Solved

Cisco VLAN addition

Posted on 2014-04-02
40
303 Views
Last Modified: 2014-06-13
Hello,

I need a little help adding a VLAN to a Cisco 3560. I'm not a Cisco expert, but I do ok.

Attached is the running config of the box. I have VLAN 1300, 1301, and 1302 running fine.

Problem. We are running out of IP address on 10.13.1.x (1301)
I created a superscope and added 10.13.3.x, it is to reside on VLAN 1303

I added the 1303 VLAN to the Cicso box, copying what is already there, so everything looks good to me.

Results:
Users on 10.13.1.x can ping 10.13.3.1, but nothing beyond (ie 10.13.3.2...)
Users can get a 10.13.3.x ip address...but cannot ping 10.13.3.1 or anything in the 10.13.2.x or 10.13.1.x network.
cisco.txt
0
Comment
Question by:pdesjardins1
  • 21
  • 11
  • 6
  • +1
40 Comments
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
Is the IP on the SVI of the 3560 the gateway address of the devices

eg
for vlan 1300 default gateway on clients = 10.13.0.254
for vlan 1301 default gateway on clients = 10.13.1.1
for vlan 1302 default gateway on clients = 10.13.2.1
for vlan 1303 default gateway on clients = 10.13.3.1

Also, post the result of "show ip route"
0
 

Author Comment

by:pdesjardins1
Comment Utility
Hello,
Thank you for your reply.
You have listed the vlans and gateways correctly.

--------------------------------------
User Access Verification

Username:
Password:
#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.13.0.1 to network 0.0.0.0

S    192.168.77.0/24 [1/0] via 10.13.0.3
     10.0.0.0/8 is variably subnetted, 10 subnets, 3 masks
C       10.13.3.0/24 is directly connected, Vlan1303
C       10.13.2.0/24 is directly connected, Vlan1302
C       10.13.1.0/24 is directly connected, Vlan1301
C       10.13.0.0/24 is directly connected, Vlan1300
S       10.3.0.0/22 [1/0] via 10.13.0.3
S       10.0.0.0/8 [1/0] via 10.13.0.2
S       10.29.0.0/22 [1/0] via 10.13.0.3
S       10.60.0.0/22 [1/0] via 10.13.0.1
S       10.66.0.0/22 [1/0] via 10.13.0.1
S       10.89.0.0/22 [1/0] via 10.13.0.3
S*   0.0.0.0/0 [1/0] via 10.13.0.1
S    192.168.0.0/16 [1/0] via 10.13.0.4
0
 
LVL 10

Expert Comment

by:Rafael
Comment Utility
The issue seems to be in your routes.

IP Helper address are normally used for UDP.

Do you have any firewalls in place? Also you may have to add in a static route.

ip route 0.0.0.0 0.0.0.0 10.13.0.1
ip route 10.0.0.0 255.0.0.0 10.13.0.2
ip route 10.3.0.0 255.255.252.0 10.13.0.3 <------------You may have to pull this one.
0
 

Author Comment

by:pdesjardins1
Comment Utility
I need the IP helpers, as that 10.13.1.2 is my DHCP server.
I think it works because items can get the 10.13.3.x addresses.

ip route 10.3.0.0...why would this be an issue?

10.13.0.1, 10.13.0.2, 10.13.0.3, 10.13.0.4 are all firewalls.
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
Is it something as simple as not giving the clients on the new VLAN the correct gateway address?

It could be that your DHCP server is using 10.13.0.1 as its default gateway, and has static routes configured, but that's unlikely if the clients are actually getting IP addresses.
0
 

Author Comment

by:pdesjardins1
Comment Utility
craigbeck, I re-checked and the gateway is listed at 10.13.3.1
I can even put in a static IP and get the same results.
0
 
LVL 10

Expert Comment

by:Rafael
Comment Utility
Here is a test. Add a static route on one of your client's route tables and make sure you have the gateway set.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Working from a static IP, plugged into port 8

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\>route print
===========================================================================
Interface List
 12...f0 4d a2......Broadcom
 11...00 ff 72 ......TAP-Win32 Adapter V9
  1...........................Software Loopback Interface 1
 35...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
 14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask   Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.13.3.1       10.13.3.20    266
        10.13.3.0    255.255.255.0         On-link        10.13.3.20    266
       10.13.3.20  255.255.255.255         On-link        10.13.3.20    266
      10.13.3.255  255.255.255.255         On-link        10.13.3.20    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.13.3.20    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.13.3.20    266
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0        10.13.3.1  Default
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  1    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

C:\
0
 

Author Comment

by:pdesjardins1
Comment Utility
did
route add 10.13.1.0 mask 255.255.255.0 10.13.3.1

route added successfully.
Made no change to my problem.
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
OK can you confirm what the gateway of a client on VLAN 1301 is?
0
 

Author Comment

by:pdesjardins1
Comment Utility
VLAN 1301 gateway is 10.13.1.1
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
Can hosts on the new VLAN ping each other?
0
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
Run the following commands on the 3560 and post only the 1st one
- show interface status

You don't have to post the results of the following, just identify whether pass or fail

- ping 10.13.0.254 source 10.13.0.254
- ping 10.13.1.1 source 10.13.0.254
- ping 10.13.2.1 source 10.13.0.254
- ping 10.13.3.1source 10.13.0.254

- ping 10.13.2.1 source 10.13.1.1
- ping 10.13.3.1 source 10.13.1.1

- ping 10.13.3.1 source 10.13.2.1
0
 

Author Comment

by:pdesjardins1
Comment Utility
#show interface status

Port      Name               Status       Vlan       Duplex  Speed Type
Gi0/1     *** Vestibule (VLA connected    1300       a-full  a-100 10/100/1000BaseTX
Gi0/2     *** Vestibule (VLA connected    1300       a-full  a-100 10/100/1000BaseTX
Gi0/3     *** Vestibule (VLA connected    1300       a-full  a-100 10/100/1000BaseTX
Gi0/4     *** Vestibule (VLA connected    1300         full    100 10/100/1000BaseTX
Gi0/5     *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/6     *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/7     *** Data (VLAN 130 connected    trunk      a-full  a-100 10/100/1000BaseTX
Gi0/8     *** Data (VLAN 130 notconnect   1            auto   auto 10/100/1000BaseTX
Gi0/9     *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/10    *** Data (VLAN 130 notconnect   1            auto   auto 10/100/1000BaseTX
Gi0/11    *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/12    *** Data (VLAN 130 connected    trunk      a-full  a-100 10/100/1000BaseTX
Gi0/13    *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/14    *** Data (VLAN 130 notconnect   1            auto   auto 10/100/1000BaseTX
Gi0/15    *** Data (VLAN 130 connected    trunk      a-full  a-100 10/100/1000BaseTX
Gi0/16    *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/17    *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/18    *** Data (VLAN 130 connected    trunk      a-full a-1000 10/100/1000BaseTX
Gi0/19    *** To Voice (VLAN notconnect   1302         auto   auto 10/100/1000BaseTX
Gi0/20    *** Vestibule (VLA connected    1300       a-full a-1000 10/100/1000BaseTX
Gi0/21    *** To Data (VLAN  connected    1301       a-full a-1000 10/100/1000BaseTX
Gi0/22    *** To Data (VLAN  connected    1301       a-full a-1000 10/100/1000BaseTX
Gi0/23    *** To Data (VLAN  connected    1301       a-full a-1000 10/100/1000BaseTX
Gi0/24    *** To Data (VLAN  notconnect   1300         auto   auto 10/100/1000BaseTX
Gi0/25    *** Trunk (VLANs 1 connected    trunk      a-full a-1000 1000BaseCX SFP Cable
Gi0/26    *** Trunk (VLANs 1 connected    trunk      a-full a-1000 1000BaseCX SFP Cable
Gi0/27    *** Trunk (VLANs 1 connected    trunk      a-full a-1000 1000BaseCX SFP Cable
Gi0/28    *** Trunk (VLANs 1 notconnect   1            auto   auto Not Present
swCoquitlam-01#
0
 

Author Comment

by:pdesjardins1
Comment Utility
- ping 10.13.0.254 source 10.13.0.254 - PASS
- ping 10.13.1.1 source 10.13.0.254 - PASS
- ping 10.13.2.1 source 10.13.0.254 - PASS
- ping 10.13.3.1source 10.13.0.254 - PASS
- ping 10.13.2.1 source 10.13.1.1 - PASS
- ping 10.13.3.1 source 10.13.1.1 - PASS
- ping 10.13.3.1 source 10.13.2.1  - PASS
0
 

Author Comment

by:pdesjardins1
Comment Utility
Can hosts on the new VLAN ping each other?
- Good question, I don't know. I don't think I tried that.

I'll have to put two host on and make the attempt.
I'm out of the office today, will attempt tomorrow.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Hosts on the new 1303 VLAN can ping each other.
(10.13.3.5 can ping and be pinged by 10.13.3.6...and so on.)
0
 

Author Comment

by:pdesjardins1
Comment Utility
Other possibly useful information.....

#show ip route
Gateway of last resort is 10.13.0.1 to network 0.0.0.0

S    192.168.77.0/24 [1/0] via 10.13.0.3
     10.0.0.0/8 is variably subnetted, 10 subnets, 3 masks
C       10.13.3.0/24 is directly connected, Vlan1303
C       10.13.2.0/24 is directly connected, Vlan1302
C       10.13.1.0/24 is directly connected, Vlan1301
C       10.13.0.0/24 is directly connected, Vlan1300
S       10.3.0.0/22 [1/0] via 10.13.0.3
S       10.0.0.0/8 [1/0] via 10.13.0.2
S       10.29.0.0/22 [1/0] via 10.13.0.3
S       10.60.0.0/22 [1/0] via 10.13.0.2
S       10.66.0.0/22 [1/0] via 10.13.0.1
S       10.89.0.0/22 [1/0] via 10.13.0.3
S*   0.0.0.0/0 [1/0] via 10.13.0.1
S    192.168.0.0/16 [1/0] via 10.13.0.4


#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/8, Gi0/10, Gi0/28
1000 Vestibule                        active
1001 Data                             active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup
1300 VLAN1300                         active    Gi0/1, Gi0/2, Gi0/3, Gi0/4, Gi0/20, Gi0/24
1301 VLAN1301                         active    Gi0/21, Gi0/22, Gi0/23
1302 VLAN1302                         active    Gi0/19
1303 VLAN1303                         active

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
1000 enet  101000     1500  -      -      -        -    -        0      0
1001 enet  101001     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0
1300 enet  101300     1500  -      -      -        -    -        0      0
1301 enet  101301     1500  -      -      -        -    -        0      0
1302 enet  101302     1500  -      -      -        -    -        0      0
1303 enet  101303     1500  -      -      -        -    -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------
0
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
Your routes are good. The networks are talking to each other based on the results of the source pings.

There's no switchport assigned to vlan 1303. That's the problem

Do that 1st
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
@Akinsd - VLAN1303 may be assigned to a trunk.  Something must be in that VLAN or the route wouldn't appear in the routing table.

Just a thought?
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 

Author Comment

by:pdesjardins1
Comment Utility
Ok. I think I see what you are seeing...

1300 VLAN1300                         active    Gi0/1, Gi0/2, Gi0/3, Gi0/4, Gi0/20, Gi0/24
1301 VLAN1301                         active    Gi0/21, Gi0/22, Gi0/23
1302 VLAN1302                         active    Gi0/19
1303 VLAN1303                         active

So I'd want to copy the port settings of 1301?

Can you point me in the right direction with some commands?
0
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
conf t
int gi0/8
switchport mode access
switchport access vlan 1303
no shut
wr me

This is assuming you want to plug the device that belongs to vlan 1303 to port gi0/8

Apply the command to the appropriate port.


Just FYI
you have a lot of ports configured as trunk. You should hardcode unused ports as access ports and assign them to an inactive vlan. You should also shut those ports down and only enable them as needed.  Configuring switchport security and/or authentication are other additional or advanced security measures. This prevents someone just connecting a switch to your network and cause really bad damage or issues.
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
you have a lot of ports configured as trunk. You should hardcode unused ports as access ports and assign them to an inactive vlan. You should also shut those ports down and only enable them as needed.  Configuring switchport security and/or authentication are other additional or advanced security measures. This prevents someone just connecting a switch to your network and cause really bad damage or issues.
Good advice!


I've had another read through everything and noticed this...
Working from a static IP, plugged into port 8
That won't work with the port's current config...

interface GigabitEthernet0/8
 description *** Data (VLAN 1301, 1303) and Voice (VLAN 1302) port
 switchport trunk encapsulation dot1q
switchport trunk native vlan 1301
 switchport trunk allowed vlan 1301-1303
 switchport mode trunk
 priority-queue out
 service-policy input plmDataPolicies

...the port is untagging traffic in VLAN 1301, not 1303.

Do as Akinsd suggests and put a port into access mode in VLAN 1303 and try again.
0
 

Author Comment

by:pdesjardins1
Comment Utility
thank you for the input.

Akinsd
I'd like VLAN 1303 viable on ports 5-18, 25-28.   Same as VLAN 1301.
So I believe I should do the command you listed for all the ports in the sentence above, correct?

Craigbeck...Do I need to remove that line "switch port trunk native vlan 1301"
again, for 5-18, 25-28?
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
If you're only connecting one device to a switchport, unless that device does 802.1Q you should configure the port as an access port (so remove all trunk config).

So all ports where PCs/Servers/Printers/Phones/etc will connect should look like...

interface GigabitEthernet0/8
 description *** Data VLAN 1303
 switchport access vlan 1303
 switchport mode access
 switchport voice vlan 1302
 priority-queue out
 service-policy input plmDataPolicies
 spanning-tree portfast

Open in new window


I think you're confusing the issue a little by configuring the ports as trunks (I'm guessing for phones?).  You don't need to do this if the phones do CDP or LLDP (see the switchport voice vlan command), although you will if the phones are configured to get their VLAN info via DHCP.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Phones rely on DCHP to get their VLAN info.
0
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
conf t
int range gi05 - 18
switchport mode access
switchport access vlan 1303
no shut
exit

int range gi0/25 - 28
switchport mode access
switchport access vlan 1303
no shut
wr me
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
Ok, you do need trunk ports then.

interface GigabitEthernet0/8
 description *** Data (VLAN 1303) and Voice (VLAN 1302) port
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 1303
 switchport trunk allowed vlan 1302-1303
 switchport mode trunk
 priority-queue out
 service-policy input plmDataPolicies

Open in new window


(Notice the native VLAN is 1303)
0
 

Author Comment

by:pdesjardins1
Comment Utility
Will changing the native vlan from  1301   to   1303   mess with the 10.13.1.1 network, and all the towers that pull ip address on the 10.13.1.1 network?
0
 
LVL 18

Expert Comment

by:Akinsd
Comment Utility
Native Vlan just means any traffic that is not tagged is treated to be in that vlan. Computers don't tag their traffic but the switchport is.

So to answer your question, it depends on what you currently have on the network. The computers will not be affected really as their switchports are tagged, the issue will be on devices attached to trunk ports. You can also change the native vlan on the trunk ports, but be aware to make necessary changes on devices connected to them.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Items on my network are pretty standard.
Windows tower/laptops
Printers (static ip)
Avaya IP phones
smart phones/tablets

I will implement craigbeck's recommendations (3 post up) tonight and report back in the morning.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Craigbeck -
why does line 5 read:
switchport trunk allowed vlan 1302-1303
and not
switchport trunk allowed vlan 1301-1303


and
is a different configuration needed for ports 25-28?
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
You dont need VLAN 1301 on the port.  1302 is voice and 1303 is the new data subnet.  Yiu can only allow either 1301 or 1303 on the port if its an access port.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Hello,
Taking longer than expected.
The config below works....but only for address 10.13.2.x and 10.13.3.x
So if you have a static IP (10.13.1.x) and are in one of the configured jacks, you cannot communicate.
It would be ideal if the config worked for all 3 subnets.

interface GigabitEthernet0/X
 description *** Data (VLAN 1303) and Voice (VLAN 1302) port
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 1303
 switchport trunk allowed vlan 1302-1303
 switchport mode trunk
 priority-queue out
 service-policy input plmDataPolicies
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
Let's recap.

You're not adding a subnet to an existing VLAN; you're adding a new VLAN and subnet.  Therefore you can't expect a client on VLAN 1301 to be able to connect to a port which is configured in VLAN 1303.  That's just not possible.

Here we're setting some ports in VLAN 1301 and some ports in VLAN 1303.  Unfortunately we can't have the ports in both VLANs unless the clients can do 802.1Q.  What's confusing the situation (I think) is the fact that the phones work at the same time as a client.  This is due to the phone supporting CDP and 802.1Q.
0
 

Author Comment

by:pdesjardins1
Comment Utility
Ok. I see the error of my thought process.
What I was trying to create, does not deliver what I want.
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 500 total points
Comment Utility
You could add a secondary IP address to VLAN 1301 (10.13.3.1 / 255.255.255.0) and create a superscope on the DHCP server.  This would allow you to use two different IP subnets on the same VLAN and achieve what you need to do.
0
 

Author Comment

by:pdesjardins1
Comment Utility
^^
Ok, that sounds more like what I want to do.
Please provide more details on "Adding a secondary IP address to existing VLAN."
0
 

Author Comment

by:pdesjardins1
Comment Utility
Hello,

The Adding a Secondary IP address worked!

ip address x.x.x.x  y.y.y.y secondary
0
 
LVL 45

Expert Comment

by:Craig Beck
Comment Utility
Glad it worked - sorry for not replying to your earlier question I didn't see a notification that you'd responded!?
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

As dyndns has reduced the capabilities of the free service, I looked around for other free providers of Dynamic DNS service. After testing several I decided to move my DNS hosting to Hurricane Electric as then domains that require dynamic hostnam…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now