VLAN configuration on a SG 300-52

Posted on 2011-03-18
Last Modified: 2012-05-11
I am both new to these forums as well as new to VLANs, so please take it easy on me ;)

I am attempting to configure 4 SG 300-52 Gigabit switches to accommodate 4 VLANs, and attach 4 WAP4410N  AP's to that network. I have been able to create separate VLANs, but I can seem to configure a single line to carry multiple VLANs. I need this, because the APs are VLAN capable, but they only have one ethernet port. From what I am reading, that single port is called a trunk. But every time I configure a port to say, VLAN 10, then the uplink I am trying to use (on the management VLAN 1) no longer gives connectivity to that port. I am a systems engineer and great with servers, but obviously networking is still a mystery to me :)  Can someone describe to me in detail how to configure this new Cisco branded interface (I can only find screenshots/instructions for the old Linksys model, which has changed), or point me to a easy to follow document? A simple configuration model to use for an explanation would be this: a single SG 300-52 switch with 24 ports on VLAN 10 and 24 ports on VLAN 20. Port 49 and 50 for uplink connectivity to two different gateways (one for each VLAN, we are two different companies sharing the same network devices), Port 51 goes out to the next switch and needs to carry both VLAN 10 and 20, and port 52 needs to go to the WAP, and carry both VLANs as well. The WAP has support for 4 VLANs and 4 SSIDs, btw.

Is this even possible? Do I have to stick with separate VLANs, each with their own input from router and output to the next switches same VLAN?

Part of the problem is I have trouble understanding why a port configured as a PVID/trunk on VLAN 1, and either tagged or untagged on VLAN 10, will not allow connectivity to ports set as PVID on VLAN and either tagged or untagged on VLAN 1. Also to further complicate the mix, I am confused by the Access/General/Trunk nomenclature used for the whole setup. Please help, we are moving to the new building next week, and I am pulling my hair out!
Question by:B3nt
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2

Accepted Solution

lcappelli earned 125 total points
ID: 35177148

General—The interface can support all functions as defined in the
IEEE 802.1q specification. The interface can be a tagged or untagged
member of one or more VLANs. This is a hybrid port that allows both tagged and untagged traffic. It’s a catch all port I think meant to handle the advertized guest vlan services

- Access—The interface is an untagged member of a single VLAN. A port
configured in this mode is known as an access port. This is a port destined for a particular vlan group. These ports are used for computers to connect to the switch. An acess port can use voice vlans. The phone is a mini switch and has a computer port on the phone. You connect the phone to the switch and  a computer to the phone and the voice vlan keeps the phone traffic and the data or regular vlan keeps the data traffic separate on the same wire.

- Trunk—The interface is an untagged member of one VLAN at most, and
is a tagged member of zero or more VLANs. A port configured in this
mode is known as a trunk port.  This means that this port is used to carry multiple vlans up a port to a server or another switch, but these messages are not meant to  co-mingle as they travel up  the same wire, they are still part of their logical vlans. When they reach the upstream switch the traffic is again kept separate to the vlan

If you have no external router, I not sure if you realize this but you have to set it up so that the switches routing capability (static routing according to the Cisco site) routes so that the vlans are allowed to talk to each other.
When you set a port as access vlan 10, it no longer can talk with vlan 20, for example, unless some sort of routing is enabled via turning on internal aka virtual vlan interfaces. This is known as the oximoron "layer 3 switches"

 I am familiar with the IOS version of the Cisco switches but not with the managed switch via browser, but the switch in order to allow vlans to cross messages to the other vlan broadcast domains ie networks, must have an interface on each vlan. This interface can be a virtual interface ( for example: int vlan 10  will have an ip and subnet mask and be enabled,, int vlan 20 will have an ip and subnet mask and be enabled. The switch can than route between these vlans and your switch has the ability to static  route.

Here is the guide
Here is a quote from sg300 literature

” Static routing/Layer 3 switching between VLANs: This capability allows you to segment your network into separate workgroups and communicate across VLANs without degrading application performance. As a result, you can manage internal routing with your switches and dedicate your router to external traffic and security, helping your network run more efficiently.”

So your switch can do layer 3 routing between vlans set up on the same switch.
“Wirespeed routing of IPv4 packets
Up to 32 static routes and up to 32 IP interfaces
Allow/disallow routing between IP subnets or directly connected IP networks”
Here  is another link to an admin guide:
Cisco admin guide quoted below

Management and IP Interfaces
The factory default setting of the IP address configuration is DHCP. This means
that the switch acts as a DHCP client, and sends out a DHCP request during boot

If the switch receives a DHCP response from the DHCP server with an IP address,
it sends Address Resolution Protocol (ARP) packets to confirm that the IP address
is unique. If the ARP response shows that the IP address is in use, the switch sends
a DHCPDECLINE message to the offering DHCP server, and sends another
DHCPDISCOVER packet that restarts the process.

If the switch does not receive a DHCP response in 60 seconds, it continues to
send DHCPDISCOVER queries, and adopts the default IP address:

IP Addressing
The switch can work in a Layer 2 mode or a Layer 3 mode.
• In Layer 2 mode, the switch operates as a Layer 2 VLAN-aware switch, and
has no routing capabilities.
• In Layer 3 mode, the switch has IP routing capabilities as well as Layer 2
mode capabilities.
In Layer 3 mode, the switch does not support MAC based VLAN, Dynamic
VLAN Assignment, VLAN Rate Limit, SYN Rate DoS Protection, and
Advanced QoS Policers.

Layer 3 IP Addressing
In Layer 3 mode, the switch can have multiple IP addresses. Each IP address can
be assigned to specified ports, LAGs, or VLANs. These IP addresses are
configured in the IPv4 Interface Page in Layer 3 mode. This provides more
network flexibility versus the Layer 2 mode, in which only a single IP address can
be configured. Operating in Layer 3 mode, the switch can be reached at all its IP
addresses from the corresponding interfaces.

A predefined, default route is not provided in Layer 3 mode. To remotely manage
the switch, a default route must be defined. Any DHCP-assigned default gateways
are stored as default routes. In addition, you can manually define default routes.
This is defined in the IP Static Routing Page.

NOTE The switch can be switched from Layer 2 mode to Layer 3 mode only by using the
console interface. When this is done, all configuration settings are returned to their
default values. For more information about the console interface, see the Console
Menu Interface chapter in the administration guide.

IPv4 Address Configuration
Path: Switch Main Menu > System Configuration Menu > IP Configuration
Use the IPv4 Address Configuration Menu to configure the switch IPv4 address.

IPv4 Address Settings
Path: Switch Main Menu > System Configuration Menu > IP Configuration
Use IP Address - Add/IP Address Settings to add or change the switch IPv4
• IPv4 Address—Enter the IPv4 address that you want to assign to the switch
if the switch is disabled as a DHCP client. Verify that the IP address does
not conflict with another device on the network.
• Subnet Mask—Enter the subnet mask that you want to assign to the switch.
• Default Gateway—Enter the default gateway address for the switch (IPv4
Address Settings).
• Management VLAN—Enter the management VLAN ID (IPv4 Address
• DHCP Client—Use the Spacebar to enable or disable the DHCP client.
• Interface Type—Select the interface type, LAG, VLAN, or GE (IPv4 Address
• Interface Number—Enter the interface number (IPv4 Address Add).
IPv4 Address Table
Path: Switch Main Menu > System Configuration Menu > IP Configuration
The IP Address Table displays the IPv4 addresses in Layer 3.
• Delete/Keep—Use the SPACE bar to toggle between Delete and Keep.
When the action is executed, this entry is acted upon based on your

Defining IPv4 Static Routing

When the switch is in Layer 3 mode, this page enables configuring and viewing
IPv4 static routes on the switch. When routing traffic, the next hop is decided
based on the longest prefix match (LPM algorithm). A destination IPv4 address
may match multiple routes in the IPv4 Static Route Table. The switch uses the
matched route with the highest subnet mask, that is, the longest prefix match.
To define an IP static route:

STEP 1 Click IP Configuration > IP Static Routes.
The IP Static Routing Page opens.
STEP 2 Click Add. The Add IP Static Route Page opens.
STEP 3 Enter the values for the following fields:
• Destination IP Prefix—Enter the destination IP address prefix.
• Mask—Select and enter information for one of the following:
- Network Mask—The IP route prefix for the destination IP.
- Prefix Length—The IP route prefix for the destination IP.
• Next Hop Router IP Address—Enter the next hop IP address or IP alias on
the route
NOTE You cannot configure a static route through a directly-connected IP
subnet where the switch gets its IP address from a DHCP server.

• Route Type—Select the route type.
- Reject—Rejects the route and stops routing to the destination network
via all gateways. This ensures that if a frame arrives with the destination
IP of this route, it is dropped.
- Remote—Indicates that the route is a remote path.
• Metric—Enter the administrative distance to the next hop. The range is 1–
STEP 4 Click Apply. The IP Static route is added, and switch is updated.



Author Comment

ID: 35198012
I appreciate your detailed response! However the situation has evolved as I have educated myself over the past week. I now know my switches were in Layer 2 mode, and I want to keep them that way. I think this has not been working becasue I have these 4 switches plugged into a dumb switch which is our current backbone, thus the VLAN uplink is non-functional.  I now want to run a trunk to my ASA, and configure my inside interface to utilize 4 VLAN sub interfaces. My fear is that since the physical interface is configured now as gateway, if I add the subinterfaces that I might lose the current configuration... Anyways I have a contractor coming to assist with that tomorrow, so I'll accept your solution... as I checked into it, I realized what direction I really needed to go. Thank you!

Author Closing Comment

ID: 35198031
This was great, but just a little bit of a 10,000 feet perspective... I needed more of a walkthrough, the theory I mostly undderstood, it was the implementation. Thanks anyways though, as I didn't make that clear initially.

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are times where you would like to have access to information that is only available from a different network. This network could be down the hall, or across country. If each of the network sites have access to the internet, you can create a ne…
Security is one of the biggest concerns when moving and migrating your data from your on-premise location to the Public Cloud.  Where is your data? Who can access it? Will it be safe from accidental deletion?  All of these questions and more are imp…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question