Cisco Switching/Routing :: 2960S / 2911 / ASA 5510 - VLAN Can't Get To Internet
Sep 24, 2012
Have multiple Catalyst 2960S switches, Cisco 2911 router and ASA 5510 firewall.
On the router have subinterfaces created for the VLAN's Int FA0.0/41 for wirless VLAN setup with IP 10.10.41.100 Int FA0.0/60 for new Voice VLAN setup with IP 10.10.60.100 Internal network is 10.10.10.0/24 and LAN IP of router is 10.10.10.100 Have default route setup to push traffic from the router to the firewall ip route 0.0.0.0 0.0.0.0 10.10.10.251
On the firewall have added the new VLAN 10 (10.10.60.0) to the network object-group Have configured route inside command route 10.10.60.0 255.255.255.0 10.10.10.100 1 Have also added the NAT command nat (inside) 1 10.10.60.0 255.255.255.0
On the 2960 I have my laptop connected to port 45 and I have it configured as follows switchport mode access switchport access vlan 10
I assign my computer a static IP address of 10.10.60.84/255.255.255.0/10.10.60.100 with 10.10.10.11 as DNS server. When I do this, I can ping anything on the 10.10.60.0 network, I can ping anythign on the LAN 10.10.10.0 network. I am able to connect MSN messenger, I am able to do NSLOOKUP and get outside IP addresses to resolve. I am unable to browse the Internet though. I am not sure where the problem is at though. It doesn't make sense to me, as it is setup the same way as VLAN 41 which is the wireless network, and when users connect to that, they get out to the Internet with no issues.
View 15 Replies
ADVERTISEMENT
Feb 17, 2013
We need to give differentiated internet access to three VLANs. Each one of this VLANs is used for totally different purposes, so traffic between the VLANs is not allowed. Each VLAN has its own internet access provided for the data center using one fast ethernet connection.
We're thinking about using cisco 2911 for Internet access, VPN and firewall. I suppose that best option for VLANs is using Catalyst 2960S or a swithing module for the 2911, but these two options are too expensive for us. We're thinking about using swtiches from the SB series (maybe a SG-200).
We're totaly newbies to VLANs so we have many doubts. This are our questions:
1) The 2911 has three on board ethernet interfaces; we have three VLANs and three internet connections, so we need to use HWICs to get three more ethernet ports. That's right?
2) We need three HWICs or there is some kind of HWIC with more that one ethernet interface?
3) The routing solution is to assign static routes in the 2911 for each interface connected to a VLAN through a 2911's interface connected to internet?
4) Simply connecting three different router interfaces with three different switch ports, each one of them assigned to one of the three different VLAN, are we going to get internet access for all devices in those VLANs? or do we need to configure something else like trunking, VSIs...?
5) Can we achieve our goals using the SG-200 switch?
6) We have the chance to use older routers, is this possible? We're specially interested in knowing if a 1841 or a 2801 router could be used for this setup.
7) This is not a production environment so we can use refurbished equipment.
View 4 Replies
View Related
Mar 31, 2013
i need to solves this little problem on 2960S lan BASE but i dont know if it is possible.
Uplink port config for gi 1/0/28 is:
switchport mode trunk
switchport trunk alloved vlan 10,11
but on interface gi 1/0/1 i want to have data from vlan 10 tagged as VLAN 20.
At this time i have solved this issue very primitively
I have set up gi 1/0/2 as int mode acces, acces vlan 20 and i have connected gi 1/0/2 with gi 1/0/3 with eth cable. int gi 1/0/3 is switchpor mode acces, switchport acces vlan 10
View 4 Replies
View Related
Jun 27, 2012
I got a different scenario from one of my client.My client have two different branch offices and have 50Mbps point to point connectivity between them. All users in both braches using same series of IP pool ( 192.168.224.0/24) in both branches.Both branches he had only Cisco 2960S series switches only. And in both branches he is using IP cameras. He will monitor the assets by accessing IP cameras through the browser.His requirement is, he wants to prioritize the Video traffic( monitoring through the browser) over the normal data traffic.Note: He had a single VLAN only.
View 8 Replies
View Related
Sep 22, 2012
I need to set QOS in our new network. We have connected 2 cities together with 700Mbit leased line. On each side we have Catalyst 2960S switches and between them is TRUNK for VLAN 10 and Vlan 20.Vlan 10 is for IPTV (fixed 400 Mb/s for CATV)Vlan 20 is for Internet (rest).Sometimes is happening that Vlan 20 takes more than 400 Mb/s for a few seconds and in this situation we have problems with CATV.Is there any way to make a guaranteed bandwidth 410 Mb/s for CAT - VLAN 10 on this swithces?
View 2 Replies
View Related
Jan 20, 2013
I have hybrid network in which I want to configure VLAN on Cisco 2960 S switch. I have unmanged switch where my DHCP server and other servers are connected. Now I created two VLANs on cisco 2960S and they don't talk each other, but as soon as I connect unmanaged switch to 2960S switch, both VLANs start communicating which I don't want. I want to listen server traffic from unmanaged switch from both VLANs but simultaneously I don't want to communication between two VLANs.
View 10 Replies
View Related
Jan 4, 2012
We are trying to setup a new configuration with 2960S as access switchs and a 4507 as a core switch.I want to protect the management IP VLAN of the swich using vrf on the 4507 so we :
SHUT VLAN 1 on every switch (2960 + 4507)
CREATE A NEW VLAN 289 (management vlan) -> IP network : 10.32.126.192/26
L3 VLAN on every switch
VLAN 289 in the VRF XXX on the 4507
create tunk between the switch and the 4507 :
switch mode trunk allowed vlan 200-230
sw trunk native vlan 289
so with this configuration on the 2960 the vlan 289 is UP/DOWN and UP/UP on the 4507 I can access to the 4507 using the IP in the VLAN 289 but i cannot access to the 2960 behind the 4507 CDP connectivity is ok?
View 14 Replies
View Related
Dec 7, 2011
i have a Catalyst 2960S since 2 days. I am a new user, i like to configure the switch! my first problem is: i have 2 v LAN vlan1/24 and vlan200/24. I'd like to config port1 to be tagged on the 2 v LAN i know from hp port must be tagged. how can i config port 1 to be tagged on vlan1 and vlan200? and port 2 to be untagged in vlan1 and untagged in vlan200?
View 12 Replies
View Related
Oct 8, 2012
Has anything changed in the way of defaults for creating a trunk port and spanning-tree between a 3750x and the newer 2960s? I have one of each I just took out of the box and applied my standard switch configuration template but I cannot get my VLANs that are configured on my 3750X to appear on the 2960S. I find nothing that is blocking and everything seems to be forwarding and I am running out of things to check.
View 5 Replies
View Related
Jan 27, 2013
We bough an Cisco 2911 router, and as i see the "ip sla monitor" command is not supported. Which license/IOS upgrade should i buy the fullfill this. And i cant add a trunkport to the iunterface even cant add a vlan to interface. How do i a trunkport on the cisco 2911 router. ANd how can i do a vlan on a interface on the router.
View 2 Replies
View Related
Mar 24, 2012
I have a network with the following structure
internet ---- cisco2911 ----cisco3750 --- internal lan
I have two email servers on different vlan
192.168.0.1 ----- 1.1.1.2 (public ip)
10.1.1.65 ---- 1.1.1.3 (public ip)
Before these servers were directly connected to the internet with two nics (Nightmare, I know). The Public IP on internet facing NIC and private ip on LAN facing nic. I'm in the process of changing this.I'm able to access internet from my vlans and also able to send emails but cannot receive emails on these servers.
My router congif is as follows:
Building configuration...
Current configuration : 6234 bytes
!
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
[code]....
View 1 Replies
View Related
Jan 16, 2013
Topology: 3560 <-access-mode-link-> ASA5510 - Internet,3560 has 3 VLANs and 3 corresponding SVIs (default-gateways for VLANs),Just configured RAS VPN on ASA5510 and successfully made connection,Now, from RAS VPN (IPSEC) client workstation CLI, can ping all 3560 SVIs,CANNOT PING host devices plugged into switchports.
View 1 Replies
View Related
Nov 13, 2012
Firewall: ASA 5510
Switch: Linksys SRW2048
Physical topology: PC - > VLAN99 - > SRW2048 - trunk - > ASA5510
Switch Setup:
I've been tasked with breaking up a network that has run out of IP's, and have decided to use VLANs to accomplish this. I have to use an ASA5510 to accomplish all the routing between hosts in different VLANs.Port 48 is trunked to the ASA eth0/0 interface, with VLAN 99 and VLAN 20 tagging packets, VLAN 1 Untagged. Hosts hooked up to appropriate ports on Switch.
View 2 Replies
View Related
May 28, 2012
I am a complete newbie to Cisco equipment. So far I've been able to figure out how to do most of what I needed by using the ASDM but I have run into something that is a little more complicated that just opening a port. We currently have a connection to our remote site. This site has a T1 internet connection. Our connection is a site to site VPN with an ASA-5510 on this end and a ASA-5505 on the other.
We are upgrading this connection to a 75mbit hybrid microwave/fiber link. The provider is going to hand it off to us as an untagged VLAN. We made the decision to route all of the remote site's internet access through this location as to avoid having to split off part of the bandwidth of this link to dedicate to internet access.........
View 23 Replies
View Related
Dec 7, 2012
Need to Have both ISP to access internet/servers configure a Cisco 2911 router, It has two ISP one as primary 216.140.140.0, and secondary for backup as 216.150.150.0. I need to be able to access both the ISP's using the same interface Gi0/1. Since we have servers that have to have specific IP both when accessed and when accessing the internet so I used static Nat for the servers and Dynamic for all others. I did the following configuration but it does not work as i want it, if i unplug the Primary ISP from the unmanaged switch the secondary cant access the Internet or network.The secondary only works when the primary and secondary are both connected and have an equal cost Administrative distance, hence it is not available when the primary is down . Even though I can use a sub-interface instead of a secondary Ip address (which worked when I used it) I need to use the same interface using a unmanaged switch to which the outside interface of the router is connected and the two ISP's. Below is my configuration.
interface GigabitEthernet0/0
ip address 10.0.0.254 255.255.255.0
ip nat inside
[Code].....
View 1 Replies
View Related
Dec 19, 2011
I couldn't access internet with route specified i know the problem with the route or nat.i have 2911 router [code]
i could ping from lan Ip's to ISP1 and ISP2 gateway IPS. but when i ping to any site llike example gmail.com packet s not moving out to the ISP1 or ISP2 interfaces. [code]
View 10 Replies
View Related
Jul 24, 2012
Since two weeks I have a problem with the VLANs who I started to configure. I hope together we find the way.I have 5 VLANS configured in a CISCO 3560G switch. In my windows server 2003 I configured DHCP scope for each VLAN.One of the requirement to connect vlans each other is to put the IP of each vlan as gateway in the clients.So, how can I do to access to internet?. The ip of my Firewall are in one of the VLAN´s.When the configuration of the LAN only had one DHCP scope the gateway was the ip of my firewall. But now i don´t know how to configure the DHCP server, or the firewall, or the switch, or all of them To get access to internet.
View 2 Replies
View Related
Apr 2, 2012
We have 2 internet connections- one for production and one as a backup. The backup connection will be used for allowing guest visitors on a wireless network that is on a seperate VLAN.
We have the following networks:
VLAN 1 production, 192.168.1.0
VLAN 10 backup internet connection, 192.168.100.0, Interface 100.2
VLAN 41 wireless guests, 192.168.41.0, interface 41.1
VLAN routing provided by Dell 6224 switch and other switching is Cisco 2970 (L2) switches.Backup Internet router is SMC (Comcast)
I would like to allow clients on VLAN 41 access the internet connection in VLAN 10 at 192.168.100.1. Clients on VLAN 41 can PING and trace to the default gateway 100.1. VLAN 41 clients are also able to get DHCP info from VLAN 1. NSlookup fails when using the ISP DNS servers. NSlookup is suscessful when using our internal DNS servers, but web pages are not returned. It eventually fails.We've tried to set the DFGW on the clients to both 41.1 and 100.1 with no success.
100.2 know where to find 41.1 interface for the 41.0 network. The router/gateway can PING the clients on VLAN 41, 192.168.41.0 network and visa-vera.
It seems like the clients are not able to get through 100.1 to the internet or the gateway/router doesn't know how to get packets back to the clients.A static entry was made on the router that mapped back to the next hop at 100.2. 1 Someone alluded to a NAT issue, where the returning packets have information for the 100.0 network only and the internet router doesn't know to send the packets through to the 41.1 interface to the clients.
View 2 Replies
View Related
Oct 31, 2012
i have router 1841 have 2 interface.i make routing between vlan by subinterface in router and in switch trunk but vlan 5 cannot access internet
View 3 Replies
View Related
Apr 1, 2013
I am using a Cisco SG-300 28 port switch in layer 3 mode as my default gateway for all my devices. I have two vlans on the switch, vlan 1 and vlan 4. Both are pulling valid IP addresses in their scope from the DHCP server, and both have valid DNS settings. I set a static route to the Internet on the switch to our firewall (192.168.5.254). All devices connected to vlan 1 are able to access the Internet, however all devices connected to vlan 4 cannot get past the switch. A tracert from one of these devices shows it hits the switch as the gateway, but gets no further. [code]
View 4 Replies
View Related
Feb 6, 2012
I have a 2960-S running the lastest software for testing on my bench:
[code]
Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 24 WS-C2960-24-S 15.0(1)SE2 C2960-LANLITEK9-M
[/code]
I have set up VLAN 2 on 192.168.2.0/24 with the switch as the DHCP server. The switch is connected to an RV082 router which is at 192.168.1.65/27. Once I figure out what I doing I'll eventually shift that to 192.168.1.0/24 or something similar. So I have my switch acting as the DHCP server for VLAN 2 but I can't figure out how to get it to access the internet.
I found this example to set up the DHCP server:
[code]
###################################
this works to get vlan 2 to serve ips
conf t
[Code].....
The RV082 doesn't support trunks AFIK and I'm pretty much a newb at this stuff. TIA. I guess I should get a real router and I most likely will but I'd like to get this working if possible before taking the next plunge.
View 7 Replies
View Related
Oct 28, 2012
I have recently split the voice vlan (10) from the data network (1), and am wondering why my catalysts and router do not require an interface Vlan10 statement. In the past I used OpenBSD boxes to do the routing, and I first needed to configure vlan 10 on the interface before I could get inter-vlan communication to work. With these Cisco devices it works, and I am wondering if it is because of VTP, for the fact that the ports maybe just pass all traffic, or is there some other explanation? Below is the setup, and firmware is up-to-date on all of the devices.
When I plug a phone into the POE SGE, the phone turns on, obtains an address on the proper subnet, and conversations are clear (whereas without the ip nat inside on the new subnet the calls had a lot of static). Possibly the reason that it works is because the phones properly create the tcp/ip packet, and it hops over the trunks and creates the states so that traffic routes back properly. I will install wireshark to see exactly what is going on, but is there a simple explanation that I am overlooking?
View 1 Replies
View Related
Mar 23, 2013
I need to enable multicast routing on 2960s but the command "ip multicast-routing" isn't available on my release (12.2.(55)).
From which release this command is available?
View 1 Replies
View Related
Oct 8, 2012
I have C2960S-48FPS-L and C2960S-24TS-S both of them are using C2960S-UNVERSALK9-M image with version 15.0(2)SE on both I run "mls qos"
and on 48FPS-L I run "mls qos map cos-dscp..."on 24TS-S I cannot run it. there is no such command. there is just "mls qos rewrite..." and "mls qos srr-queue..." variants.
I thought that one image give the same set of commands...?
View 5 Replies
View Related
May 9, 2012
At the core of my network I have two Nexus 5548's with the routing/L3 daughter installed. They have a default route that points to my ASA 5520 for Internet access. I have configured a VLAN that I do not want to have access to the Internet. What is the best way of preventing this access? ACL on the Nexus or Firewall rules on the ASA?
View 1 Replies
View Related
Jan 17, 2012
while i am configuring a port on switch .The switch reloads.After reload the show version says,System returned to ROM by bus error at PC 0x458F6C, address 0x0,show version from the effected switch is,Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1).
View 4 Replies
View Related
Dec 8, 2011
I am currently having an issue with connecting a Catalyst 2960-S switch to a Small Business SG300 switch. When I connect them they are unable to form a link. When I do a show spanning-tree it says the mst link is in dispute.
View 1 Replies
View Related
Mar 25, 2012
I read some papers about QoS. The thing is that I have to implement 30 switches with QoS to connect to a lot of Cisco IP phones. The switches are Cisco 2960S with code image "C2960S Software (C2960S-UNIVERSALK9-M), Version 12.2(55)SE3". Should I use autoQoS feature or manually configure them?. How should I treat uplinks between access switchs and core/distribution? I have a lot of doubts regarding queueing, because all the info I had read its for another model/image.
View 4 Replies
View Related
May 16, 2013
I'm looking at the WS-C2960S-48TD-L and have a question about the uplink ports. Is it possible to mix 10G on one uplink and 1G on the other? The datasheet says 2x10G SFP+, 2x1G SFP so I am thinking mixing is not possible.
View 6 Replies
View Related
Nov 5, 2011
just got new hardware and decided to try the newer USB port for IOS upgrades. I could not get the switch to recognize my 2gig flash drive. Do I need a proprietary stick or special format?
I also noticed when I removed it the switches crash dump and rebooted?
View 12 Replies
View Related
Mar 30, 2012
i have a problem with ASA 5510 version 8.2(1),i have a mac os x 10.6.8 dns server when the asa is online and i want to use the internet my internet is very slaw it neede about 1.5 min to open yahoo.com and the asa log viewer shows too many drops, i have only the rule allow any tcp/udp domain.
View 1 Replies
View Related
Aug 18, 2012
When using dynamic configuration tools, if I choose 2960 (not 2960s), I have the option to choose RPS2300 as redundant power, but when I choose 2960s, I cannot choose RPS2300. However, in a document describe both 2960 and 2960s, it said that RPS2300 can be used. Does RPS2300 support 2960S?
View 1 Replies
View Related
Dec 20, 2012
Recently I'm working with my client to setup their network and he want me to limit user access internet bandwidth to 2 Mbps and the topology show below.Users ---> Switch ---> NAT Router ---> (int gi1/0/24 - qos apply) Edge Switch ---> INTERNET ROUTER (12Mbps) --->> INTERNET,This is my configuration, but it doesn't work, the end user still able to get more than 2Mbps internet speed.Access-list 100 permit ip any any dscp default,class-map match-all QoS_Floor_Limit, match access-group 100.
View 1 Replies
View Related
