Cisco Switching/Routing :: 3750 - How To Hide Mac Addresses
Jun 12, 2013
I Lease fiber between two locations, My operator limiting number of MAC addresses to 8 macs. Is there any possibility using some feature available in the Cisco 3750 switches to (hide mac addresses) encapsulate traffic witch flowing via operator network ?
I need to send data between locations with 1Gb/s speed. If 3750 switches can't do that, which models of switches 1 or 2U can do it. May Metro switches ?
We have a 3750 running IOS ver 12.2 (44) SE, it has performed great and we have never had a problem with it. However we have noticed that when we had an outage some of our Wireless APs didn't come up as they get DHCP from the 3750. The DHCP scope said IP was depleted although there were IPs to give. We had to delete and recreate the DHCP Pool. However two days later we got the same problem and then had to do the same thing over again.
I have Catalyst 3750 running IOS version c3750-ipservicesk9-mz.122-55.SE.bin. I have an access port that connects to a Redhat Linux version 5.4 64 bits machine. When I perform a "show mac address-table interface g1/0/3" where the redhat machine is connected to, I see two mac addresses on this access port. One of the mac addresses, 0025.9006.4898, belongs the the redhat machine. the other mac address, I have no idea where it comes from. I tried to perform clear mac address-table dynamic g1/0/3 several times but it does not work either.
we have a 3750 and use dhcp services on the switch. every so often we run out of ip's even though we have much less users than the size of the allocated dhcp pool. I've noticed that the dhcp bind table is full but a ping-sweep only shows very few ip's being assinged and used. It looks like the IP addresses are not being released from the table even though I have decreased the lease time to 8 hours.
Had a problem with a 3750 this morning not handing out DHCP addresses. The following is a sanitized config of what the switch is using. [code] The IOS installed on the switch is c3750-ipbasek9-mz.122-55.SE1.bin. What got my attention was that the sh ip dhcp pool PC showed 180 addresses being excluded. In doing the math from the dhcp excluded addresses, only 64 should be excluded.
My next step was to remove the second dhcp excluded-address line above. Doing a clear ip dhcp binding * started letting the DHCP service hand out addresses but the sh ip dhcp pool PC stil showed 180 addresses excluded.
It finally took removing the dhcp pool and putting it back in to drop the number of excluded addresses down to a value that matches the first excluded-address line. Didnt see a dhcp bug in the bug database that would explain this.
I tried re-entering the second excluded-address line from above and saw the number of excluded addresses rise as expected. When I negated the line, the number of excluded addresses dropped back to its previous value.
Haveing issue with DHCP server handing out IP addresses to client connected to VLAN5 interface.ISP Router>Firewall -(WatchGuard Drop-in mode) I have several 3750 switches and one acting as a L3 switch. The L3 is configured as follow: [code]
If I connect a laptop to int fa1/0/10 I DO NOT get an IP address from the 10.100.0.8 scope. If I connect to another interface within the VLAN 1, I get an address from the 10.100.0.0 range.
I currently have a the following configuration and am unable to get more than 2 DHCP addresses for the devices connected to the Cisco new SG 100-16 Switch.The AP have no trouble handing out DHCP to the wireless clients, but we are unable to get the SG 100-16 to be able to do the same thing to wired clients. It is currently connected to the 2960-8 in port 1. We can get 2 devices connected without a problem, but the 3rd machine and beyond do not work. Also, setting up a static IP does not work. Using a static will not even allow us to ping or tracer back to any devices beyond the SG 100-16.
I'm working on my CCNA. I purchased an old router 2610 with two ethernet ports. I configured the IP addresses on the interfaces and added the default gateway. I configured NAT to go out my ATT DSL router to the internet. With the 2610, I'm able to ping the back end or internal DSL router, but I can't ping the front end, external router, or out to any internet site such as google.
I used to use a CentOS self-made server for intranet for my little office, but I bouth few days ago a Cisco 861 router to replace the linux box.
1. I have 2 public IP classes from my ISP. 1 class is limitted to 80mbit upload, the other to 30mbit upload. So I need some sort of DNAT to be able to know exactly which intranet computer uses big internet and which one limitted internet. 2. I need DHCP server and with static IP addresses (one computer must always have the same IP address, etc).. i have my needs for this. 3. Also I need external access to some servers inside (web, ftp, etc) [code]
So far so good, all looks simple and I can achieve this in 2 hours on a centos linux box (correct routes, ip forwarding enabled and few iptables rules for NAT/SNAT/DNAT).
But on this brand new Centos router well, i'm not even successful in pinging the outside world, nor the inside world I'm tired of reading the forums, the documentation..i want (at first) a simple scenario: vlan+dhcp, fa4 with 1 public ip address and ACCESS to the real world. I wasn't able to achieve not even that much. [code]
We want to permit certain mac addresses on the cat 4506 switch wherein only those mac addresses will get access to network.
Configuration Planned: For testing purpose we have created mac access list on cat 4506 and deny laptop mac address in this access list. The mac access group is applied to the port where the laptop is connected to cat 4506.Even after applying the mac access group on the port, the laptop is able to ping the vlan ip of cat 4506 [code]
laptop with ip address 192.168.10.2/24 connected to port 2/1 is able to ping 192.168.10.1 even after applying the mac access-group
Note-we have tested same configuration on cat 3560 and its working fine. We apply the mac access-group command on interface and clear the arp-cache and we are not able to ping vlan interface ip. The moment we remove the mac access-group,ping starts again.
I have an ASA 5505 with Security Plus License ?I have 5 Static IP Addresses from my ISP?I have the following interfaces. Outside (vlan 2) / Inside (vlan 1) / Guest (vlan 3)For my Vlan3 guest network I have set it up so that DNS must be routed through opendns.org's DNS servers ( for web filtering, etc ) However, its using the static ip that I have plugged into the ASA.
What I would like to accomplish is to put my inside interface (vlan1) on another static ip for outside access if thats possible, so that I can route those clients through opendns.org however however giving them more web privlieges than what the guest network is getting.
I have a 1941 router tt needs to be setup with the range of WAN ip addresses ip nat inside outside don't allow me to use it..How can i configure on the router to ensure from outside i'm able to access to firewall (126.96.36.199) ?
I have a customer who has an ASA 5505 that is handling the routing for their internal network. They are running out of available IP addresses on their subnet 192.168.1.0/24. They have dumb switches that don't suppport multiple vlans or trunking & they are only able to connect to one switchport on the ASA. He doesn't not want to purchase any new equipment or rearrange their existing equipment at this time. The customer would like to statically assign IP addesses for 192.168.1.x & 192.168.2.x and have the ASA hand out DHCP addresses for 192.168.3.x addresses. The customer suggested configuring a super subnet. A 192.168.0.0/22 address scheme would provide an ip range 192.168.0.0 - 192.168.3.255 on a single VLAN. I know this is an unconventional way to setup an internal network & I will definitely advise the customer that this should only be considered as a temporary solution until they get more appropriate network equipment.
I inherited a Cisco ASA 5505 and am trying to piggy back the device off of an established Network. Here is the basic layout:
192.168.10.1 (Core Router - Handles DHCP/DNS) 192.168.10.9 (ASA 5505 - Piggy backing off of Network) 192.168.40.x (ASA 5505 - VLAN)
I'm able to get onto the Internet without any problems. Devices from the 192.168.10x Network can not ping the inside VLAN1 (192.168.40.x). However, I would like traffic going from the inside VLAN to the Outside VLAN to be blocked, except for 192.168.10.1 and 192.168.10.9. I've tried using ACL's but end up killing my Internet connection. 192.168.10.1 is the default route and is how I get out to the Internet. Is this possible? Essentially, I'm trying to set up a small Network that guests can connect to. The idea is that they can get to the Internet, but that is it. They can't get to internal resources on the 192.168.10.x Network
Here is the config:
ASA Version 8.2(1) ! hostname ciscoasa enable password EeCsulrpu.9LalEE encrypted
I have a network topology which you can see on image. All routers are Cisco 3745 with IOS (C3745-ADVENTERPRISEK9-M), Version 12.4(12). SW1 is L3- switch Cisco Catalyst WS-C3560E-24TD with IOS (C3560E-UNIVERSALK9-M 12.2(58)SE2). [code] After that I have problem. When PC with OS Windows 7 begins to work in corporate network, it sees "coflict ip addresses" and doesn't work with network. I've used wireshark and seen, when the PC send arp request a SW1 always send arp reply (see attached file). I think problem with command "ip sla responder", but I haven't searched information about it and I want understand this is bug or normal functioning.
I've got a problem with DHCP running on a cisco 1900 series router, 1921 to be precise. The Data VLAN works perfectly, i configured a ip helper address and its working. Problem tough is VLAN 20. This is the voice vlan. As u can see in the config below, this has been configured using VRRP and VRF for failover purposes. I did more of these configurations, and they all worked fine, just not with this particular router!
As u will notice i deleted all the not needed to know information or i X'ed it!
Jan-Aart version 15.1 service timestamps debug datetime msec
Had an odd issue that started up last few days.. Have a port on a cisco 2912 XL that keeps dropping (drops all packets) on a certain VLAN, but still passes others. Spanning-tree for that vlan says all ports are in forwarding status. VTP says that VLAN is still active.
This network is a little strange... 2924XL -> MotoPTP -> 2912XL -> Moto Canopy Array -> Some sites with cisco, some without all feed through canopy controller switch to single port (fa0/8) on 2912.
Getting a few of these on terminal monitoring, %RTD-1-ADDR_FLAP: FastEthernet0/8 relearning 5 addrs per min... Sometimes this is fa0/8, fa0/10, or fa0/1.
I'm thinking the switch has just gone nuts, cause fa0/1 is direct connected to a router used for VLAN1. fa0/8 is connected to a dumb switch on a canopy CMM as a trunk which i enabled bpdufilter on because of some spanning tree issues on VLAN1. fa0/10 is connected to canopy PTP back to the 2924 as a trunk. VLAN69s router is off the 2924. So there aren't really any possible alternate packet paths to this switch from another switch.
I also setup SPAN and captured all packets from fa0/8 and fa0/10 (seperately) and never seen packet storms of any kind on either VLAN1 or VLAN69.Further testing with debug, nothing on spanning tree, nothing on vtp, but on ethernet-controller addr I got some interesting results showing one mac moving from fa0/1 to fa0/8 and back to fa0/1 but it never moves, its the routers mac that is connected directly to fa0/1. Same with some macs on the other side of the PTP link saying they are bouncing from fa0/10 to fa0/8 and back to fa0/10 which isn't possible
- Incoming frames on three of a blade's four switchports are being put into VLAN 1 even though the ports are either in other access VLANs, or are configured as trunks with different VLAN IDs being tagged by the server. - When the ports go down the access VLAN is removed from the port.
Switch stack: 4x WS-CBS3120X-S, 12.2(58)SE1 HP blade: HP BL460c Gen8
This combination has been used successfully elsewhere.
! interface GigabitEthernet1/0/13 -------> THIS PORT IS OK switchport mode trunk
I'm looking at adding a Cisco 3750-X switch running c3750e-universalk9-mz.122-55.SE1 (IP base license) into a stack of 3750-G switches running c3750-ipbasek9-mz.122-55.SE1.bin Given that the version and feature sets are the same I don't forsee any compatibility issues. Would there be any reason why a universal image wouldn't stack correctly with other switches running the single .bin file?
i have to Bridge the AP to VLAN1 which has the DHCP pool. For some reason when I try to do this from iOS console it tells me that gig0 is not a bridgable interface. I am newb to Cisco iOS (24 hours new ). I got the Cisco Configuration Professional working and would like to fix my issue through there if possible? why my AP wont get anything but APIPA addresses?
version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption
Setting up a stand-alone WDS/PXE server.Current we have helper addresses setup to forward the DHCP requests from the different VLAN's to the DHCP server. The WDS/PXE server we are setting up is on its server. How do we craft the helper addresses so DHCP requests go to the proper server hosting DHCP and PXE requests go the WDS server?
Everything I seen on Microsoft Technet, lists using Helper Address as the recommended way, but assume both services are on the same server. Our helper address is as follows on each VLAN interface in router: ip helper-address X.X.X..This is a Cisco 3750.
We have a stack of switches that is at the max number of members allowed in the stack. Problem is we are running out of port density and need to add more ports. So instead of adding a whole new stack I would rather replace 2 of the 24-port swicthes with 48-port switches.
If the two 24-port swicthes we are removing are stack members and neither of them are the stack master, I should be able to replace the 24-port switches with the 48-port switches without bringing the master offline? If the new 48-port switches are running the same IOS version as the current 24-port swicthes, they should add themselves to the stack?Would I have to tell the new 48-port swicthes what switch numbers they are replacing in order for them to be added to the stack since we are at the max number of members?Also since the 48-port swicthes are replacing 24-port switches will the master give the 48-port switches the configuration for only the 24-ports?
some of our switches have the switchport mode trunk command configured between the 3750 switches but other 3750 switches connected to our 6509 core switch do not have the switchport mode trunk command to permit Vlans from going across the swtiches instead it has an ip address and says no switchport what is the difference between does two. Is trunking used only for Layer 2 and L3 is used to route interface vlans?
I have a network with a Catalyst 3750 as the main switch and then some Catalyst 2960 switches that are plugged in to that. I have a server running windows server 2008 with a couple of virtual machines running in Hyper-V. I created 4 VLANS listed below and gave the 3750 the following IP Address.I would like the 3750 to only be configurable from VLAN 40 but currently every VLAN can connect to it, I noticed in the standard web page settings there was a setting for "Management VLAN" but it was set to 1 and would not let me change it, I kinda assumed that was for the management port in the back.-Now the tricky part, I was trying to set up routing between the VLANs and so far I have only been able to get a sort of "all or nothing" routing to work. I can turn IP routing on and add two or more VLANs to the routing and it works fine. But what I was hoping to do is create a couple of "junction vlans" that would only route to one or two other vlans. For instance, I wanted to create a VLAN 100 that routed to VLAN 20 and 30 but nothing else. I also want to route VLAN 1 just to VLAN 30, and so on. I am able to do each one of the cases but only one, it seems like the switch only supports one "routing table" am I missing something or is this just a limitation of the switch?
I have a network with several catalyst 2960 switches and one catalyst 3750. I have created two VLAN and set up the proper routing and everything is working fine there. I have a client/server application that used multicast in the initial start up for the client to determine available servers, the issue is one of my clients is on a different VLAN then the server. I am able to route the multicast using MVR as long as both the server and the client are plugged into the 3750 by creating a static route, making the server a source port and the client a receive port. Unfortunately I need the client and the server plugged in to different 2960s. My question is how do I establish multicast routing between the two and perferably do it dynamically (always route multicast traffic from one VLAN to another).
I have been looking into this for a while and I can't seem to figure out why my 2nd vlan is not able to connect properly to the net.
My switch has 12 ports where my devices connects directly, they are all on Vlan 1 and they all work perfectly. on Port 12 I have a dlink router that is connected to a cable modem. the dlink router has an Ip address of 192.168.0.20
I created a second vlan (vlan2) and enabled dhcp relay on it. then I assigned port 9 on the switch to (vlan2)my laptop which is connected to port 9 seems to get an ip address fine and able to ping only some devices on my network (vlan1) and is not able to go out to the internet. I think it has to do with the routes. [code]
I have the task of replicating the router config on a 3825 router on a 3750 switch. Reason is we are taking out the router and replacing it with the switch to make use of the router for other functions.
Below is main part of the router config:
! ip source-route ip cef ! ! multilink bundle-name authenticated ! license udi pid CISCO3825 sn FCZxxxxxxx ! vlan internal allocation policy ascending
The 3750 switch I have runs C3750E-UNIVERSALK9-M, Version 12.2(55)SE3 on a LAN BASE license.
The first thing I have done is to order for a license upgrade to IP BASE which would give the support for OSPF routing.I do not see much of an issue with the Interface configs, however, I am not too sure about replicating the routing config on the switch.
My question is can I run the commands as shown for the OSPF routing on the switch? If not, can I get suggestions on how best to set this up on the switch?
In 3750 switch,I have configured intervlan routing.I have three vlans Vlan 10,vlan 20,Vlan 30 and I have assigned IP address for that Vlan.In vlan 10,I have connected one systen gigabitethernet 0/1 interface.From my system I am able to ping vlan 10 ip address but I can't able to ping other vlan ip address (vlan 20,vlan 30).Is it possible to up the protocol for all that time.
For intervlan routing, Is 'IP routing' command enabled by default on a 6500 series switches based on the IOS?and on 3750 switches, do we need to enable the "ip routing" command manually for intervlan routing?
I am using a 3750 as a default gateway for multiple Vlans on a few 2960 switches. The trunk lines are configured and working and I have assigned ip addresses to each of the Vlan interfaces on the 3750. My issue is that I can only ping the ip address on the Vlan interface of the 3750 if I have a working computer plugged directly into the Vlan on the 3750. I only have 3 vlans on the 3750 that have hosts directly connected (vlans 2, 10 and 40) the other vlans ( 20 and 70) don't have any clients plugged into them on the 3750 but the hosts reside on 2 different 2960s that connect via trunk ports. How do I keep the vlan interface on the 3750 switch pingable when I don't have hosts directly connected in that vlan on the 3750? (yes, I have enabled ip routing on the 3750)
I have a simple design with 3750. I configured a route-map which define a next hop. I defined this route-map on a policy on a vlan interface.When I test some ping and a debug ip policy and it seems that my policy never match.Is there any mechanism that prevent the switch from using PBR? I think of CEF .