Cisco Switches :: SG300-10 / Setup Multiple Routed VLANs Going Back To FiOS Actiontec Router
Aug 13, 2011
I just received a new Cisco SG300-10 and am configuring it in Layer 3 mode. I am trying to setup multiple routed VLANs going back to a FiOS Actiontec router. My configuration is as follows.
Fios Router: 192.168.1.1
Assigning DHCP 192.168.1.2 through 100.
SG300-10 has VLan 1 ip 192.168.1.5 used for Mgmt.
VLAN2 is 10.0.2.1
VLAN3 is 10.0.3.1.
I have a static route set on the fios router for both subnets setup as follows.
I have a laptop connected to Gi8 on the Cisco (Vlan 3) and statically assigned 10.0.3.3, with a gateway of 10.0.3.1. DNS set to the fios router (192.168.1.1).
Everything pretty much works EXCEPT, I cannot get out to the internet from either vlan. Traffic routes between vlans/and the default subnet on the fios without issue.
When I ping out, DNS resolves, but will not go past the fios router. Am I missing a setting somewhere?
I'm going to have several SG300-28P switches to setup. I'll need to create multiple vlans for data, voice, and wireless traffic. I have the following questions in setting up this configuration:
1) For managing the switches via IP, will LAN1 be the default management network? Should I create a seperate VLAN for managing the switches?
2) For uplinking the switches together, I plan to trunk a port to connect the switches together. What's the configuration on the trunk port to forward all vlans from one switch to another?
3) On some ports, I want to configure a trunk for two vlans (Data and Voice) where the phone has a pass through for PC. The phone supports tagging for the PC and the VoIP traffic. For example on port 10, would VLAN 100 and 300 be set to tagged?
I have 2 SG300-10 switches, and I need two VLANs, one for internal network and one for WiFi APs.I need ports 1->4 on both switches to be part of 1st VLAN and ports 5->8 on 2nd VLAN; and port 10 uplink to 2nd switch.How I set up the VLANs and interface VLAN mode?
We have a Cisco 887 router and a Cisco SG-200 switch.We'd like to setup trunking between these 2 devices for multiple VLANs on the switch to be made available on the router.
With previous routers, you could set the router up in the configuration 'router-on-a-stick' and VLANs worked like a charm but the 887 no longer support sub-interfaces.So how can you get trunking working between the 2 devices?
Is there a VTP configuration menu for the SG-200 which we can setup in order for it to talk 'VTP' with the 887 router??
I have an ASA 5505 with the security plus software and I'm trying to find out how to assign 2 public IPs to the outside interface and have each IP routed to a separate internal VLAN. For example, IP 1 = X.X.X.1 routed to 192.168.1.0 and IP 2 X.X.X.2 routed to 192.168.2.0. I was told this was possible and I've been trying to find configuration examples, but I can't seem to get anywhere and now I'm getting desperate because I'm scheduled to install it this weekend.
I bought the Linksys E1200 for it's wireless N and the guest account. set up my new Linksys E1200 router to use for wireless N access rather that my Verizon Fios provided Actiontec (model M4124-WR Rev.C) which is only wireless G, and so that I can use the guest account. I have an ethernet cable running from one of the 4 ethernet ports on the E1200 to one of the 4 LAN ports on the Actiontec. I have the wireless turned off on the Actiontec, and have the E1200 set as 192.168.1.200.My wireless N signal seems to be working fine from the E1200, and I was able to turn on the guest account on the E1200 and "connect" to it on my iPhone 4, but then when I open Safari I can not connect to the internet.
Just had Verizon FIOS service installed. It comes with an actiontec modem. I would like to remove the actiontec modem and connect directly to my Linksys RT31P2 which is cascaded to my Linksys WRT54G. I have tried just about every router setup config; all with no success. How to be able to connect the FIOS directly to a linksys router.
I got Fios installed this week. Router is the Actiontec MI424, it sits int he living room. I ran a speed test of the wifi on my laptop in the living room, and the internet speeds were great. Here's my problem. I'm in a 2 br condo, not a huge place maybe like 1200 Sq feet, same floor. Wifi is awesome in the living room, but in the bedroom it hangs. I still have a signal, varying for low to good, but it takes forever to open a web page, to the point where you can't use the internet. Bedroom is just down the hall.I called Verizon. They told me they can only guarantee the wifi signal 10 feet from the router, after that no promises. My frustration is that with my previous provider, which was giving me a slower internet connection, my wifi in the bedroom was fine and the router was in the exact same spot. Of course I used my own router? I know there are instructions on connecting my old router to the fios one and using my old router for wifi.
i am trying to get a SG300 work as a router between VLAN's?So fare without any lock?Test setup one SG300 switch and 2 PC's ?Ping works from host to VLAN IP's, but not from host A to host B
SG300 with FW 1.1.2.0 configuration i L3 mode set system mode router confip routing (needed on SG300??? - ti is on a 3560 i PacketTracer) vlan databasevlan 5vlan 6vlan 7
I'm using a stock FIOS router Actiontec MI424WR, and I'm trying to access the router settings at 192.168.1.1. I type in my username fine, but when I type the password, each keystroke gives me more than one digit. Even holding Ctrl adds one, and letting go removes three characters. I've never seen this happen before, and I've tried it on two computers and three different browsers. I see that people recommend hard-resetting the router, but I was wondering why this has happened
I connected EA6500 internet port to actiontec router provided by Verizon fios. I don't have any other way to connect as FIOS connection is coax to actiontec modem. I must take a drop from actiontec to internet port on EA6500.
With that said, I can't get EA6500 to work, it keeps saying no internet. The only way I can get it to work is when I set it to bridge mode. This makes my EA6500 a dumb switch/access point. I didn't spend $200 for a switch. I need to use advanced features offered by this router but I can't until this problem is fixed. I made sure I am running latest version of firmware (1.1.28.146856).
I have reset my fios router as well as ea6500 to factory defaults multiple times.
I was assigned a task to configure an SG300-28P to have 3 different vlans.Now on VLAN1 their will be only one device configured with static IP 192.168.0.230,On the other 2 VLANS there will be a separate router connected on each one of them and will also act as a DHCP server.
I have a Cisco SG300 switch on which trunks are configured. I have a server which sits on the switch via a trunk link of four network cables (4 Gbps total)on which LACP is enabled. I'm having trouble connecting to the server using VNC from a computer on the network. It doesn't happen all the time though, it's just random.
On looking at the logs of the switch, I saw something unusual. The trunk that connects the switch to the server is constantly removing all the member ports and adding them back again after a few minutes interval. That causes the trunk link to flip on and off all the time. What could be the reason that's causing it to happen? I know it could be the network cable but I'm using brand new cables and the server also is brand new.
I have spent several days tearing my hair out trying to properly configure our small business switch (SG300-10p) for voice. The phones are a relatively new addition and will replace old POTS phones.Our network consists of a 1941 ISR router, the SG300-10P switch, a mac server (handing DHCP, DNS, AFP), 4 client desktops and 4 SGA525G2 IP phones. The router, server, desktops and phones all have their own connection to the switch and the second data ports on the back of the IP phones are not used. We do not have any unified comms devices for voice. Our VOIP solution is hosted by a local SIP provider, and each phone independently registers with the provider's SIP proxy over the internet.
Left almost to it’s own devices (or presumably flat, default settings on VLAN 1), this whole setup works just great. We can TFTP files, make and receive calls, and do all the usual XML stuff. Calls are crystal clear. Even the localisation and directory works. However, I’ve been told several times that to ensure good quality on VOIP calls during periods of busy traffic, I should set up some form of QoS. A Voice VLAN on the switch, I was told, is the best way to do this as it automagically gives priority to the whole voice VLAN over the normal data VLAN.
I have followed instructions in numerous manuals, articles and guides, and have managed to create the Voice VLAN, both manually and automatically (I can watch Smartport detect the phones and see the Auto Voice VLAN add the ports to the VLAN as I connect them). The trouble is, as soon as this happens, the phones lose connectivity with the rest of the network, including the DNS server and the router, and therefore the internet, causing them to lose registration with the SIP service.
I tried adding the server and router ports to the Voice VLAN and tweaking every possible combination of tagged, untagged, excluded, trunk, access, general and PVID settings I can think of (by the way, I have no idea what any of those mean). The switch is in Layer 2 mode, but adding the port connected to the router to all the VLANs does not result in internet connectivity to the phones. I have told the phones to tag frames with the VLAN ID and told them not to. I have tried upgrading firmware and I have rebooted the switch so many times I'm tired of those wretched little flashing lights.
Nothing seems to work. And so I am stuck with everything on VLAN 1. My most recent thought is that the 1941 needs to know about the Voice VLAN (I checked CDP and it knows about the switch), but I’m reluctant to start messing with the router config when this is our production network, at least without knowing what I'm doing. I don’t even know if QoS applies when a Voice VLAN is not set up and we're on VLAN 1, some articles say yes, others say no. And when it is set up right, how does that priority transfer to the router? I’ve looked in the router manual and config options and found something called 802.1Q, but I have no idea what it is, how it works or even if it applies to our situation. Can I forgo VLANs altogether and use QoS some other way, perhaps?I have googled enough to cobble together our setup in IOS up until now. Ideally, I would still like to be able to ssh or https into each device (as I do now) for management, and I’ve read about setting up a another VLAN for config, monitoring etc, but I guess that would mean routing between VLANs in Layer 3.
I have just purchased a SG300-28P switch I am using a GUI to do my config. I cant create VLANs just fine on this but I can not assign IP address to the VLANs.
I just want to have a Data and Voice VLAN on this I am planning on leaving data on VLAn 1 but I can't seem to find an option to assign an IP address to my voice vlan.
For some odd reason I cant access this switch using a console port.
I have a SG300-28P that is our Main VLAN Switch. Though the VLANs that I have on it are there mostly because of our Edge Router and our AP541Ns.We have the Following VLANs defined (Subnets Changed to conseal Piblic IPs) [code]
VLAN200 and VLAN201 come into Our Edge Router and out on a Single GE Port via VLAN Tagged to thje SG300.The SG 300 Splits them out to Untagged Ports and they are connected to Two Firewalls, each with a IP in the 200 and 201 Subnets. The AP510 has the VLAN200, VLAN192 and VLA101 tagged Subnets sent to it. The AP521 has three SSID, each associated with a Paticular VLAN.
This all works fine, though there are a few hidden flaws. Since all of the VLANs are present, both Internal and Public IPs, one could craft packets form one network and use the SG300 as its gateway to the other subnet and Gain Access. How can I isolate the Subnets, so that I can still use the SG300 as a Default Gateway for the 10.1.0.0/16 Network Make it so if someone from the 10.1.0.0/16 netwok accesses the 201.201.201.0/24 Subnet it uses the SG300's 0.0.0.0 0.0.0.0 default router (the Firewall IP) and not the VLAN InterfaceIf somone in the 201, 200, 192 Subnets uses the SG300 as a Gateway and tries to access a 10.1.0.0/16 address it gets blocked.
I'm having alot of trouble trying to connect more that one LAG between two SG300-52 switches.Basically i have configured both switches with the same vlans. For 2 of the vlans i would like to connect them together between the two switches using LAG. Switch1 has Vlan 5 (ports 1-12) & Vlan 10 (Ports 25-36) with LAG configured on ports 1-2 and ports 25-26. I have setup the second switch identical to the first. But when i connect the LAG's there is no connectivty. If i disconnect one LAG the other starts working.Can you only have i interconnect LAG between switches?
How to setup 3 SG300-52 (in L2 mode) as per this diagram:Port 1 on all switches should be able to talk to each other and access the blob at the right.The ports 25 on the other hand should only be able to talk among themselves in their own private vlan. They are to carry sensitive traffic. So I created 3 vlans, vlan 78 for ports gi1, gi51 and vlan 10 for port25,49,50 and a dummy vlan: 666 with the intent of segratating vlan 10 from vlan 78. My attempts so far have failed. ports gi49-50 are configured as trunk ports and gi1,gi51 as access ports as the following cli output (excerpts of the startup config):
Ports gi1 can talk to each other and access the blob but ports 25 refuse to talk to each other. But as soon as I remove the access links to the blob they can! Obviously, at that point port gi1 lose access.Is such a topology feasable or even advisable?
I've seen lots of posts from people having problems routing traffic between two vlans with some complicated examples. Any simple step-by-step example for an SG300 switch (in layer 3 mode) to configure two vlans and sending traffic between the two vlans without an external router?
-VLAN1 10.10.10.0 -VLAN2 10.10.20.0
I've tried to do this through the GUI and can't seem to make it work. I'm missing something in the GUI.
I supplied 3 numbers of SG300 series switches for the sole reason to have inter-vlan routing. I created 4 VLANs in the switches and made one switch as Layer 3 switch and other 2 as Layer 2 switch. Inter-Vlan routing is working fine. I am able to ping PCs from different VLANs. But I am not to access shared folders. Customer has installed Window 2003 server installed and it is in VLAN 1. There are some folders created in this server and it is very important for users to have access to the folders.Also, I am not able to access shared folders in other VLANs. I have created a case with Cisco small business and I got a reply saying that the switches will not support shared folder feature, which I think is not real. I am getting a very time to implement this solution in the network. I have a Sonicwall firewall after Core switch which is connected to ISP.
I want to setup an home network with a wireless router and use multiple switches for wired connections through out my home. I currently have an Airport extreme hooked up to a cable modem and a leviton gateway hooked up to the Airport. The 2 computers connected to the Leviton are on a windows 7 homegroup and share fine, but won't share or discover any wireless device connected to Airport. My main goal is to have a wireless/wired network with all computers sharing information with each other. I want 2-3 wired switches/gateways with a min of 2 devices connected to each, connected to my wireless router whiich is connected to cable modem.
I was looking for configuring QOS for two VLANS i have created. these will be for voice traffic vlan 22 and video traffic vlan23. i also have three other vlans for pc's, wireless devices and our cnc machines. we have 5 switches that are all SG30028P's with a single switch doing the intervlan routing (operating at layer 3). all of the switches are trunked back to the main switch and ive been through the guide written on how to do this on a single switch which i dont think is layer 3.
I have a SG300 Switche working in layer 3 mode.I configured 3 VLANs on the switch, assigned all ports, given IP addresses to VLANs interfaces, etc.Now I want to implement ACL to permit or deny access between vlans and hosts.Can I apply an ACL to a whole VLAN (in or out) like Catalyst models?I mean apply the ACL to the entire vlan or the only way in this model is to implement that ACL port by port?Every time I have a new port configure to work in a Vlan I have to implement the ACL?
I'm trying to setup a VPN connection for the two PC's in the graphic below. I have the link between the two locations setup and secured, now I just working with the routing elements.what I need to add to the firewall config in order to get this to work? Here is what I have:
SITE A------access-list mpls_vpn_sitea extended permit ip host 172.168.199.1 host 172.168.199.2 access-list mpls_vpn_sitea extended permit ip TEST-LOCAL 255.255.255.0 TEST-REMOTE 255.255.255.0crypto map mpls_vpn 1 match address mpls_vpn_siteacrypto map mpls_vpn 1 set peer 172.168.199.2 crypto map mpls_vpn 1 set transform-set ESP-3DES-SHAcrypto map mpls_vpn interface MPLScrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac SITE B------access-list mpls_vpn_siteb extended permit ip host 172.168.199.2 host 172.168.199.1 access-list mpls_vpn_siteb extended permit ip TEST-LOCAL 255.255.255.0 TEST-REMOTE 255.255.255.0crypto map mpls_vpn 1 match address mpls_vpn_sitebcrypto map mpls_vpn 1 set peer 172.168.199.1 crypto map mpls_vpn 1 set transform-set ESP-3DES-SHAcrypto map mpls_vpn interface MPLScrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
do I need to specify a route between the two networks? What do I need to have for NAT statements?
I am having problems accomplishing these tasks with my new SG 200-18.
I have a LinkSys WRT54G2 connected to port 1. I would like ports 2-8 to be in one VLAN with access to the Internet and to be able to share their printers, hard drives, etc. with other computers on ports 2-8. I would like each of ports 9-16 to be on a separate VLAN with access only to the Internet and no other ports on the switch. I would like to be able to manage the switch from any of the ports 2-8.
After I create the VLAN 1009 (see screenshot below), port 9 can browse the Internet and cannot see the other ports on the switch which is correct. However, ports 2-8 can no longer access the switch at 192.168.1.20 in order to manage the switch.
I have to configure multiple vlans served with a unique DCHP server . As first step, I just will The DHCP server to serve 2 vlans. The following is the hardware and configuration that I implemented :
[code]...
But If I connect the DHCP server on a trunked switch port and adapt the DHCP server gateway 172.16.0.1 to 172.16.0.254, hosts receive ip address properly.I have to connect the DHCP server directly to the router. How can I do that, what is wrong in the configuration?
I can't figure out how to configure a port membership with multiple VLANs. My setup:
- VLAN10 - VLAN20 - port settings tab: port24 in general mode - ports to VLANs tab: untagged everywhere, when I set port 24 membership to VLAN10 I can't set port 24 membership in VLAN20 because when I do that port 24 membership in VLAN10 dissapears and vice versa - but I can set port 24 membership to both VLANs in VLANs to port tab, but I think it doesn't work because: - when I connect hosts to ports 23 (port 23 is a member of VLAN10 only) and 24 (member of VLAN10 and VLAN20) there are not any connectivity between them - but connectivity is working when I set the same PVID for both ports 23 and 24 in port setting tab, I can't set multiple PVID in here.
So, is it possible to configure port membership for multiple VLANs on this linksys. [URL]
I have 8 apartments that have a single internet connection coming into the building, I then have a PoE Access Point in each of the 8x apartments.
What I would like to be able to do is to have each apartment within its own vlan, but to be able to use the internet via one of the non-PoE ports (port 9 say) but do not want residents in different flats to be able to see each others devices on the same network.
I have a Cisco SG 300-10MP which has 8x PoE ports and 2x Ethernet ports, one of which my Internet connection is plugged into (using WiMax).
I'm trying to setup an ACL on my SG300-20 to enable FTP and a few other protocols to a server, but I'm running data that returns on different ports (ie active FTP).
Below is a sample: ------------------------------------------- Extended IP access list Protocol_Restriction permit tcp any ftp any any -------------------------------------------
Now that works great to allow a connection, but with active ftp when the data tries to come back on a different port (I assume) it is just hung up as all other ports are denied.
I event tried allowing all ports to come back from the server: ------------------------------------------- Extended IP access list Protocol_Restriction permit tcp any ftp any any permit ip any host 192.168.0.100 -------------------------------------------
But that also didn't work seem to work.
I've played around with this in layer2 and layer3 to no avail. I've also seen many tips on applying in and out to the various interfaces, but that doesn't seem to work. Is that something that is only available on higher end switchers/firewalls?
We have been set the task of securing a small managed office system which is currently set up with a standard switch allowing each of the offices (containing different companies) to see each other, and in some cases, access each others documents across the network.
Obviously this is a far from adequate set up and our aim is to isolate each office using VLAN's but share a common internet connection provided by the managed offices. We have two Cisco SGE2000-G5 layer 3 switches but we are new to Cisco equipment and VLAN's so we are not quite sure on how to implement this. DHCP would need to be provided by a Router, there is no Server. We are open to suggestions on the Router as we have yet to purchase one.
I am aware that private-vlans are not supported on edge switches like 2960 series - so my question is would it be possibel to ceate private vlans on say just the core switch which would be a 3570 or 4506 that supports private vlans and then just trunk these to the edge like normal vlans?
what I need to achive is to have edge port not able to communicate to each other even across switches - which cannot be done using 'protected' port so need the private vlan feature
