Link to home
Start Free TrialLog in
Avatar of P1ST0LPETE
P1ST0LPETEFlag for United States of America

asked on

Trouble getting 2nd VLAN to connect to internet

Experts,

I have the following config (see below) running on my Cisco 1811 router.  When I connect a pc to Fe1-Fe8  with a 10.10.10.0 network address then I am able to fully connect to the internet.  However, when I connect a pc to Fe9 with a 10.10.20.0 address I am not able to connect to the internet.

When I have PC's plugged into Fe2, Fe3, Fe4 and Fe9 and then issue a "show ip int brief" command on the router it returns this:

Interface                       IP-Address       OK?   Method   Status                            Protocol
FastEthernet0              223.103.5.175   YES   NVRAM  up                                  up
FastEthernet1              unassigned       YES   NVRAM  administratively down   down
FastEthernet2              unassigned       YES   unset      up                                  up
FastEthernet3              unassigned       YES   unset      up                                  up
FastEthernet4              unassigned       YES   unset      up                                  up
FastEthernet5              unassigned       YES   unset      up                                  down
FastEthernet6              unassigned       YES   unset      up                                  down
FastEthernet7              unassigned       YES   unset      up                                  down
FastEthernet8              unassigned       YES   unset      up                                  down
FastEthernet9              unassigned       YES   unset      up                                  up
Dot11Radio0                unassigned       YES   NVRAM  administratively down   down
Dot11Radio1                unassigned       YES   NVRAM  administratively down   down
Vlan1                           10.10.10.1         YES   NVRAM  up                                  up
Async1                        unassigned       YES   NVRAM  down                            down
NVI0                            223.103.5.175    YES   unset      up                                 up
Vlan2                          10.10.20.1          YES   NVRAM  up                                  down

The 3 computerss connected to Fe2-Fe4 are able to get online and ping their gateway (10.10.10.1), but the pc on Fe9 cannot get internet access and cannot ping it's gateway (10.10.20.1) although windows shows it to be connected.

What do I need to change in my configuration to allow VLAN 2 (10.10.20.0) to get up and working?

!
version 12.4
no service config
no service timestamps debug datetime msec
no service timestamps log datetime msec
no service password-encryption
!
hostname xxxxx
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
clock timezone PCTime -5
!
!
ip dhcp excluded-address 10.10.10.1
ip dhcp excluded-address 10.10.20.1
!
!
ip cef
ip domain name xxxxxx
ip name-server 68.94.156.1
ip name-server 68.94.157.1
no ipv6 cef
!
multilink bundle-name authenticated
!
username xxxxx privilege 15 password xxxxx
!
!
archive
 log config
 hidekeys
!
!
interface FastEthernet0
 description $xxxxx Gateway$
 ip address 223.103.5.175 255.255.255.0
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface FastEthernet1
 no ip address
 no ip route-cache
 shutdown
 duplex auto
 speed auto
 no cdp enable
!
interface FastEthernet2
 switchport access vlan 1
!
interface FastEthernet3
 switchport access vlan 1 
!
interface FastEthernet4
 switchport access vlan 1
!
interface FastEthernet5
 switchport access vlan 1
!
interface FastEthernet6
 switchport access vlan 1
!
interface FastEthernet7
 switchport access vlan 1
!
interface FastEthernet8
 switchport access vlan 1
!
interface FastEthernet9
 switchport access vlan 2
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
 no cdp enable
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
 station-role root
 no cdp enable
!
interface Vlan1
 description $xxxxx Network Block$
 ip address 10.10.10.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Vlan2
 description $xxxxx Network Block$
 ip address 10.10.20.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Async1
 no ip address
 encapsulation slip
 no ip route-cache
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 223.103.5.1
!
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0 overload
!
!
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.20.0 0.0.0.255
!
!
control-plane
!
!
banner login ^
---------------------------------------------------------
Only xxxxx Employee's may access this device.
If you are NOT an authorized user, disconnect now!!!
---------------------------------------------------------
^
!
!
line con 0
 login local
line 1
 modem InOut
 stopbits 1
 speed 115200
 flowcontrol hardware
line aux 0
line vty 0 4
 password xxxxx
 login
!
no process cpu extended
no process cpu autoprofile hog
end

Open in new window

Avatar of Don Johnston
Don Johnston
Flag of United States of America image

Can a PC on VLAN 2 ping the 10.10.20.1 address?

I recall something about a limit of 1 functional VLAN on some routers.
Avatar of P1ST0LPETE

ASKER

No.  Fe9 is the one and only interface that I have setup for VLAN 2, and a pc hooked up to it cannot ping 10.10.20.1.

I've tried changing the config around too, making Fe9 a VLAN 1 interface and putting one of the other interfaces like Fe4 on VLAN 2.  When I do this, Fe9 works just perfect onVLAN 1, and then Fe4 can't do anything ping it's gateway or get internet access.
Try changing lines 121 and 122:

access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

ACL's should increment and usually start with 10 and go up by 10 each time.
So if I changed this:
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 1 permit 10.10.20.0 0.0.0.255

to this:
access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

would I need to change this:
ip nat inside source list 1 interface FastEthernet0 overload

to this:
ip nat inside source list 10 interface FastEthernet0 overload
ip nat inside source list 20 interface FastEthernet0 overload
Since you are allowing all 10.10.10.x and all 10.10.20.x addresses you could do it the lazy way and create one access list:

access-list 10 permit 10.10.0.0 0.0.255.255
ip nat inside source list 10 interface FastEthernet0 overload

However this will will permit all address from 10.10.0.1 to 10.10.255.255 and would then rely on security in other areas

You could get more restrictive with the third octet but not to the point of eliminating the addresses 10.10.11.0 through 10.10.19.255 still leaving a large hole.

So basically speaking I would say yes you need both nat's that you have listed.
ok, changed the access-lists to look like this:
access-list 10 permit 10.10.10.0 0.0.0.255
access-list 20 permit 10.10.20.0 0.0.0.255

and changed my nat to look like this:
ip nat inside source list 10 interface FastEthernet0 overload
ip nat inside source list 20 interface FastEthernet0 overload

VLAN 2 still shows it's protocol as down, and no pc plugged into a port assigned to VLAN 2 can ping the IP address assign to VLAN 2.
Sounds like your platform is one of those that only allow 1 VLAN.
Does the PC get a 10.10.20.x address when plugged into the VLAN2 port?
I am manually assigning the pc's static IP addresses. I don't have dhcp setup on the router yet - and don't even know how at this point :-)
Did some searching around.  The Cisco 1811 that I have supports up to 8 VLANs.
ASKER CERTIFIED SOLUTION
Avatar of Don Johnston
Don Johnston
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Ok, did the following:

Router# vlan database

This threw a warning saying "It is recommended to configure VLAN from config mode, as VLAN database mode is being deprecated. Please consult user documentation for configuring VTP/VLAN config mode.

Changed my cursor to Router(vlan)# not Router(vlan-data)#

Anyway, typed in "show"
Router(vlan)#show

and it displayed this:

VLAN ISL Id: 1
    Name: default
    Media Type: Ethernet
    VLAN 802.10 Id: 100001
    State: Operational
    MTU: 1500
    Translational Bridged VLAN: 1002
    Translational Bridged VLAN: 1003

  VLAN ISL Id: 1002
    Name: fddi-default
    Media Type: FDDI
    VLAN 802.10 Id: 101002
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Translational Bridged VLAN: 1
    Translational Bridged VLAN: 1003

  VLAN ISL Id: 1003
    Name: token-ring-default
    Media Type: Token Ring
    VLAN 802.10 Id: 101003
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Ring Number: 0
    Bridge Number: 1
    Parent VLAN: 1005
    Maximum ARE Hop Count: 7
    Maximum STE Hop Count: 7
    Backup CRF Mode: Disabled
    Translational Bridged VLAN: 1
    Translational Bridged VLAN: 1002

  VLAN ISL Id: 1004
    Name: fddinet-default
    Media Type: FDDI Net
    VLAN 802.10 Id: 101004
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Bridge Number: 1
    STP Type: IBM

  VLAN ISL Id: 1005
    Name: trnet-default
    Media Type: Token Ring Net
    VLAN 802.10 Id: 101005
    State: Operational
    MTU: 1500
    Bridge Type: SRB
    Bridge Number: 1
    STP Type: IBM

Can't really decipher what this is telling me.  How else should I verify is VLAN 2 is actually created?
Pulled up some more stuff on the router.

Router#show vlan-switch

VLAN Name                                     Status        Ports
----     --------------------------------    ---------      -------------------------------
1        default                                     active       Fa2, Fa3, Fa4, Fa5, Fa6, Fa7, Fa8
1002 fddi-default                            act/unsup
1003 token-ring-default                  act/unsup
1004 fddinet-default                       act/unsup
1005 trnet-default                           act/unsup

VLAN  Type     SAID      MTU   Parent  RingNo   BridgeNo    Stp   BrdgMode   Trans1    Trans2
----      -----    ----------   -----    ------     ------      --------       ----    --------         ------       ------
1         enet    100001    1500      -            -              -             -           -              1002     1003
1002   fddi     101002    1500      -            -              -             -           -                 1        1003
1003     tr       101003    1500  1005         0             -             -         srb               1        1002
1004  fdnet    101004    1500      -            -             1           ibm         -                 0           0
1005   trnet    101005    1500      -            -             1           ibm         -                 0           0


Then typed in
Router#show vlans

and the response was "No Virtual LANs configured."

What have I done wrong?  I have VLAN 2 in my config file.  Even doing a "show run" shows it....
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Been pulling my hair out all day on this one.  Added vlan to the database, and now it works, thanks for the hellp.
I bow to Don on this one.  VLAN2 does not exist and needs to be created.  
Simply kissing my ring will suffice. ;-)