I am using several SG300-28 Switches with firmware version 1.1.2.0.I have dynamic VLAN enabled. As RADIUS server I am using free radius 2.1.12.Authentication is only based on the MAC address. (I configured that on the switches)On the switches I created three VLANs. VLAN100 for the authenticated clients, VLAN200 for Management interface and VLAN300 as Guest VLAN. After a wrong authentication the clients should be put into this Guest VLAN immediately (I configured this on the switches). I am using Windows XP and Windows 7 clients in my network. I did not configure any EAP settings because I just wnat to use the MAC address.
In most cases the dynamic VLAN assignment and authentication is working fine. The switch log says that the client is authenticated and the same I can see on free radius log. But in some (rare) cases the client is rejected. The CISCO log says "MAC aa:bb:cc:dd:ee:ff was rejected on port ge17" but when I look at the free radius log then this MAC address was successfully authorized.
The problem is that the client gets an IP address based on the Guest VLAN300 but after that the switch seems to "switch" the VLAN on the port and then the client is authenticated correctly on the right VLAN but the client does not request a new IP on the new VLAN. If I unplug and re-plug the LAN cable in most cases the client get the correct VLAN and the correct IP. This is happening randomly on nearly all my PCs.
Do I have to set some timers higher ? I don't think it is a problem between switch and RADIUS but a problem between communication of the host and the switch.
When the users connect their laptop they are getting a authentication prompt but the switch is not changing the VLANs on the port after successful authentication.Below are the logs on the switch
Jan 28 2013 17:21:32.417 CST: RADIUS: Framed-MTU [12] 6 1500 Jan 28 2013 17:21:32.417 CST: RADIUS: Called-Station-Id [30] 19 "E4-D3-F1-0B-C6-0A" Jan 28 2013 17:21:32.417 CST: RADIUS: Calling-Station-Id [31] 19 "84-8F-69-A8-BD-1D" Jan 28 2013 17:21:32.417 CST: RADIUS: EAP-Message [79] 45
I'm trying to use 802.1x to authenticate clients on my network with dynamic VLAN assignment from RADIUS. We have IP-Phones(powered by PoE) that only supports EAP-MD5, and we would rather use MAB(it also uses LLDP-MED for some settings) to authenticate the phones using the MAC-range from the phones vendor. The following scenario works perfect:Connect the phone and let it boot up(takes a while) and authenticate with MAB.Connect a computer in the phones data-port and let it authenticate with 802.1x(or fail and reach guest-vlan) However, the following scenario doesn't work:The computer is already connected to the phoneThe phone is then connected to the switch What happends now is that the computer is authenticated using 802.1x before the phone boots up and get's authenticated with MAB. When the phone is ready, it's authenticated with MAB and everything works. However, after a short period(let's say a minute), using `debug authentication all`, we see a "NEW LL MAC: phones mac" message(which is weird since the mac has already been MAB-authenticated), and then we are unable to contact the phone using ping. When I check `show mac address-table` it has now moved the mac from `Port Gi 0/12` to `Port Drop`. However, if I check `show mab interface Gi 0/12` or `show authentication sessions` it lists the phones-mac as `mab auth sucess `.why the first scenario works, and not the second?
The switch is a 3560E PoE 24p with IOS 12.2.58SE2. Sample of the switch-config: network-policy profile 1voice vlan 90!interface GigabitEthernet0/12switchport mode accessnetwork-policy 1authentication control-direction inauthentication event fail retry 1 action authorize vlan 60authentication event server dead action authorize vlan 60authentication event no-response action authorize vlan 60authentication event server alive action reinitializeauthentication host-mode multi-domainauthentication order mab dot1xauthentication priority mab dot1xauthentication port-control autoauthentication periodicauthentication violation replacemabdot1x pae authenticatordot1x timeout tx-period 5dot1x max-reauth-req 1spanning-tree portfast!Btw, when we tried authenticating the phones using 802.1x too (EAP-MD5), there are NO problems in any of the scenarios. However, we want to use MAB instead of 802.1x to avoid the requirement of configuring the phones with a username and password. The RADIUS response was the same when using 802.1x as it is with MAB for the phones (including device-traffic-class=voice AV-pair).
I am using the CISCO SG300-28 with firmware version 1.0.0.27. I enabled RADIUS authentication and accounting. Authentication is working but there are no accounting requests/replys (Accounting on, accounting off, accoun ting start, accounting stop) when running RADIUS in debug mode. I also did a packetcapture and there are no accounting packets.
So i updated the firmware image up to version 1.1.2.0. When I now want to configure accounting in RADIUS settings then there isn't any option to set an accounting port.
Ich checked the data sheet of the switch and it says that accounting is supported:
=============================================== 802.1X: RADIUS authentication and accounting, MD5 hash; guest VLAN; unauthenticated VLAN, single/multiple host mode and single/multiple sessions [URL] ===============================================
I did a second packet capture with the new firmware image and there are still no accounting packets.
The RADIUS server is configured correct for accounting because when using another NAS like a WLAN-AP with DD-WRT accounting is workings. It is working with pfsense Captive Portal (an open source firewall and routing solution with a hotspot portal).
I have an SG300 authenticating telnet login to a RADIUS server. It allows me to log in at Priv level 1. when I try and enter Priv 15 mode, I'm prompted for a password which I don't appear to be able to set anywhere or know.
If I remove RADIUS and go back to Local authentication, telnet logs me in at Priv15 immediately.
I have an SG300-20 here for testing (firmware: 1.1.2.0, boot version: 1.0.0.4, language version: 1.1.1.6 English). Everything seems to work on it, except, that if I choose Radius authentication by mac address only, then the switch does not honor the Idle-Timeout and Session-Timeout attributes from the Radius server (freeradius).
The setup is the following: I have a no name access point plugged in to switch port gi1. The port gi1 is set up for Radius authentication by mac address only. The access point itself is authenticated, no problem with that. If I connect through the access point by (say) a mobile phone, it is authenticated, no problem. The radius server does send the Idle-Timeout and Session-Timeout attributes, I checked it by running "freeradius -X", both are set to 30 seconds. Then I turn off the wireless card in my mobile phone and check the dot1x users by "show dot1x users". My mobile phone's mac address remains there for 5-10 minutes, so the Idle-Timeout and Session-Timeout does not work.
Another way I could resolv this problem is by explicitely asking the switch to reauthenticate the user. Unfortunately there is no CLI command to do just that, I can do however a reauthentication on a port using "dot1x re-authenticate gi1" (for example). But it does not work as it is expected: the switch uses the stored mac-address to reauthenticate the user, so nothing changes on the port (unless something changes in the radius server). I think it should work like the following: remove the authenticated user from the port, and whenever that mac address makes some network traffic, then reauthenticate as if it were a completely new connection. BTW: it would work for me also if I could just remove an authenticated user from a port, but I did not find a command to do that.
As a last resort I can simply shutdown the port, bring it up again ("shutdown" and "no shutdown" in the interface config), then all users are removed from the port and they all mush reauthenticate. But it causes a network outage for a couple of seconds for all users on that port, on a busy access point it is quite disturbing, and it is not an elegant way to do this.
So my actual question is: is there a way to remove an authenticated user either automatically (Idle-Timeout and Session-Timeout) or manually from this switch?
I enclose the relevant part of the running config.
Any snmpset commands to add, modify and delete vlan table entries on SG300-10 switches? I checked url... however this information is apparently only valid for catalysts. The latest firmware is installed and the provided MIB files are used.
I want to set up a vlan only for the wifi APs and wifi clients on my network. They can't access to any server, only internet acces. I already implement this configuration and its working, but now I want to allowed a couple of laptops to connect to servers in other vlan. what should I do? Should I do it using Mac address of laptops or IP?
I am using a couple cisco sg300 28P switches along with a sonciwall firewall/router. The sonicwall was already in place and working so they didnt want to replace it. I understand how to configure the vlan on the sonicwall, but could use some info on the cisco. I would basically like to create 3 vlans, 1 default for management, 2 for pc's on lan, and 3 for the cisco spa504g phones/'voip. Would i just go into the vlan managment, configure the 2 new vlans and give them two id's? These offices have one network drop, so the phones and pc's will be sharing the switch ports, however the phones have a setting to configure the vlan id so they know which one theyre on. Is there anything i need to do after that? I want to make sure that vlan 3 has the highest priority becuase its voice, is there some qos configurations i need to make on that switch as well? Also, the port that links the two cisco swtiches together, does that need to be set as "trunk" port? I understand what vlans are, but its just the first time ive run into these cisco models. .
Before I launch into this can I say that I am very much a novice with regards to Managed Switches and their configuration. I have the following equipment which I have connected to the switch: [code] All of the above are on subnet 255.255.255.0.All of the above communicate with each other during normal operation.Our client is connecting to the switch but his requirement is for his system to "see" the PLC Comms Card as follows:IP: 10.0.3.61 on Subnet 255.255.252.0 .
Using the Internet Explorer interface connection I have created an additional VLAN (ID 2) on Port 10 with the intention of using this as the connection to the client ( I assume there will be further settings required to route the PLC connection to this port) but every time I try to assign the IP and Subnet values and click "APPLY" the changes are not made and the connection appears to hang leading me to reboot the switch.I have connected to the switch via console and changed the mode to Layer 3. I also assume that it is OK for the three pieces of equipment to remain on the default VLAN. How I should setup this VLAN and ultimately achieve my goal.
I am facing an issue to setup what I initially called simple network but still unable to put it together.On SG300-20 I want to setup 4.3 of the vlan are to separate users in to different groups and to secure data confidentiality.1 is for the NAS. All users on the 3 vlans must access the NAS vlan.All user should have access to internet via SG300 through the ISP provided router. How to configure this, I have every little knowledge of switching and routing? And the routing seems to be the issue I am encountering because I am able to create the VLANs and assign static IP address to them but not able to get them talk to each other. I use each vlan ip as gateway on each port assigned. [code]
I want to use Multicast TV VLAN with my SG300-10 to join Multicast Groups in different Data VLAN's. It's working fine, but the problem is that it isn't possible to add all the Multicast Groups to the Multicast VLAN because each TV channel use other groups. For me it's only to handle if I can use wildcards to add a specific range of multicast traffic to the Multicast TV VLAN. Is that possible with that Switch?
We have recently purchased a SG300 to break up our network which most consists of virtual machines via Bridged networking on network machines. I have created successfully Vlans and the physical machines are capable of communicating across the different subnets that I have created via the SG300 however the Virtual machines can no longer be reached.
I have a connection on IP 192.168.1.21, Subnet 255.255.255.0 - this is on the default VLAN1 on the switch. I need to route this to IP 10.0.3.101, Subnet 255.255.252.0 - which is set up on VLAN2 on the switch. I have set the switch to Layer 3 via console.
how I setup this route? I am use the Browser based interface.
I am wondering what the best way to separate a network, both data, on a cisco SG300. I do not want network 1 to able to communicate with network 2 or vice versa. I have one server for DHCP for network 1, 192.168.1.X. I would like network 2 to have ip of 10.0.0.X, can the cisco SG300 do dhcp for this vlan?
Using a sg300-52 switch I created two VLANs that share a port for access to the internet. All original devices added to the VLANs are functioning correctly so I have to beleive the VLANs are set up correctly. I added a new desktop and an old laptop to the VLAN and neither worked. I was able to get the desktop to work by enabling VLAN tagging in the network adapter. The laptop is 5 years old and it does not have any such setting in network adapter. There are 2 other devices that share the same port with the laptop and they both function properly. My conclusion is that the laptop does not support VLAN tagging. Is there someway to configure the switch to account for this?
i have a SG300-52 Switch, route mode is enabled, and it is using the latest IOS.I have created 4 Vlans in this switch, till this point its OK, but once i try to give ip addres to the created Vlan either from the GUI or CLI the switch is not responding. i have to go and manually reset the switch using a pin.
i was trying to set up a new SG300-52 L3 switch for switching and Vlan. The problem is that the vlans on this switch cannot get their DNS resolved. Probably a stupid thing i can't get to see, but i think it is a simple solution given switchin is not my expertise.So my setup:
- ISP Wan router: LAN ip 10.0.0.1, DMZ: 10.0.0.2 -> i have to use this router for ISP support. But it suckes, that's why we use own router for firewall, port forwarding etc.
- Nice Router: WAN: 10.0.0.2, LAN: 192.168.1.1
- SG300 L3 switch
This works. I can ping switch, nice router, ISP router and google's ip from VLAN 5.But i cannot ping google using host name. From within SG300 i can. So it has something to do with SG300 not doing DNS right.My Client on VLAN 5 has ip 10.1.1.5 / 24, default gateway and dns pointing to switch: 10.1.1.1.I have put an entry in DNS servers in SG300: 192.168.1.1 active (pointing to Nice router). On client leave default gateway pointing to switch. But put DNS server : 192.168.1.1
I set an SG300 switche in layer 3 mode with 3 vlans.I need to give IPs to a whole vlan machines. Do the switch have a DHCP server per vlan? How to configure this?
configure my new SG300-28P. When I have started the switch, I have specified a new password and enabled telnet in order to setup the switch in Layer 3 mode.
After a restart, the switch took its IP address from a DHCP server. When I try to set a static IP address (192.168.2.1), I receive the following error message: Duplicated IP interface on the same subnet.
The IP address 192.168.2.1 is not used by any device within the network. For information, the message doesn't appear when the switch is in Layer 2 mode.
why I can't change the IP address of default vlan in Layer 3 mode ? All I can do is set the IP address to static or dynamic.
For test purpose, I have added 2 vlans. But I wasn't able to route traffic between vlan. how to configure the switch to route traffic between vlan?
find below details informations about my VLANs.
- Default (VLAN ID 1) IP Address : 192.168.2.1 Subnet : 255.255.255.0
I have a SG300-28P switch. I just read in the Administration Guide that, when in Layer 3 mode, the switch doesn't support MAC-based VLAN or Dynamic VLAN Assignment.
So, in order to assign a client to a VLAN based on their MAC or based on the response of a RADIUS server, we have to disable layer 3 features. Without layer 3 switching, the switch is unable to act as a default gateway and forward packets between VLANs. As a result, the VLANs can't communicate in any way, or access the internet, unless a separate router is connected to every VLAN. Right? Doesn't this limitation significantly reduce the usefulness of the DVA feature?
Any snmpset commands to modify port vlan membership on SG300-28 switches? I checked [URL] however this information is apparently only valid for catalysts.
The latest firmware is installed and the provided MIB files are used.
we have an SG300 latest 1.3 firmware, we have it acting as our DHCP server, we have a 10.10.1.x range, 10.10.3.x range, and 192.168.24.x range, they are all on seperate VLANs and all can talk to each other which is what we want. However we have someone who wants to use the 192.168.1.x range to add IP cameras to our network using there own switch. I figured I'd just setup our server to do DHCP etc and it would communicate with the 10.10.1.x range of IP addresses no problem. It turns out the SG300s can't do DHCP for that range, so if he has all static address on the 192.168.1.x range how can i setup inter VLAN communication so we can talk to that range?
I am having a problem with 6941 phones on a SG300.When connected Smartport assignes the native and tagged voice vlan correctly, however the phone connects to the native vlan. After running a few tests I have found it only happens when the voice vlan is also the default vlan, though this has only been tested with the default left as VL1.I can get to the phone on the native vlan, it picks up an address via dhcp, and the Operational VLAN ID is shown as 4095.Manually configuring the port as a trunk with the native and tagged voice vlans gives the same result.CDP properties for the ports show the voice vlan as correctly advertised.This happens on multiple phones/ports.The 7962 phones on the same switch work as expected.If I set the voice vlan to be something other than the default vlan 1, a vlan with dhcp available, the phone uses the configured, tagged vlan as expected and the Operational vlan shown on the phone is correct.The switch is running 1.2.7.76 I have a test setup with a number of 7900 and 6900 series phones running on a SF300 and have tested all phones as working if the voice vlan is not on the default. I intend to test with the voice vlan as the default shortly to confirm it is not an issue with the specific switch and discover if it occurs on more than just the 6941.
I have a Cisco SG300 small business switch and 541 APs. There are 2 VLANs in our network. One must be limited by bandwidth. How to configure vlan rate-limiting on SG300? And describe CIR & CBS.
why i can not found ip router setting by main menu? the sg300-28 can not support ip router command?mor informations,see my img. If sg300-28 can not support ip router command,what i can do it that communicate by multi-Vlan ?
I am having a problem with 6941 phones on a SG300.
When connected Smartport assignes the native and tagged voice vlan correctly, however the phone connects to the native vlan. After running a few tests I have found it only happens when the voice vlan is also the default vlan, though this has only been tested with the default left as VL1.
I can get to the phone on the native vlan, it picks up an address via dhcp, and the Operational VLAN ID is shown as 4095.Manually configuring the port as a trunk with the native and tagged voice vlans gives the same result.
CDP properties for the ports show the voice vlan as correctly advertised.This happens on multiple phones/ports.The 7962 phones on the same switch work as expected.
If I set the voice vlan to be something other than the default vlan 1, a vlan with dhcp available, the phone uses the configured, tagged vlan as expected and the Operational vlan shown on the phone is correct.
The switch is running 1.2.7.76 I have a test setup with a number of 7900 and 6900 series phones running on a SF300 and have tested all phones as working if the voice vlan is not on the default. I intend to test with the voice vlan as the default shortly to confirm it is not an issue with the specific switch and discover if it occurs on more than just the 6941.
I have two Cisco SG300-20 switches. Both of them are configured in L3 mode. They have several VLAN's configured.
When I reboot my switches some VLAN membership settings are lost! I have already saved the settings over and over before rebooting, and even tried to save it to the backup memory and so on. Say for example I have changed port 9 to 14 from VLAN 101 to VLAN 105. I save the configuration, reboot the switch. And then the changes are lost. This is a big problem, because servers and my iSCSI network loose connectivity. They already have the latest firmware. This issue was there three firmwares before.
This issue pop-ups when I have a power loss, or I need to reboot/shutdown them manually. It may be off-topic but I also have the feeling that the performance of the switches goes down during uptime. A reboot solves the performance issue. I don't have a performance benchmark, but I can notice it on the performance transfer rate between clients and servers.
I am trying to assign static ip address on vlan 1 interface , the model no of switch is SG300 & the firmware version is 1.1.2.0 .But whenever I type the IP address & press enter , a question is popped up asking for confirmation (switch0d851f(config-if)#ip address 1.1.1.1 255.0.0.0.
Please ensure that the port through which the device is managed has the proper settings and is a member of the new management interface.Would you like to apply this new configuration? (Y/N)[N] N )
I have 2 SG300 switches and all I want is to propagate VLAN info from one to other. I do not have computers with GVRP compliant NICs, so I dont want that auto registeration functionality on access ports. I want VLAN prop via trunks and switchport mode access on access ports just like VTP. I have read on cisco docs that this functionality is provided with GVRP Mode fixed, but there are only 2 modes that I can see on SG300 are Normal and Forbidden. Trunk configured correctly, gvrp is enabled globally and on port, ports are up and functional, tried different combinations of checking and unchecking boxes of dynmic vlan creation and enable registeration on both ends but no joy. When I create a vlan from one, it doesnt propogate to other.
We have recently purchased a Cisco SG300 and have been configuring it. [code] The VLANs have ACLs set up to prevent any communication between the Holly and Tempo VLANs (and their associated WAN VLANs).Each VLAN has a WAN available for it's use, which connects to external networks (including the Internet).In order to facilitate this, we have set up all the necessary ACLs and routes and confirmed that this all works.However, the problem comes when we assign the static routes that specify the default gateways.We add the two static routes below:
-0.0.0.0 next hop 10.10.200.254 metric 1 -0.0.0.0 next hop 192.168.200.254 metric 1
In this case, only one of the VLANs has WAN access. It is either Holly or Tempo (it can be either if the order the static route is added is changed).What we need is to force Holly to use Holly WAN and Tempo to use Tempo WAN, but we cannot see a way of doing this.Effectively, we want the following static routes: [code]
We connected 4 wireless access points (AP541N-E-K9) to an SG300-10P switch.We want to be sure that no wireless clients can alter settings to the network by connecting to any of the networking devices. We also want that no wireless devices (except a few) can connect to computers that are on the wired network. I'm new to configuring networking devices so how to set up the switch for this.We already added all the MAC-adresses of all the wireless devices (that are allowed to use the wireless network) to the access points.
