Avatar of cwellsatl

asked on 

VLANs and routing with layer 2 Cisco 2960G

I have a network with five Layer 2 2960G switches. We also have an old Cisco 4000 Core layer 3 switch which have several VLAN's for our phones and related networking equipment and intervlan routing enabled. Up until now the 2960s have been flat with a single default VLAN. But now I need to create new VLANS on all devices as I need to change the internal IP range of the network to a new scheme. The plan is to implement this new scheme over a matter of months with devices slowly changing their IP address to the new scheme.

I set the ports that connect to each of the switches to Trunking and I have enabled VTP communication between all the switches and the 2960s all show the VLANs that they received from the 4000.

So what I need is to be able to do is have all of the ports on the 2960s to be members of two vlans at the same time. That way devices can be changed to the new scheme at anytime without having to reconfigure ports for vlans as they are needed.

I have tried several things but cant get them to work. Here is an example of what one of the ports looks like on the 2960s now.

interface GigabitEthernet0/1
 switchport trunk allowed vlan 1,10
 spanning-tree portfast

Here is a SHOW VLAN from the same switch

2960G-1#sh vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3, Gi0/4
                                                Gi0/5, Gi0/6, Gi0/7, Gi0/8
                                                Gi0/9, Gi0/10, Gi0/11, Gi0/12
                                                Gi0/13, Gi0/14, Gi0/15, Gi0/16
                                                Gi0/17, Gi0/18, Gi0/19, Gi0/20
                                                Gi0/21, Gi0/22, Gi0/23, Gi0/24
                                                Gi0/25, Gi0/26, Gi0/27, Gi0/28
                                                Gi0/29, Gi0/30, Gi0/31, Gi0/32
                                                Gi0/33, Gi0/34, Gi0/35, Gi0/36
                                                Gi0/37, Gi0/38, Gi0/39, Gi0/40
                                                Gi0/41, Gi0/42, Gi0/43, Gi0/44
                                                Gi0/45, Gi0/46, Gi0/47
10   VLAN0010                         active
15   VLAN0015                         active
20   VLAN0020                         active
30   VLAN0030                         active
45   VLAN0045                         active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
15   enet  100015     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
30   enet  100030     1500  -      -      -        -    -        0      0
45   enet  100045     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    srb      0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
Thanks in advance for any assistance
Switches / Hubs

Avatar of undefined
Last Comment
Avatar of Hutch_77
Flag of United States of America image

As this is very fresh on my mind I will give you some suggestions to look at but I was using a Power Connect so the way to do it will be different.

Right now everything is untagged default and a PVID of the default.

You will want to set the PVID to I would imagine your resulting vlan for the port and then add an untagged to the current vlan
Avatar of John Meggers
John Meggers
Flag of United States of America image

I don't know of any way you can have a port be participating in two VLANs at the same time unless it's a trunk, or unless you're using a voice vlan where you have a phone connected, with a PC connected to the phone and you want both devices to be on different VLANs.  But that's not what you're trying to do, as I understand it.

Keep in mind, you can use the "interface range" command to change a number of ports to a different VLAN at one time, rather than changing them one at a time.  Still requires some reconfiguration, but makes it easier.
Avatar of rfc1180
Flag of United States of America image

What is it that you are trying to that makes you think you need a port member of 2 vlans.

Avatar of Don Johnston
Don Johnston
Flag of United States of America image

Cisco used to allow a port to be a member of more than one VLAN long ago. I believe the command was "switchport mode multi". But that feature is long gone.

The closest you can get to that now is a trunk port.

Making a port a member of more than one VLAN kind of defeats the purpose of having VLANs.
What will the second vlan that you want the port to access be for? Is it for VOIP? If the ports are to only have access to those specific vlans then the way to go about this is to assign the ports to one vlan and then create access lists that restrict traffic.
Avatar of Craig Beck
Craig Beck
Flag of United Kingdom of Great Britain and Northern Ireland image

If I am guessing right you want each port to be on VLAN1 now and VLAN2 (for example) in the future, and that the devices are workstations, printers, etc?

You can only really do this if you configure trunk ports on the switches and tag the VLAN ID on the device.  If the NIC in your PC supports this you could do it, but I doubt most of your devices will have this functionality.  At best they will remain in VLAN1.

The other option would be 802.1X and assign the VLAN ID to devices based on a policy, but that isn't easy to implement, and again some of your devices might not support 802.1X.

I would just prepare the switch with the VLANs you need (as you have already using VTP) and configure the ports when you are ready to move the devices to the new VLAN.
Avatar of eeRoot

How are the VLAN's and ports configured on the 4000?  Since it is the root of the network, all VLAN's will need to be created there and the ports will need to be trunked.

Make sure all the switches are set to "VTP mode transparent" and are not using VTP domains.  What is the IP range/subnet of VLAN 1?  Do the new VLAN's have different IP ranges/subnets?  Also, because a new VLAN doesn't activate until a device tries to use it, give the 4000 and a few of the 2960's IP addresses in VLAN10, then do some test pings.
Avatar of kcoect
Flag of United States of America image

Blurred text
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Avatar of kcoect
Flag of United States of America image

Donjohnston, your correct, I was curious about the "switchport mode multi" command and it looks like it was taken out with IOS version 12.x.x.  I see it referenced in a configuration with version 11.2, but I just checkeda 3570 and 2950 switch I have at home and it's definitely not there.
Yes, a trunk could be a solution but as mentioned can be a security risk. However that security risk comes from the native vlan being present in the trunk and that can be changed to make it more secure. What would need to be done is tag the native vlan and then only allow the 2 specific vlans over the trunk. you will need to allow the vlans on trunks connecting switches together on all the switches that you configure this command also.

configure terminal
switchport tag vlan 1 (assuming vlan 1 is your native vlan)

int fa0/1
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allow vlan 1,10

It would be best if you change the native vlan to an unused vlan number.
Avatar of cwellsatl


Thanks for all of the input. We ended up getting Cisco Support involved. Even though the 4000 was not under SmartNet, the 2960's were.
Basically what I wanted to accomplish is not possible for security reasons. I was advised that as we migrate to the new IP range, change each port on an as needed basis.
Having the ARP tables handle most of this was also an option, but did not want all of that traffic of updating ARP tables between the switches.
Switches / Hubs
Switches / Hubs

A switch is a device that filters and forwards packets of data between LAN segments. Switches operate at the data link layer or the network layer of the Open Systems Interconnection (OSI) Reference Model and therefore support any packet protocol. LANs that use switches to join segments are called switched LANs or, in the case of Ethernet networks, switched Ethernet LANs. A hub is a connection point for devices in a network. Hubs are commonly used to connect segments of a LAN. A hub contains multiple ports; when a packet arrives at one port, it is copied to the other ports so that all segments of the LAN can see all packets.

Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews


IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo