Need help with router on a stick vlan configuration

I have a cisco  and a cisco router where I am trying to run router on a stick. I built the following configs below. Ping works great but when I IP hosts they cannot connect and I cannot connect to them. They are all connected to the same switch which is connected to the same router. Can anyone give me any clues on what I am doing wrong here.

[code][/


                                    CISCO SWITCH

Current configuration : 2322 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname SW1-CORE
!
enable secret 5 $1$gJl9$2ohrNMmWR0t32wcyH1VCe/
!
username tut
no aaa new-model
switch 1 provision ws-c3750e-24td
system mtu routing 1500
ip subnet-zero
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface FastEthernet0
 no ip address
!
interface GigabitEthernet1/0/1
 description Trunk-to-Router
 switchport trunk encapsulation dot1q
 switchport mode trunk
 spanning-tree portfast trunk
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
 description Trunk-To-Router
 switchport trunk encapsulation dot1q
 switchport mode trunk
 spanning-tree portfast trunk
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/0/25
!
interface GigabitEthernet1/0/26
!
interface GigabitEthernet1/0/27
!
interface GigabitEthernet1/0/28
!
interface TenGigabitEthernet1/0/1
!
interface TenGigabitEthernet1/0/2
!
interface Vlan1
 description Main_one
 ip address 10.46.72.5 255.255.255.192
!
interface Vlan63
 description firstad
 ip address 192.168.46.2 255.255.255.192
!
interface Vlan127
 description vlan 127
 ip address 192.168.46.66 255.255.255.192
!
interface Vlan191
 description secondAD
 ip address 192.168.46.130 255.255.255.192
!
interface Vlan254
 description thirdad
 ip address 192.168.46.194 255.255.255.192
!
ip default-gateway 10.46.72.1
ip classless
ip http server
ip http secure-server
!
!
control-plane
!
!
line con 0
line vty 0 4
 password secret
 login
line vty 5 15
 password secret
 login
!
end



                        CISCO ROUTER


Current configuration : 1536 bytes
!
! Last configuration change at 20:27:35 UTC Sun Apr 1 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$I82l$7qVCpEL4zYjazjo6eLebR.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
!
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2851 sn FTX1108A38P
!
redundancy
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
 ip address 10.46.72.1 255.255.255.128
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.63
 encapsulation dot1Q 63
 ip address 192.168.46.1 255.255.255.192
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.127
 encapsulation dot1Q 127
 ip address 192.168.46.65 255.255.255.192
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.191
 encapsulation dot1Q 191
 ip address 192.168.46.129 255.255.255.192
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/1.254
 encapsulation dot1Q 254
 ip address 192.168.46.194 255.255.255.192
 ip nat inside
 ip virtual-reassembly in
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
!
!
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line vty 0 4
 password secret
 login
 transport input all
line vty 5 15
 password secret
 login
 transport input all
!
scheduler allocate 20000 1000
endcode]
techdriveAsked:
Who is Participating?
 
JustInCaseCommented:
You are right, generally that's all you need (I just analyzed present configuration and looked for inconsistencies like nat half configured, no default route (and nat is present on router) etc).

In the case of router on the stick you don't need SVis on the switch (other than management - if OOB is not in use). You just need VLANs on switch, trunk in direction of router. On router there should be configured subinterfaces with dot1q encapsulation and IP addresses.
There is no need for NAT configuration or default route if it is not production Portfast trunk is not recommended if trunk is not connected to end host (e.g server). Minimum configuration for "Router on a stick" with management SVI - (recommendation from Cisco is not to use VLAN1 for anything - even for management (but I left it as it is)).
Switch
vlan 63
vlan 127
vlan 191
vlan 254
!
interface GigabitEthernet1/0/1
 description Trunk-to-Router
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
! only one uplink to router is needed
default interface Gi1/0/3
!
interface Vlan1
 description MANAGEMENT
 ip address 10.46.72.5 255.255.255.192
 no shut
!
ip default-gateway 10.46.72.1

Open in new window

Router
interface GigabitEthernet0/1
 ip address 10.46.72.1 255.255.255.128
 no shutdown
!
interface GigabitEthernet0/1.63
 encapsulation dot1Q 63
 ip address 192.168.46.1 255.255.255.192
!
interface GigabitEthernet0/1.127
 encapsulation dot1Q 127
 ip address 192.168.46.65 255.255.255.192
!
interface GigabitEthernet0/1.191
 encapsulation dot1Q 191
 ip address 192.168.46.129 255.255.255.192
!
interface GigabitEthernet0/1.254
 encapsulation dot1Q 254
 ip address 192.168.46.194 255.255.255.192

Open in new window

On switch you can check if all VLANs are present on trunk to router and is management interface up up by issuing:
sh interface trunk
sh ip int brief
You can check router subinterface status on router
sh ip int brief

Regarding hosts, beside above configuration (switch vlan assignment), you need to assign access ports to proper VLANs, to manually assign IP addresses from proper range since DHCP server is not configured, and it should work (default gateway IP address configured on hosts should be IP address of LAN subinterface for specific VLAN).

Binding VLAN and IP address to router subinterface:
interface GigabitEthernet0/1.63 <-- creating subinterface which will be assigned to specific VLAN - dot1q and subinterface numbers do not need to match (Gi0/1.60 and enc dot1q 63 would still be OK)
 encapsulation dot1Q 63             <-- accept frames with tag 63 in it (assigning subinterface to VLAN 63)
 ip address 192.168.46.1 255.255.255.192 <-- IP address of subinterface (belongs to VLAN 63 since sunbinterface accepts only frames with tag 63)
0
 
JustInCaseCommented:
Switch:
Vlan1
 description Main_one
 Vlan 63
description **whatever1**
 Vlan 127
description **whatever2**
 Vlan 191
description **whatever3**
 Vlan254
description **whatever4**

Open in new window

Router:
interface GigabitEthernet0/1
no shut
!
interface GigabitEthernet0/0
 ip nat outside
!
ip route 0.0.0.0 0.0.0.0 <next-hop>
!
ip nat source inside list NAT interface fa0/0 overload
!
ip access-list extended NAT
 permit ip 192.168.46.0 0.0.0.255 any

Open in new window


Switch needs VLAN created since VLANs will not be created by creating interface vlans (or VTP assigns VLANs to device in VTP client or VTP sever mode).

I guess router needs the rest of NAT configuration since SVIs are configured with ip nat inside. External interface in that case is missing ip nat outside. Also default route is not present. NAT access list s summary for all networks.

You may need to assign access ports to specific VLANs (if present on switch). Also if DHCP server is not provided - you will need to assign IP addresses manually. If DHCP server is provided - each SVI is missing command ip helper-address x.x.x.x for hosts to be able to reach DHCP server (except VLAN where/if DHCP server is present).

It's is a little bit strange that VLAN1 is taking different path to router....
Router
interface GigabitEthernet0/0
 ip address 10.46.72.1 255.255.255.128

Open in new window

Switch
interface Vlan1
 description Main_one
 ip address 10.46.72.5 255.255.255.192

Open in new window

The rest of SVIs are connected as subinterfaces of interface Gi0/1.

And switch is missing
ip routing

Open in new window

command.
1
 
techdriveAuthor Commented:
good catch Predrag Jovic
0
Network Scalability - Handle Complex Environments

Monitor your entire network from a single platform. Free 30 Day Trial Now!

 
techdriveAuthor Commented:
Can you explain Predrag Jovic  this line "ip nat source inside list NAT interface fa0/0 overload"
0
 
JustInCaseCommented:
Actually, IP routing on switch is not needed for router on stick.
0
 
JustInCaseCommented:
That line is performing natting from inside interfaces to outside interface (but is nat needed and which interface is outside interface?)... And it supposed to be gi0/0 not fa0/0 (again if nat is needed at all on router).
0
 
techdriveAuthor Commented:
Honestly I copied this config from a site and I might be doing myself an injustice. I am just trying to setup a lab with 5 subnets and just able to talk to the 10.46.72.0 network.
0
 
techdriveAuthor Commented:
I guess what I am trying to understand is what binds the IP address with that of the VLAN.  I guess in my simple world the vlan ID in the encapsulation command with the 802.1Q should bind with the switch vlan. Do you even need IP addresses on the virtual ports on the cisco switch. Shouldn't I just need to create the vlan on the switch, create a 802.1q trunk on the switch and define the ip addresses and encapsulation command to get this to working...or am I missing something,.
0
 
techdriveAuthor Commented:
thanks
0
 
JustInCaseCommented:
You're welcome.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.