Setting up Cisco 2960 with VLANs

Posted on 2007-07-30
Last Modified: 2013-11-09
I have the following devices:
- 6 x accesspoints (Cisco AP1131AG)
- 1 x switch (Cisco 2960)
- 1 x Firewall (Cisco ASA5510)

The switch collects the six APs and connects to its own interface on the ASA.
Every AP have 2 SSIDs; a private net and a guest net. These two SSIDs have been given the vlan numbers 2 and 3 in the APs. The six APs are spread widely among the area to provide best coverage and roaming.
The ASA will route clients based on its vlan number.

I have plugged it like this:
F0/1: AP1
F0/2: AP2
F0/3: AP3
F0/4: AP4
F0/5: AP5
F0/6: AP6
F0/11: LAN (for mangement)
F0/12: ASA5510 (unique interface)

How do i configure the switch to allow these two vlans on every port to go forward to the ASA?
And is my solution optimal? I want to get 2 wireless nets that people can access all over the company.
Question by:chanfandk
    LVL 27

    Expert Comment

    You would trunk each connection to the AP's with the two vlans assigned to the trunk - 802.1q trunking.  Then, you would trunk the two vlans to the ASA, or send the vlans seperately per port - vlan A on one port, vlan B on another port.

    Optimally, you would use a wirless controller and convert your AP's to "light" AP's so that all the config is done in the controller.  Then the APs build their own tunnels through your network back to the controller and you only have to worry about the vlans in once place, on the controller.

    Author Comment

    Hi pseudocyber,I can see a point with the 2106, but will stick to the equipment i already have.
    There is a single line between the 2960 and the ASA. Routing will be done in the ASA, based on VLAN number.
    Could you please provide me with the commands needed for configuring the 2960?
    LVL 27

    Expert Comment


    Author Comment

    I saw that doc before i posted this question. You need to understand the theory in full to use it. And i dont.
    I guess i should set "switchport mode trunk" on interface 1-6+12 ?
    Is that it, or must i specify both vlans on every interface?
    LVL 27

    Accepted Solution

    You need to define vlans 2 and 3 on the switch.
    Then, set the ports to trunking mode.
    Then, make the ports members of those vlans.

    I'll attempt to give you the commands, though I confess to relying on ? in the cli.

    (conf mode)
    vlan 2
    (vlan conf mode)
    name SSID A
    cntrl z
    vlan 3

    (conf int mode)
    switchport mode trunk
    switchport trunk encap dot1q
    switchport trunk allowed vlan add 2
    switchport trunk allowed vlan add 3

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Hello , This is a short article on how would you go about enabling traceoptions on a Juniper router . Traceoptions are similar to Cisco debug commands but these traceoptions are implemented in Juniper networks router . The following demonstr…
    This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now