Cisco Switching/Routing :: 3750 - Only Allow Specific Traffic To VLAN

Oct 10, 2012

Have a quick question regarding inter-vlan routing on a 3750.  Overview of network is ISP --> ASA --> 3750 (acting as my core and default gw).  I have 5 vlan interfaces on my 3750, all w/ 192.192.x.x subnets, a 6th w/ 192.168.100.x, and a 7th w/ 192.168.200.x.  I have enabled "ip routing" on the switch and can successfully ping from subnet A to subnet B as long as both devices are using the correct DG for their vlan, which is the switch.  I have a few ports that are trunked as well that go to ESX hosts which break out the vlans according to the subnet the vm should be attached to.  The ASA is set to nat internal traffic for all the vlans.
Now my question:  short of applying an ACL to each vlan interface to block traffic from other 192.192.x.x subnets is there a better way to accomplish this?  I want my 192.168.10.x subnet to be able to reach all the subnets, but don't want 192.192.10.x to be able to talk to 192.192.20.x for example.  I was thinking to create an acl like this:
access-list 120 permit ip access-list 120 deny ip 120 permit ip any
and then applying this to the interface for the appropriate vlan. 

View 4 Replies


Cisco Switching/Routing :: Block / Permit Intra Vlan Traffic On 3750

Feb 21, 2013

I have One switch 3750 and many switch 2960 c.I use one ASA 5510 to reach emote branche site (vpn conexion).I use one router 1841 for internet conexion.Router 1841, ASA and catalyst 2960 are connected on the 3750.Default gateway of all user is ASA IP
I configured Vlan 3750 and it work.Now I need to implement security : permit/block specific traffic between vlan [code] From vlan 72 I cannot have remote access on computer in vlan 34 and I cannot ping computer in vlan 34.

View 1 Replies View Related

Cisco Switching/Routing :: Setup VLan To Allow Video Traffic Between 2960 And 3750?

Nov 13, 2011

I am trying to setup a network using Cisco 2960 switches with vlans configured.  One vlan will handle video coming from four cameras that are connected to another 2960.
We have four cameras feeeding one port each on a 2960, that 2960 in turn feeds one port on the main 2960 which is the video vlan for that site.  From the site it goes back to a Cisco 3750 to be sent over to a Sonicwall firewall. If we connect to the 2960 that the camera are connected to we can see the video, but not on the main site 2960.

View 5 Replies View Related

Cisco Switching/Routing :: 3750 - Show Interface Vlan (ID) Doesn't Show In / Out Traffic Rate

Mar 13, 2013

I have configured a vlan interface on a 3750 switch. there is aprox 4Mb active traffic flowing through the interface, but when I do a "show interface vlan (vlanid)" the output show zero bits in and zero bits out. Its a typical L3 config with one IP on the vllan interface acting as the gateway for the VLAN devices. Is this a normal behaviur ? and if so is there any way to get the traffic in/out stats. The end PC/devices are connected to this switch via an L2 TRUNK and I dont have access to the L2 switch on which the actual devices connect. so cant get the real time stats of those interfaces.

View 2 Replies View Related

Cisco Switching/Routing :: 3750 - Extending VLAN To Remote Switch That Already Has VLAN ID In Use

Jan 10, 2013

I have two networks at two sites with a dot1q trunk between the two L3 switches at both sites (no routers involved)
SITE A - Cisco 3750 L3 - VLAN ID 50
SITE B - Cisco 3750 L3 - VLAN ID 50
I would like to extend the SITE A VLAN to SITE B so that I can move hosts from SITE A to SITE B without needing to change their IP address but the vlan ID is already in use. Obviously the easy solution is to change the VLAN ID for one or other of the sites but both sites contain hosts that run 24/7. Is there a way to join two VLANs with different IDs together.So for example I create a new VLAN 60 at SITE B and associate it with VLAN 50 at SITE A.

View 4 Replies View Related

Cisco Switching/Routing :: Low Bandwidth On 3750 From Vlan To Vlan?

Nov 20, 2012

We have a low bandwith (15-20 Mbit/s) to the ASA from our Client vlan. If i connect the Client to the same vlan as the ASA is, the bandwith (90 Mbit/s) is good.
Here are the Layer 3 Design:
Client     ->     vlan 2 - Switch - vlan 7     ->     vlan 1 - ASA 5505     ->     ISP
The Layer 2 Design:
Client     ->     Gig2/0/13 - Switch - Gig4/0/43     ->     Eth0/1 ASA5505     ->     ISP
IP Address:
I assuming the switch has a problem with routing ?It is a stacked Switch with following members:

switch 1 provision ws-c3750g-12sswitch 2 provision ws-c3750g-24tsswitch 3 provision ws-c3750g-24tsswitch 4 provision ws-c3750x-48
And we have following error message in the log from the switch:


One or more specific prefixes could not be programmed into TCAM and are being covered by a less specific prefix, and the packets may be software forwarded I first get the idea that the switch is overloaded with router traffic. Thats why i assuming i have to check the sdm templates, but i'm not sure if this resolves the issue. 
Here are the relevant config:
ASA Interface on the Switch:

interface GigabitEthernet4/0/43description ASA-inside LANswitchport access vlan 7switchport mode accessspanning-tree portfast
Client Interface on the Switch:

interface GigabitEthernet3/0/1switchport access vlan 2switchport mode accessswitchport port-securityswitchport port-security aging time 2switchport port-security violation restrictswitchport port-security aging type inactivitymacro description cisco-desktopspanning-tree portfastspanning-tree bpduguard enable


View 2 Replies View Related

Cisco Switching/Routing :: ASA 5510 Routing Specific Traffic To Inside Router

Nov 7, 2012

I have an ASA 5510, with Ethernet0 connected to Internet via a T1 line, Ethernet1 connected to LAN1, and Ethernet2 connected to LAN2.  LAN1 & LAN2 are independant, but share the Internet connection, via the T1 line.  On LAN2, I have another router that connects to the Internet, via a Comcast line.  I wish to route some of the traffic on LAN2 ( to the other Router, on LAN2 ( (connected to the Comcast line).  I have entered the following lines:

route inside2 1
route inside2 1
route inside2 1
I can trace the routes from the ASA 5510 (1st hop is to, but not from anything else on LAN2.

View 7 Replies View Related

Cisco Switching/Routing :: QoS Limit Specific VLAN Within Trunk 4506

Jan 25, 2012

Need to limit the amount of bandwidth a specific VLAN can use on a 802.1q trunk port. Situation is that we have a pair of Catalyst 4506 switches which have 802.1q trunk ports into a Checkpoint Firewall, this in turn is connected to a managed WAN router (to which I can't apply a QoS policy).If the 4506 was routing the traffic it would be easy to setup a class-map to match the IP traffic and then QoS the traffic, but the VLAN in question is trunked directly into the firewall (no L3/IP presence on the 4506 next hop for all clients on this VLAN is the firewall).What I need to do is restrict any traffic from this specific VLAN to 10Mbps on the uplink to the Checkpoint Firewall so it cannot impact the onward WAN.

View 1 Replies View Related

Cisco Switching/Routing :: ASA 5505 - Blocking Traffic To Specific IP Addresses

Sep 24, 2012

I inherited a Cisco ASA 5505 and am trying to piggy back the device off of an established Network.  Here is the basic layout: (Core Router - Handles DHCP/DNS) (ASA 5505 - Piggy backing off of Network)
192.168.40.x (ASA 5505 - VLAN)
I'm able to get onto the Internet without any problems.  Devices from the 192.168.10x Network can not ping the inside VLAN1 (192.168.40.x).  However, I would like traffic going from the inside VLAN to the Outside VLAN to be blocked, except for and  I've tried using ACL's but end up killing my Internet connection. is the default route and is how I get out to the Internet.  Is this possible?  Essentially, I'm trying to set up a small Network that guests can connect to.  The idea is that they can get to the Internet, but that is it. They can't get to internal resources on the 192.168.10.x Network
Here is the config:
ASA Version 8.2(1)
hostname ciscoasa
enable password EeCsulrpu.9LalEE encrypted


View 5 Replies View Related

Cisco Switching/Routing :: 3750-X Way To Get NetFlow Support Is To Install Specific Module

Sep 17, 2012

I've been researching the 3750-x Netflow support but I'm not 100% sure of how much support it has. From what I've read the only way to get NetFlow support is to install a specific module that provides NetFlow. I also heard about how it might support s-flow but I haven't found out for sure.

View 8 Replies View Related

Cisco Switching/Routing :: C6500 Filter ARP Answer On 802.1q Port For Specific VLan

Oct 10, 2012

I am trying to filter ARP answer arriving on a C6500 trunk port, for a specific vlan.Filtering conditions are:

- packet arrive from vlan ID x on the trunk (on only for this vlan ID)
- source MAC address = xx:xx:xx:xx:xx:xx

Thae aim is that the C6500 with never enter into its CAM table this MAC address.I looked at several methos like service policy or vlan filter, but no solution for the moment.

View 3 Replies View Related

Cisco Switching/Routing :: 2560 Create Dynamic VLAN For Specific Group Of Users

Feb 6, 2012

We have Cisco Cat4503 series L3 Switch and Cisco L2 2560 Series Switches, some of the users want to have a dynamic VLAN membership, and connecting with the network as mobile users,
can it possible and create dynamic VLAN for specific group of users.

View 6 Replies View Related

Cisco Switching/Routing :: 1433 - Span Port Configuration To Listen To Specific Traffic Only?

Nov 2, 2011

Is it possible to configure the span(switch port analyzer) port and restrict it to only listen to ingress and egress of TCP/1433 from the source port?

View 2 Replies View Related

Cisco Switching/Routing :: Multiple VLAN Routing Tables For 3750 Catalyst

Oct 24, 2012

I have a network with a Catalyst 3750 as the main switch and then some Catalyst 2960 switches that are plugged in to that. I have a server running windows server 2008 with a couple of virtual machines running in Hyper-V. I created 4 VLANS listed below and gave the 3750 the following IP Address.I would like the 3750 to only be configurable from VLAN 40 but currently every VLAN can connect to it, I noticed in the standard web page settings there was a setting for "Management VLAN" but it was set to 1 and would not let me change it, I kinda assumed that was for the management port in the back.-Now the tricky part, I was trying to set up routing between the VLANs and so far I have only been able to get a sort of "all or nothing" routing to work. I can turn IP routing on and add two or more VLANs to the routing and it works fine. But what I was hoping to do is create a couple of "junction vlans" that would only route to one or two other vlans. For instance, I wanted to create a VLAN 100 that routed to VLAN 20 and 30 but nothing else. I also want to route VLAN 1 just to VLAN 30, and so on. I am able to do each one of the cases but only one, it seems like the switch only supports one "routing table" am I missing something or is this just a limitation of the switch?

View 2 Replies View Related

Cisco Switching/Routing :: Catalyst 3750 Multi-cast VLAN Routing

Oct 28, 2012

I have a network with several catalyst 2960 switches and one catalyst 3750. I have created two VLAN and set up the proper routing and everything is working fine there. I have a client/server application that used multicast in the initial start up for the client to determine available servers, the issue is one of my clients is on a different VLAN then the server. I am able to route the multicast using MVR as long as both the server and the client are plugged into the 3750 by creating a static route, making the server a source port and the client a receive port. Unfortunately I need the client and the server plugged in to different 2960s. My question is how do I establish multicast routing between the two and perferably do it dynamically (always route multicast traffic from one VLAN to another).

View 2 Replies View Related

Cisco Switching/Routing :: Inter-VLan Routing On Catalyst 3750 Switch

Dec 17, 2011

I have been looking into this for a while and I can't seem to figure out why my 2nd vlan is not able to connect properly to the net.
My switch has 12 ports where my devices connects directly, they are all on Vlan 1 and they all work perfectly. on Port 12 I have a dlink router that is connected to a cable modem. the dlink router has an Ip address of
I created a second vlan (vlan2) and enabled dhcp relay on it. then I assigned port 9 on the switch to  (vlan2)my laptop which is connected to port 9 seems to get an ip address fine and able to ping only some devices on my network (vlan1) and is not able to go out to the internet.  I think it has to do with the routes. [code]

View 4 Replies View Related

Cisco Switching/Routing :: 3750 Inter Vlan Routing Configuration

Mar 24, 2013

In 3750 switch,I have configured intervlan routing.I have three vlans Vlan 10,vlan 20,Vlan 30 and I have assigned IP address for that Vlan.In vlan 10,I have connected one systen gigabitethernet 0/1 interface.From my system I am able to ping vlan 10 ip address but I can't able to ping other vlan ip address (vlan 20,vlan 30).Is it possible to up the protocol for all that time.

View 2 Replies View Related

Cisco Switching/Routing :: 3750 Private VLAN With Routing

Jan 1, 2012

I have a Cisco 3750 with private VLANS configured.. VLAN 2 is the "primary", VLAN 3 is "isolated" and VLAN 4 is "community".  This is all working correctly, however I now have the need to another VLAN called "production". I need the production VLAN to be able to reach all the private VLAN hosts (community and Isolated), and vice versa

View 2 Replies View Related

Cisco Switching/Routing :: 3750 - Public VLAN Routing?

Dec 8, 2011

I have a quick query which i need ratified before proceeding.  I have the following scenario -
Two Cisco 3750v2 switches with stackwiseISP allocated block of /26 (64 addresses)8 customers each with a VLAN and SVIInternet facing VLAN and SVIDefault route to ISP router Lets say the ISP has given me the network range (we'll assume this is routable on the internet for the purposes of this example) and a default gateway to the internet of within this range.  I have configured a public facing VLAN as follows -
VLAN 300
 int VLAN 300
IP Address
I have then created a default route as follows -
ip route
With this configured, the switch can successfully route upstream to the internet with no problems.  I have then moved onto the customers and depending on what service they have purchased, I have subnetted the range into smaller subnets.  See as follows -
Customer A -
Gateway IP -
Useable IPs -
 Customer B -
Gateway IP -
Useable IPs - -
This continues for each customer depending on how many IP's the have purchased.  I have then assigned these IP ranges to a customer VLAN and SVI as follows -
Customer A
 VLAN 10
 int VLAN 10
ip address

It is then up to the customer as to what equipment they use and how they NAT or firewall their internal networks.

View 5 Replies View Related

Cisco Switching/Routing :: 3750 MAC Table Missing For One VLAN

Jan 18, 2012

I have one VLAN on a 3750 where I do not see any MAC addresses even though it is in use.  This is an unrouted VLAN between a WLC on a port- channel /LAG and an access port to an ASA for guest traffic.  When I do a show MAC add I get nothing for VLAN 60 (guest DMZ) but all other VLANs seem to be OK. Spanning tree is not showing TC counters incrementing either. 
I also was told when put a port on this VLAN the laptop did not get a DHCP address form the ASA, but the wireless guest clients are working fine.  I can see the DHCP leases and ARP entries in the ASA and the ASA ARP in the WLC so some traffic is passing fine.  I'm not onsite right now so troubleshooting is all remote which limits some options.

View 4 Replies View Related

Cisco Switching/Routing :: VLAN On 3com 2952 And 3750?

Jul 1, 2012

I have setup both Vlans on 3com and cisco. but it seems they cant talk to each other.ive setup both on trunking mode?

View 6 Replies View Related

Cisco Switching/Routing :: 3750 No Spanning Tree Vlan

Feb 29, 2012

I have a 3750 switch which has the command 'spanning-tree vlan **'.  I am struggling to remove this command, as this particular VLAN is one I want to distribute across our network.I have so far, set the switch to VTP Transparent mode and removed the VLAN from the database, this removes the command.  If I then put the switch back to VTP client mode (or manually add the VLAN, while in in VTP transparent mode) then the command comes back.  Submitting the command 'spanning-tree vlan **' command has no affect.

View 1 Replies View Related

Cisco Switching/Routing :: VLAN Bridge With Catalyst 3750

Nov 8, 2012

I have 3 VLANs here that need to be on the same network segment.  They are going to be used by our Wi-Fi network (with Aironet APs), bound to 3 different SSIDs (as Aironet APs doesnt allow multiple SSID per VLAN), each one with a different authentication method and server.Is there a way to bridge those VLANs together with a Catalyst 3750 switch?  I tryed configuring an IP address on one of the VLAN interfaces, then configuring a bridge with the vlan-bridge protocol (Catalyst 3750 doesnt have the "ieee" bridge protocol type) and put all 3 VLAN interfaces on the same bridge-group, but it didnt work (even with "bridge x route ip").I also tryed configuring IRB bridging, with the 3 VLAN interfaces on the same bridge-group and an IP address on the BVI interface (the way I used to do with old 2600 routers).  Same result.(actually, I didint test to see if the interfaces are actually being "bridged", but I see neither of them can reach the router)

View 1 Replies View Related

Cisco Switching/Routing :: 3750 / VLAN Is Locally Shut

Apr 24, 2011

One of my VLANS on my 3750 gives a status of act/lshut. I've tried no shut commands on the interface to no avail. From my reading it seems like this means the VLAN is active but shut down locally.

View 8 Replies View Related

Cisco Switching/Routing :: VTP Traffic Not Seen On SPAN Port On 3750

Dec 12, 2011

Been dealing with a strange problem for several days now.  It started out with a problem that I thought was VTP related but ended up being something else.  I setup a span port on a 3750 that I am connected to that was mirroring the trunk connection coming into the switch.
Never saw an VTP traffic come across the connection but doing a sh vtp status indicated the traffic was arriving and getting processed.  When I found some debug commands (debug sw-lan vtp), I was also able to see the packets go between switches.  Seeing this issue concerns me that there is other traffic that isnt showing up during a span session.
I know that doing a span on a switch, especially using a trunk port as a source, isnt a good idea.  Since I didnt have a TAP at time, this was my only choice.  I have since borrowed a NetOptics TP-CU3 tap from a good friend and was able to confirm the VTP traffic was going across the trunk connection between switches.
All of my 3750's are running 12.2.55.SE.

View 8 Replies View Related

Cisco Switching/Routing :: Keep Traffic Local Between Two Sub-nets Using 3750-X

Nov 13, 2011

We have a remote office with a Cisco 3750-X switch with the IP-Services feature set connected via dark-fiber to a 6509-E at the corporate office. We plan on migrating the remote office to a new network (new acquisition) to subnet on VLAN 20 which has an existing  subnet of and we would like to run both in parallel using their existing switches (Dell) and the new 3750-X.
I’m curious as to the best way to keep the traffic local between the two subnets using the 3750-X and if necessary put the network on a VLAN. I thought about routing between the two networks via IP routing on the 3750-X but the new workstations default gateway is the 6509-E and existing workstations is a SonicWALL within the remote office. The default gateway for the new workstations can be moved from the 6509-E as a last resort.

View 5 Replies View Related

Cisco Switching/Routing :: Traffic Within 3750 Slow / But Fast Outside Of It

Jul 15, 2012

I have 2 new 3750g devices in a small environment.  switch1 acts as our collapsed core and has ip routing enabled, and is connected to a ASA 5510. There are 3 HP l2 switches connected to switch1 as well.   switch2 is simply a server switch.  switch1 and switch2 have a 2port etherchannel between them, and a vlan trunk carrying 4 vlan's.  traffic between any 2 hosts on switch2 (same vlan) are slow. (average 300Mbits/sec)  If I move one of those hosts to switch1, speeds increase by 3 times.  (average 900 Mbits/sec).  Additionally, traffic between any 2 hosts on switch1 are quick. testing is done with iperf as well as timing 1gig file transfers.
I don't see any errors or drops anywhere, and there are no other symptoms other than slow transfer beteween hosts on switch2. I just got 2 more of these 3750's to put in a 2nd site that we have, put a quick configuration on them, and have the same result.  Other than switch1 having ip routing enabled, the configs are pretty much identical.

View 2 Replies View Related

Cisco Switching/Routing :: 2960 / Traffic In Same VLAN Goes Up Trunk?

Feb 11, 2013

I have 2 hosts, 1 plugged in fa 0/21 in VLAN 101 and another in fa 0/22 in VLAN 101 on our L2 Cisco 2960.  If I try and transfer files from either host the gig 0/1 trunk port on the 2960 leading tot he 3750 fa 0/1 port hits 100mb (using a real time bandwidth monitor tool), but why?  This VLAN is on the same switch, why does it go one way up the trunk to the L3 3750 switch?  The L3 3750 is the VTP server and the 2960 is a client.  I would of thought the traffic stays local.  The 2 hosts don't even have a gateway set.To sum up the typology the 2960 and 3750 are trunked using a single cable.  The 3750 hangs of a ASA firewall using SVIs.Here is whatthe traffic looks like when copying a file between hosts (2gb file).
3750 L3 Switch (VTP Server)
  interface FastEthernet1/0/4
description Trunk to Cisco 2960 Gig 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate


View 6 Replies View Related

Cisco Switching/Routing :: EDS 316 / 208 - Network Don't Permit Traffic UDP In VLAN

Jul 17, 2012

I have problems in my Cisco network until I connected some Moxa devices.This Moxa are models EDS-316 and EDS-208
My principal trouble is the traffic UDP. Suddently the network don't permit the traffic UDP in VLAN where are connected Moxa devices.
During an hour the Moxa can send TCP traffic, but can't send UDP. If a Moxa device is unplugged from network, all devices connected to him can work offile from principal network, but if I plugg again the Moxa is like disable.
After one hour (more or less) the system restart all functions and work fine.I catch the logs from TXerrorsInPorts and all the ports where is connected a Moxa have errors all time.
I don't know which is the problem, but I think that problem is in negotiation from Moxa to Cisco.This is the configuration from a port where is connected a Moxa: [code]

View 1 Replies View Related

Cisco Switching/Routing :: Cannot Set Route-map On Interface Vlan In Non Default Vrf On 3750

Dec 12, 2012

Cannot set route map on interface vlan. which in non default vrf on Cisco 3750.IOS c3750-ipservicesk9-mz.122-55.SE.bin sdm prefer route in enable ip vrf users rd 200:0 route-target export 200:0 route-target import 200:0 interface Vlan201 description Users 1 ip vrf forwarding users ip address ip helper-address route-map fromuser permit 10 match ip address fromuser set ip next-hop When I enter "ip policy route-map fromuser" to interface Vlan 201 I heve the message:
% Remove VRF configuration from interface Vlan201 first

View 5 Replies View Related

Cisco Switching/Routing :: Catalyst 3750-X Not Showing VLAN As Active

Apr 14, 2013

I have installed a Catalyst 2960-S and a 3750-X-12S and I am trying to setup a VLAN 51 for some VoIP phones. I have added the VLAN as an interface on both switches, but the 3750 is not showing VLAN 51 as active when i do a show vlan. Also, it omitts showing Gi1/0/1 & Gi1/0/3 which are uplinks to 2960-S switches plugged in and working on VLAN1.
Catalyst3750SFP#show vlan
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/2, Gi1/0/4, Gi1/0/5


View 2 Replies View Related

Cisco Switching/Routing :: Configure Inter Vlan On 3750 Series?

Jun 25, 2012

I have 3750 series with GIBICs ports I want to create 10 vlans with its sub-net and enable all vlans to access internet.

View 4 Replies View Related

Cisco Switching/Routing :: 3750 STP Vlan 21 And 22 Root Bridge On 2 Switches

Feb 16, 2013

I config vlans 21-23 on 3750 A and B switches.I config B  switch to be Root Bridge for all vlansspanning-tree vlan 1,21-23, priority 4096 sh span tree on B  switch 3750B#  sh spanning-tree.

View 18 Replies View Related

Copyrights 2005-15, All rights reserved