Solved

Trouble getting 2nd VLAN to connect to internet

Posted on 2010-09-02
17
344 Views
Last Modified: 2012-08-14
Experts,

I have the following config (see below) running on my Cisco 1811 router.  When I connect a pc to Fe1-Fe8  with a 10.10.10.0 network address then I am able to fully connect to the internet.  However, when I connect a pc to Fe9 with a 10.10.20.0 address I am not able to connect to the internet.

When I have PC's plugged into Fe2, Fe3, Fe4 and Fe9 and then issue a "show ip int brief" command on the router it returns this:

Interface                       IP-Address       OK?   Method   Status                            Protocol
FastEthernet0              223.103.5.175   YES   NVRAM  up                                  up
FastEthernet1              unassigned       YES   NVRAM  administratively down   down
FastEthernet2              unassigned       YES   unset      up                                  up
FastEthernet3              unassigned       YES   unset      up                                  up
FastEthernet4              unassigned       YES   unset      up                                  up
FastEthernet5              unassigned       YES   unset      up                                  down
FastEthernet6              unassigned       YES   unset      up                                  down
FastEthernet7              unassigned       YES   unset      up                                  down
FastEthernet8              unassigned       YES   unset      up                                  down
FastEthernet9              unassigned       YES   unset      up                                  up
Dot11Radio0                unassigned       YES   NVRAM  administratively down   down
Dot11Radio1                unassigned       YES   NVRAM  administratively down   down
Vlan1                           10.10.10.1         YES   NVRAM  up                                  up
Async1                        unassigned       YES   NVRAM  down                            down
NVI0                            223.103.5.175    YES   unset      up                                 up
Vlan2                          10.10.20.1          YES   NVRAM  up                                  down

The 3 computerss connected to Fe2-Fe4 are able to get online and ping their gateway (10.10.10.1), but the pc on Fe9 cannot get internet access and cannot ping it's gateway (10.10.20.1) although windows shows it to be connected.

What do I need to change in my configuration to allow VLAN 2 (10.10.20.0) to get up and working?

!
version 12.4
no service config
no service timestamps debug datetime msec
no service timestamps log datetime msec
no service password-encryption
!
hostname xxxxx
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
clock timezone PCTime -5
!
!
ip dhcp excluded-address 10.10.10.1
ip dhcp excluded-address 10.10.20.1
!
!
ip cef
ip domain name xxxxxx
ip name-server 68.94.156.1
ip name-server 68.94.157.1
no ipv6 cef
!
multilink bundle-name authenticated
!
username xxxxx privilege 15 password xxxxx
!
!
archive
 log config
 hidekeys
!
!
interface FastEthernet0
 description $xxxxx Gateway$
 ip address 223.103.5.175 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1
 no ip address
 no ip route-cache
 shutdown
 duplex auto
 speed auto
 no cdp enable
!
interface FastEthernet2
 switchport access vlan 1
!
interface FastEthernet3
 switchport access vlan 1 
!
interface FastEthernet4
 switchport access vlan 1
!
interface FastEthernet5
 switchport access vlan 1
!
interface FastEthernet6
 switchport access vlan 1
!
interface FastEthernet7
 switchport access vlan 1
!
interface FastEthernet8
 switchport access vlan 1
!
interface FastEthernet9
 switchport access vlan 2
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
 no cdp enable
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
 station-role root
 no cdp enable
!
interface Vlan1
 description $xxxxx Network Block$
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Vlan2
 description $xxxxx Network Block$
 ip address 10.10.20.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Async1
 no ip address
 encapsulation slip
 no ip route-cache
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 223.103.5.1
!
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0 overload
!
!
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.20.0 0.0.0.255
!
!
control-plane
!
!
banner login ^
---------------------------------------------------------
Only xxxxx Employee's may access this device.
If you are NOT an authorized user, disconnect now!!!
---------------------------------------------------------
^
!
!
line con 0
 login local
line 1
 modem InOut
 stopbits 1
 speed 115200
 flowcontrol hardware
line aux 0
line vty 0 4
 password xxxxx
 login
!
no process cpu extended
no process cpu autoprofile hog
end

Open in new window

0
Comment
Question by:P1ST0LPETE
  • 8
  • 5
  • 4
17 Comments
 
LVL 50

Expert Comment

by:Don Johnston
ID: 33588365
Can a PC on VLAN 2 ping the 10.10.20.1 address?

I recall something about a limit of 1 functional VLAN on some routers.
0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33588428
No.  Fe9 is the one and only interface that I have setup for VLAN 2, and a pc hooked up to it cannot ping 10.10.20.1.

I've tried changing the config around too, making Fe9 a VLAN 1 interface and putting one of the other interfaces like Fe4 on VLAN 2.  When I do this, Fe9 works just perfect onVLAN 1, and then Fe4 can't do anything ping it's gateway or get internet access.
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33588480
Try changing lines 121 and 122:

access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

ACL's should increment and usually start with 10 and go up by 10 each time.
0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33588540
So if I changed this:
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.20.0 0.0.0.255

to this:
access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

would I need to change this:
ip nat inside source list 1 interface FastEthernet0 overload

to this:
ip nat inside source list 10 interface FastEthernet0 overload
ip nat inside source list 20 interface FastEthernet0 overload
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33588685
Since you are allowing all 10.10.10.x and all 10.10.20.x addresses you could do it the lazy way and create one access list:

access-list 10 permit 10.10.0.0 0.0.255.255
ip nat inside source list 10 interface FastEthernet0 overload

However this will will permit all address from 10.10.0.1 to 10.10.255.255 and would then rely on security in other areas

You could get more restrictive with the third octet but not to the point of eliminating the addresses 10.10.11.0 through 10.10.19.255 still leaving a large hole.

So basically speaking I would say yes you need both nat's that you have listed.
0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33588856
ok, changed the access-lists to look like this:
access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

and changed my nat to look like this:
ip nat inside source list 10 interface FastEthernet0 overload
ip nat inside source list 20 interface FastEthernet0 overload

VLAN 2 still shows it's protocol as down, and no pc plugged into a port assigned to VLAN 2 can ping the IP address assign to VLAN 2.
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 33588946
Sounds like your platform is one of those that only allow 1 VLAN.
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33589114
Does the PC get a 10.10.20.x address when plugged into the VLAN2 port?
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33589193
I am manually assigning the pc's static IP addresses. I don't have dhcp setup on the router yet - and don't even know how at this point :-)
0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33589485
Did some searching around.  The Cisco 1811 that I have supports up to 8 VLANs.
0
 
LVL 50

Accepted Solution

by:
Don Johnston earned 500 total points
ID: 33589795
Then it's probably a missing vlan issue.

Verify that VLAN 2 exists (not just the vlan interface) and if it doesn't, create it.

I believe that on your platform, you have to do this in vlan database mode

Router# vlan database
Router(vlan-data)# vlan 2
Router(vlan-data)# exit (NOT ctl- Z or end)
Router#

0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33590129
Ok, did the following:

Router# vlan database

This threw a warning saying "It is recommended to configure VLAN from config mode, as VLAN database mode is being deprecated. Please consult user documentation for configuring VTP/VLAN config mode.

Changed my cursor to Router(vlan)# not Router(vlan-data)#

Anyway, typed in "show"
Router(vlan)#show

and it displayed this:

VLAN ISL Id: 1
    Name: default
    Media Type: Ethernet
    VLAN 802.10 Id: 100001
    State: Operational
    MTU: 1500
    Translational Bridged VLAN: 1002
    Translational Bridged VLAN: 1003

  VLAN ISL Id: 1002
    Name: fddi-default
    Media Type: FDDI
    VLAN 802.10 Id: 101002
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Translational Bridged VLAN: 1
    Translational Bridged VLAN: 1003

  VLAN ISL Id: 1003
    Name: token-ring-default
    Media Type: Token Ring
    VLAN 802.10 Id: 101003
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Ring Number: 0
    Bridge Number: 1
    Parent VLAN: 1005
    Maximum ARE Hop Count: 7
    Maximum STE Hop Count: 7
    Backup CRF Mode: Disabled
    Translational Bridged VLAN: 1
    Translational Bridged VLAN: 1002

  VLAN ISL Id: 1004
    Name: fddinet-default
    Media Type: FDDI Net
    VLAN 802.10 Id: 101004
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Bridge Number: 1
    STP Type: IBM

  VLAN ISL Id: 1005
    Name: trnet-default
    Media Type: Token Ring Net
    VLAN 802.10 Id: 101005
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Bridge Number: 1
    STP Type: IBM

Can't really decipher what this is telling me.  How else should I verify is VLAN 2 is actually created?
0
 
LVL 10

Author Comment

by:P1ST0LPETE
ID: 33590384
Pulled up some more stuff on the router.

Router#show vlan-switch

VLAN Name                                     Status        Ports
----     --------------------------------    ---------      -------------------------------
1        default                                     active       Fa2, Fa3, Fa4, Fa5, Fa6, Fa7, Fa8
1002 fddi-default                            act/unsup
1003 token-ring-default                  act/unsup
1004 fddinet-default                       act/unsup
1005 trnet-default                           act/unsup

VLAN  Type     SAID      MTU   Parent  RingNo   BridgeNo    Stp   BrdgMode   Trans1    Trans2
----      -----    ----------   -----    ------     ------      --------       ----    --------         ------       ------
1         enet    100001    1500      -            -              -             -           -              1002     1003
1002   fddi     101002    1500      -            -              -             -           -                 1        1003
1003     tr       101003    1500  1005         0             -             -         srb               1        1002
1004  fdnet    101004    1500      -            -             1           ibm         -                 0           0
1005   trnet    101005    1500      -            -             1           ibm         -                 0           0


Then typed in
Router#show vlans

and the response was "No Virtual LANs configured."

What have I done wrong?  I have VLAN 2 in my config file.  Even doing a "show run" shows it....
0
 
LVL 50

Assisted Solution

by:Don Johnston
Don Johnston earned 500 total points
ID: 33590505
You don't have a VLAN 2. You need to create it.

Once you're in vlan database mode, create vlan 2.

Or you can do it in global config mode.

config t
vlan 2
exit

or

vlan data
vlan 2
exit

Then it will work.
0
 
LVL 10

Author Closing Comment

by:P1ST0LPETE
ID: 33590541
Been pulling my hair out all day on this one.  Added vlan to the database, and now it works, thanks for the hellp.
0
 
LVL 26

Expert Comment

by:pony10us
ID: 33590561
I bow to Don on this one.  VLAN2 does not exist and needs to be created.  
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 33590567
Simply kissing my ring will suffice. ;-)

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now