlan 2.  The Phone works with correct vlan ip.
    -          Port settings No.2
    Trunk with vlan 1UP, 2T, and 200T. The phone is even worse. Would never pick up any IP from DHCP.
    -          Port settings No.3
    Access  with 200U...of course the phone will work... and the PC could not get  to its own vlan. Instead, the PC got an ip from the voice vlan. Not from  VLAN 2.
    I have Linksys phone I’m not sure if this help.
    For more information I setup in switch,
                - enable voice vlan
    - set the port on auto voice vlan
    - enable LLDP-MED globally
    - create a network policy to assign VLAN 200
    - assign this network policy to the port the phone is connected to.
    I  hope this information help to help me to setup Data and Voice vlans, to  plug the phone to work with vlan Voice 200 (IP rang 192.168.22.X), from  phone to Pc and pc work as Data vlan 2 (IP rang 192.168.2.X).

    I just got done setting up voice VLANs on an SF 300-24P and verified working.  This was working with Cisco 7900 series phones connected to a Cisco UC setup.
    Here's my sample config.
    Note that I edited this by hand before posting, so doing a flat out tftp restore probably won't work.  However, this should give you a clue.  Also, don't take this as 100% accurate or correct.  I've only been working with these things for about a week, though I've worked with the older Linksys SRW switches for a couple of years.  I'm a CCNP/CCDP.
    VLAN 199 is my management VLAN and is the native VLAN on 802.1q trunks.
    VLAN 149 is the data/computer VLAN here.
    VLAN 111 is the voice/phone VLAN here.
    VLAN 107 does nothing.
    interface range ethernet e(1-24)
    port storm-control broadcast enable
    exit
    interface ethernet e1
    port storm-control include-multicast
    exit
    interface ethernet e2
    port storm-control include-multicast
    exit
    interface ethernet e3
    port storm-control include-multicast
    exit
    interface ethernet e4
    port storm-control include-multicast
    exit
    interface ethernet e5
    port storm-control include-multicast
    exit
    interface ethernet e6
    port storm-control include-multicast
    exit
    interface ethernet e7
    port storm-control include-multicast
    exit
    interface ethernet e8
    port storm-control include-multicast
    exit
    interface ethernet e9
    port storm-control include-multicast
    exit
    interface ethernet e10
    port storm-control include-multicast
    exit
    interface ethernet e11
    port storm-control include-multicast
    exit
    interface ethernet e12
    port storm-control include-multicast
    exit
    interface ethernet e13
    port storm-control include-multicast
    exit
    interface ethernet e14
    port storm-control include-multicast
    exit
    interface ethernet e15
    port storm-control include-multicast
    exit
    interface ethernet e16
    port storm-control include-multicast
    exit
    interface ethernet e17
    port storm-control include-multicast
    exit
    interface ethernet e18
    port storm-control include-multicast
    exit
    interface ethernet e19
    port storm-control include-multicast
    exit
    interface ethernet e20
    port storm-control include-multicast
    exit
    interface ethernet e21
    port storm-control include-multicast
    exit
    interface ethernet e22
    port storm-control include-multicast
    exit
    interface ethernet e23
    port storm-control include-multicast
    exit
    interface ethernet e24
    port storm-control include-multicast
    exit
    interface range ethernet g(1-4)
    description "Uplink trunk"
    exit
    interface range ethernet g(1-4)
    switchport default-vlan tagged
    exit
    interface range ethernet e(21-24)
    switchport mode access
    exit
    vlan database
    vlan 107,111,149,199
    exit
    interface range ethernet g(1-4)
    switchport trunk allowed vlan add 107
    exit
    interface range ethernet e(21-24)
    switchport access vlan 111
    exit
    interface range ethernet g(1-4)
    switchport trunk allowed vlan add 111
    exit
    interface range ethernet e(1-20)
    switchport trunk native vlan 149
    exit
    interface range ethernet g(1-4)
    switchport trunk allowed vlan add 149
    exit
    interface range ethernet g(1-4)
    switchport trunk native vlan 199
    exit
    voice vlan aging-timeout 5
    voice vlan oui-table add 0001e3 Siemens_AG_phone________
    voice vlan oui-table add 00036b Cisco_phone_____________
    voice vlan oui-table add 00096e Avaya___________________
    voice vlan oui-table add 000fe2 H3C_Aolynk______________
    voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
    voice vlan oui-table add 00d01e Pingtel_phone___________
    voice vlan oui-table add 00e075 Polycom/Veritel_phone___
    voice vlan oui-table add 00e0bb 3Com_phone______________
    voice vlan oui-table add 108ccf MyCiscoIPPhones1
    voice vlan oui-table add 40f4ec MyCiscoIPPhones2
    voice vlan oui-table add 8cb64f MyCiscoIPPhones3
    voice vlan id 111
    voice vlan cos 6 remark
    interface ethernet e1
    voice vlan enable
    exit
    interface ethernet e1
    voice vlan cos mode all
    exit
    interface ethernet e2
    voice vlan enable
    exit
    interface ethernet e2
    voice vlan cos mode all
    exit
    interface ethernet e3
    voice vlan enable
    exit
    interface ethernet e3
    voice vlan cos mode all
    exit
    interface ethernet e4
    voice vlan enable
    exit
    interface ethernet e4
    voice vlan cos mode all
    exit
    interface ethernet e5
    voice vlan enable
    exit
    interface ethernet e5
    voice vlan cos mode all
    exit
    interface ethernet e6
    voice vlan enable
    exit
    interface ethernet e6
    voice vlan cos mode all
    exit
    interface ethernet e7
    voice vlan enable
    exit
    interface ethernet e7
    voice vlan cos mode all
    exit
    interface ethernet e8
    voice vlan enable
    exit
    interface ethernet e8
    voice vlan cos mode all
    exit
    interface ethernet e9
    voice vlan enable
    exit
    interface ethernet e9
    voice vlan cos mode all
    exit
    interface ethernet e10
    voice vlan enable
    exit
    interface ethernet e10
    voice vlan cos mode all
    exit
    interface ethernet e11
    voice vlan enable
    exit
    interface ethernet e11
    voice vlan cos mode all
    exit
    interface ethernet e12
    voice vlan enable
    exit
    interface ethernet e12
    voice vlan cos mode all
    exit
    interface ethernet e13
    voice vlan enable
    exit
    interface ethernet e13
    voice vlan cos mode all
    exit
    interface ethernet e14
    voice vlan enable
    exit
    interface ethernet e14
    voice vlan cos mode all
    exit
    interface ethernet e15
    voice vlan enable
    exit
    interface ethernet e15
    voice vlan cos mode all
    exit
    interface ethernet e16
    voice vlan enable
    exit
    interface ethernet e16
    voice vlan cos mode all
    exit
    interface ethernet e17
    voice vlan enable
    exit
    interface ethernet e17
    voice vlan cos mode all
    exit
    interface ethernet e18
    voice vlan enable
    exit
    interface ethernet e18
    voice vlan cos mode all
    exit
    interface ethernet e19
    voice vlan enable
    exit
    interface ethernet e19
    voice vlan cos mode all
    exit
    interface ethernet e20
    voice vlan enable
    exit
    interface ethernet e20
    voice vlan cos mode all
    exit
    interface ethernet e1
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e2
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e3
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e4
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e5
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e6
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e7
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e8
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e9
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e10
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e11
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e12
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e13
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e14
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e15
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e16
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e17
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e18
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e19
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e20
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e21
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e22
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e23
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e24
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet g1
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet g2
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet g3
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet g4
    lldp optional-tlv port-desc sys-name sys-desc sys-cap 802.3-mac-phy 802.3-lag 802.3-max-frame-size
    exit
    interface ethernet e1
    lldp med notifications topology-change enable
    exit
    interface ethernet e2
    lldp med notifications topology-change enable
    exit
    interface ethernet e3
    lldp med notifications topology-change enable
    exit
    interface ethernet e4
    lldp med notifications topology-change enable
    exit
    interface ethernet e5
    lldp med notifications topology-change enable
    exit
    interface ethernet e6
    lldp med notifications topology-change enable
    exit
    interface ethernet e7
    lldp med notifications topology-change enable
    exit
    interface ethernet e8
    lldp med notifications topology-change enable
    exit
    interface ethernet e9
    lldp med notifications topology-change enable
    exit
    interface ethernet e10
    lldp med notifications topology-change enable
    exit
    interface ethernet e11
    lldp med notifications topology-change enable
    exit
    interface ethernet e12
    lldp med notifications topology-change enable
    exit
    interface ethernet e13
    lldp med notifications topology-change enable
    exit
    interface ethernet e14
    lldp med notifications topology-change enable
    exit
    interface ethernet e15
    lldp med notifications topology-change enable
    exit
    interface ethernet e16
    lldp med notifications topology-change enable
    exit
    interface ethernet e17
    lldp med notifications topology-change enable
    exit
    interface ethernet e18
    lldp med notifications topology-change enable
    exit
    interface ethernet e19
    lldp med notifications topology-change enable
    exit
    interface ethernet e20
    lldp med notifications topology-change enable
    exit
    interface ethernet e21
    lldp med notifications topology-change enable
    exit
    interface ethernet e22
    lldp med notifications topology-change enable
    exit
    interface ethernet e1
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e2
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e3
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e4
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e5
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e6
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e7
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e8
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e9
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e10
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e11
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e12
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e13
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e14
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e15
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e16
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e17
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e18
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e19
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e20
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e21
    lldp med enable network-policy poe-pse
    exit
    interface ethernet e22
    lldp med enable network-policy poe-pse
    exit
    lldp med network-policy 1 voice vlan 111 vlan-type tagged
    interface range ethernet e(1-22)
    lldp med network-policy add 1
    exit
    interface vlan 199
    ip address 199.16.30.77 255.255.255.0
    exit
    ip default-gateway 199.16.30.3
    interface vlan 1
    no ip address dhcp
    exit
    no bonjour enable
    bonjour service enable csco-sb
    bonjour service enable http  
    bonjour service enable https 
    bonjour service enable ssh   
    bonjour service enable telnet
    hostname psw1
    line console
    exec-timeout 30
    exit
    line ssh
    exec-timeout 30
    exit
    line telnet
    exec-timeout 30
    exit
    management access-list Management1
    permit ip-source 10.22.5.5 mask 255.255.255.0
    exit
    logging 199.16.31.33 severity debugging description mysysloghost
    aaa authentication enable Console local
    aaa authentication enable SSH tacacs local
    aaa authentication enable Telnet local
    ip http authentication tacacs local
    ip https authentication tacacs local
    aaa authentication login Console local
    aaa authentication login SSH tacacs local
    aaa authentication login Telnet local
    line telnet
    login authentication Telnet
    enable authentication Telnet
    password admin
    exit
    line ssh
    login authentication SSH
    enable authentication SSH
    password admin
    exit
    line console
    login authentication Console
    enable authentication Console
    password admin
    exit
    username admin password admin level 15
    power inline usage-threshold 90
    power inline traps enable
    ip ssh server
    snmp-server location in-the-closet
    snmp-server contact [email protected]
    ip http exec-timeout 30
    ip https server
    ip https exec-timeout 30
    tacacs-server host 1.2.3.4 key spaceballz  timeout 3  priority 10
    clock timezone -7
    clock source sntp
    sntp unicast client enable
    sntp unicast client poll
    sntp server 199.16.30.1
    sntp server 199.16.30.2
    ip domain-name mydomain.com
    ip name-server  199.16.5.12 199.16.5.13
    ip telnet server

  • SG300 inter-VLAN routing and MAC address changes in incoming packets

    Hello
    I have SG300-20 working in Layer3 mode
    VLAN1 is not used
    Internet gateway is in VLAN211
    Clients are in other VLANs
    Switch is default gateway for clients and itself has internet gateway as default route.
    MAC address of switch is XX:XX:XX:XX:XX:63
    When client sends trafic to Internet destination MAC address in outgoing packets is XX:XX:XX:XX:XX:63
    But in incoming packets source MAC address is XX:XX:XX:XX:XX:69
    Why does it change? And how can I setup switch to use only XX:XX:XX:XX:XX:63 MAC address?

    Hi Robert,
    I'd like to pick up this old thread because we have a huge problem with the behavior of the SG300 router/switch regarding the "spoofed" MAC source addresses. We have connected this switch to another router which has some special routing capabilities. It routes certain IP packets directly to MAC addresses which it learned from snooping on special traffic.
    When connected to a SG300 router with an Ethernet base address of XX:XX:XX:XX:XX:48 we receive packets with Ethernet source addresses like e. g. XX:XX:XX:XX:XX:49 or XX:XX:XX:XX:XX:4D (depending on which hardware port they came from). Our special router "learns" these MAC addresses and tries to send associated outgoing packets directly to these addresses using e. g. XX:XX:XX:XX:XX:49 as the MAC destination address.
    Our problem is that the SG300 does not forward the packet if the MAC destination address is not equal to the switch's Ethernet base address (XX:XX:XX:XX:XX:48 in our case). This renders the SG300 series useless for our systems.
    Is there new firmware available which fixes this problem for us? We don't care which MAC source address the SG300 uses in incoming packets we receive, but we expect that the SG300 handles packets correctly for outgoing packets we send with this MAC address as the destination address.
    Thanks,
    Chris

  • Dynamic VLAN assignment and DHCP

    Hello
    I have just upgraded our WLC from 4.0 to 7.0 (via 4.2).
    Before the upgrade we had our ACS returning a VLAN based on user group.  This seemed to be working without an issue.  Now that the WLC is on version 7 this is no longer working correctly.  The ACS is returning a VLAN and passing the user but the client can not get an IP from the DHCP server configured.
    Example configuration:
    SSID-----VLAN
    PN-CSC-----CSCVlan: Works
    PN-Others------OthersVlan: Works
    PN-Others-----CSCVlan: No DHCP
    When users are trying to be allocated to a vlan that is different from the native one the DHCP fails however both WLANs are configured to point to the management interface so dont have any real connection to the vlan other than by name.
    Have there been any changes I haven't seen in the way the dynamic vlan allocation works in version 7?

    Yes, DHCP proxy could be the culprit here.  In 4.0 it was only a CLI command to enable/disable the proxy feature.  In 5.2, I think, and later it is in the GUI
    as well.
       There is a defect filed against the behavior of the WLC DHCP funtion out there currently.  If all of your DHCP is coming from external resources than you can disable proxy.  If, however, you are using the WLC as DHCP server for guest access, then proxy must be enabled.  If the later is true, you should contact TAC, as there is an engineering special available that has the defect resolution.
    Sorry I can't provide the defect ID, my CCO account is acting up.
    Cheers,
    Steve
    If  this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

  • 802.1x with Vlan assignment and IP phone and PC

    I have a Catalyst 4510R and I want to im plement 802.1x with dynamic VLAN assignment via Radius server. I am going to plug to switch ports Cisco IP phones and PCs (PCs are plugged in the IP phone).
    For this implementation I need to configure the switch port in mode trunk because I have voice vlan corresponding IP phone and data vlan corresponding to PC.
    However I have read that I can not enable 802.1x on a trunk port.
    How could I configure this?
    I need that when the PC is authenticated correctly is assigned to his cooresponding data vlan and the IP phone is in the voice vlan.
    Thanks

    You should configure the port as an access port with an aux-vlan. Here's an example:
    interface GigabitEthernet2/2
    switchport access vlan 701
    switchport mode access
    switchport voice vlan 702
    load-interval 30
    qos trust device cisco-phone
    qos trust cos
    auto qos voip cisco-phone
    dot1x pae authenticator
    dot1x port-control auto
    tx-queue 3
    bandwidth percent 33
    priority high
    shape percent 33
    spanning-tree portfast
    spanning-tree bpduguard enable
    service-policy output autoqos-voip-policy
    Hope this helps,

Maybe you are looking for