Telnet issue on Cisco L3 switch. Can't connect from another vlan.

Published:
I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus.

After configuring vlans and trunking,  I could not telnet to the new switch from my existing environment.   I could ping the new switch from my existing environment, a PC workstation attached to the new switch could ping all of my network devices and internet addresses, a workstation connected to the new switch could also get a DHCP address from Windows servers in my existing environment, and I could also RDP to the workstation on the new switch from my existing environment.  

But, I could not telnet from the same PC used for RDP in the existing environment.  I could only telnet from the PC connected to the new switch.  I tried using both MS telnet and Putty.

Here is the problem and the solution:

I had configured 3 vlans on the new 3560 switch
vlan 1  - managment
vlan 6 - new PC and voip vlan
vlan 11 - existing voip network

I had configured the new vlan 6 on the existing 4506 switch and set up trunking between the two switches.

Problem:  
Vlan 3 used in the existing environment was not configured on the new switch.  I was trying to connect from vlan 3 using MS telnet or Putty from a connection on the existing 4506 switch.

Solution:
As soon as I configured vlan 3 on the new 3560 switch I was able to telnet/Putty from my PC workstation in the existing environment

Lesson learned:  
The new switch should have all the same vlans configured that it will be communicating with in the existing environment.

For those needing a refresher on Cisco commands, here are a few:

To create a new VLAN n  (using n=6 for example)
Note: words in (parens) are comments
config t
                        vlan 6
                        name new-user-vlan
                        exit
                      
                      interface vlan6    (note no space after vlan to set up the IP address of the switch)
                        description new user LAN 10.0.6.0
                        ip address 10.0.6.251 255.255.255.0      (this is the address of the new switch for vlan 6)
                        ip helper-address 10.0.10.10                   (dhcp server ip address)
                        no ip route-cache
                        no shutdown
                        exit

Open in new window

To configure the new switch for telenet and allow vlan 3 to connect
Note: words in (parens) are comments
(configure the access list)
                      conf t         (abbreviating config as conf works)
                      ip access-list standard TELNET-ACCESS     (the new access list name is TELNET-ACCESS)
                        permit 10.0.3.0  0.0.0.255      (this allows addresses 10.0.3.1 through 10.0.3.254 to connect.
                        permit 10.0.6.0  0.0.0.255      (this allows addresses 10.0.6.1 through 10.0.6.254 to connect.
                      ex   (abbreviating exit works)
                      
                      (configure vlan 3)
                      config t
                        vlan 3
                        name main-user-lan
                        exit
                      
                      int vlan3                 (abbreviate interface as int)
                        description Existing user LAN 10.0.3.0
                        ip address 10.0.3.251 255.255.255.0      (this is the address of the new switch for vlan 3)
                        ip helper-address 10.0.10.10                   (dhcp server ip address)
                        no ip route-cache
                        no shut                  (abbreviate shutdown as shut)
                        exit
                       
                      (configure telnet access over lan and apply access list)
                      line vty 0 15      (configures all 16 virtual telnet lines  0-15)
                        login                 (allows login from lan)
                        password YourTelnetPassword    (must set a password)
                        access-class TELNET-ACCESS in     (applies the access list TELNET-ACCESS inbound)
                        exit

Open in new window

I hope this helps someone.
0
5,608 Views

Comments (1)

This is a common error.  Configuring a vlan on an access or trunk port or even an SVI does not create the vlan on the switch, therefore no traffic can flow through that vlan until it is created, per the procedure you detailed.

Nice write-up.

Have a question about something in this article? You can receive help directly from the article author. Sign up for a free trial to get started.