Cisco Switching/Routing :: 800 / Use ASA To Configure All The Vlans And Intervlan Routing And Access Lists?

Jul 4, 2012

upgrading our small office network. We currently have about 75 employees with probably 125 devices on the network. I'd like to create about 10 vlans for the different departments and then configure intervlan routing as needed. Currently we have all unmanaged switches and it's just a huge broadcast storm on the network. We are upgrading our Cisco 800 router to an ASA5505 sec. Plus license. I need some recommendations on switches. Of course, this needs to be done as cheap as possible.... Is there a way to use the ASA to configure all the vlans and intervlan routing and access lists and use a cheaper switch to provide the access layer to hosts?

View 4 Replies


Cisco Switching/Routing :: How To Configure ASA 5505 For Intervlan With 2960L2

Oct 18, 2011

i have 2960 l2 switch connected to the ASA 5505. for some or the other reason i am not able to do intervlan communication. have done trunk mode on both ends on the switch as well as on the ASA and native vlan 1 allowed. the trunk is up up i am able to ping only the vlan 1 ip from the switch to the ASA for the vlan 2 i am not and similar for vlan 3.
 config on the ASA
ASA Version 8.2(1)
hostname ciscoasa


View 2 Replies View Related

Cisco Switching/Routing :: 3560 - Access List On InterVLan Routing

Dec 11, 2012

I implemented access list on cisco 3560 switch but it never works. I want to block access from network B to Network A and allow from Ato B
Network A.
Network B
The configuration is
interface Vlan1
description Data VLAN


View 14 Replies View Related

Cisco Switching/Routing :: Object-groups In Access-lists On 3750X?

May 29, 2013

I have started to use ip extended access-lists on several 3750X-switches to filter inbound and outbond traffic on the VLANs. But it seems that the use of object-groups is not supported, is this correct? Is it really no way to group different ip-addresses into groups and then use these groups in the access-lists?
I am running sw version 15.0(1)SE2.

View 1 Replies View Related

Cisco Switching/Routing :: Outbound Versus Inbound Access Lists On Catalyst 3750X?

Mar 17, 2013

I want to configure accesslists on my Catalyst 3750X-switches to protect different VLANs/networks. Any best-practices about inbound versus outbound accesslists? In my head it is more readable and easier to understand the config when accesslists are assigned outbound on the VLAN to protect instead of assigning them inbound on all possible source-VLANs. But of course, from a performance point-of-view it is better to use inbound access-lists to avoid un-necessary routing etc.

View 1 Replies View Related

Cisco Switches :: Configure SG300 Intervlan Routing?

Apr 18, 2011

Some tips and trick on how to configure and sg300 for intervlan routing.
I already have the switch set up for layer 3 I already set up multiple vlans and each vlan has a ip interface setup with the desired subnet I see the local routes set up in the static routing page.
I cannot seem to get from one subnet/vlan (I am using one subnet for each VLAN) to the next.

View 6 Replies View Related

Cisco Switching/Routing :: 1921 Routing Access From Mixed IP Ranges Between VLANS

Jan 23, 2013

I have the following config using a Cisco 1921.  I am trying to get devices on the the native VLAN to get internet access via the gateway x.x.x.73.Any thing being routed from the other Vlans 15/20/30 can get access, but nothing from an internal IP address.  Is there something I am missing.
The Xs replace the same 3 octets for each interface.I am trying to route from VLANs 15/20/30 to see VLAN 5.  I have tried a few things, in terms of adding extra ip routes, but can't get anything to work.  Each of those Vlans have another router on the other side of them, which I have also tried adding ip routes too, but nothing.  One of the routers (Vlan15 is a Draytek 2830). [code]

View 5 Replies View Related

Cisco Switching/Routing :: Configure VLANs On SF 300 To Work With 2960S

Sep 21, 2011

make a couple of SF300 switches to work properly with a C2960S-48TS-L that acts as core switch/basic router. I can't seem to figure out how to assign VLANs correctly in trunk and access mode on the SF300. The 2960S are a no brainer with IOS commands but the webgui in the SF300 is a pain.
I've configured the 2960S with 3 VLANs and I would like to have the SF300 switches connect to the C2960S-48TS-L through VLAN trunk and then configure the ports on the SF300 switches to belong to the assigned VLANs of my choosing. I would also like to have all the SF300 switches management interface in VLAN 50.
I've partially described the enviroment below.
Data                  VLAN 10:
Management      VLAN 50:
Voice                 VLAN 100:   


View 5 Replies View Related

Cisco Switching/Routing :: 3550 Ping Each Other When Configure Ipv4 On Both Vlans

Mar 5, 2013

I have problem with IPV6 connectivity, i have two Cisco 3550 switch and they are connected over a trunk link. The ios is c3550- ipservicesk9-mz. 122- 44.SE6 , I have configured vlans on both switches and i numbered one vlan to vlan 91 ,they can ping each other when i configure ipv4 on both vlans so trunk link is functional, but when i m using IPV6 they can't ping each other!! they can only ping their own ip address not each other. [code]

View 11 Replies View Related

Cisco Switching/Routing :: C3750 - How To Configure 2 DHCP Servers For Two User Vlans

May 1, 2012

I can't seem to find any info on how to configure 2 DHCP server pools on a C3750, to use with 2 user vlans. The purpose is that users in vlan 1 should get an IP address from DHCP server1, and users in vlan 2 should get an IP address from DHCP server2. Both DHCP servers are configured in a stack of C3750 switches, which acts a a L2 switch.

View 2 Replies View Related

Cisco Switching/Routing :: Configuring Intervlan Routing Between 2801 And HP Switches?

Aug 5, 2012

I'm trying to configure intervlan routing between a cisco 2801 router and HP/Amer switches.  Using int fa0/1 and subinterfaces I was sure I had it configured correctly, but I cannot ping the default gateways when I place a host in a particular vlan.  Below is what I have configured.
HP switch - port 9 connects to fa0/1 on 2801
 ip default-gateway
trunk 9 Trk1 trunk
trunk 10 Trk2 trunk - to another switch


View 4 Replies View Related

Cisco Switching/Routing :: InterVlan Routing With 3750 And 2960 Switches?

Nov 21, 2012

I am using a 3750 as a default gateway for multiple Vlans on a few 2960 switches. The trunk lines are configured and working and I have assigned ip addresses to each of the Vlan interfaces on the 3750. My issue is that I can only ping the ip address on the Vlan interface of the 3750 if I have a working computer plugged directly into the Vlan on the 3750. I only have 3 vlans on the 3750 that have hosts directly connected (vlans 2, 10 and 40) the other vlans ( 20 and 70) don't have any clients plugged into them on the 3750 but the hosts reside on 2 different 2960s that connect via trunk ports. How do I keep the vlan interface on the 3750 switch pingable when I don't have hosts directly connected in that vlan on the 3750? (yes, I have enabled ip routing on the 3750)

View 5 Replies View Related

Cisco Switching/Routing :: About Intervlan Routing On Catalyst 3750 Switch

Apr 16, 2012

I have been looking into this for a while and I can't seem to figure out why my 2nd vlan is not able to connect properly to the net. My switch has 12 ports where my devices connects directly, they are all on Vlan 1 and they all work perfectly. on Port 12 I have a dlink router that is connected to a cable modem. the dlink router has an Ip address of,I created a second vlan (vlan2) and enabled dhcp relay on it. then I assigned port 9 on the switch to  (vlan2),my laptop which is connected to port 9 seems to get an ip address fine and able to ping only some devices on my network (vlan1) and is not able to,go out to the internet.

View 3 Replies View Related

Cisco Switching/Routing :: ME3400 Boot Loader - Intervlan Routing

Sep 5, 2012

On cisco and am having some issues with intervlan routing. I have followed the vids and manuals but just can seem to get this working. I have the following network lab set up.
Vlan 10 =
Vlan 20 =
ME2400 firmware
ROM: Bootstrap program is ME340x boot loader
BOOTLDR: ME340x Boot Loader (ME340x-HBOOT-M) Version 12.2(35r)SE3, RELEASE SOFTWARE (fc1)

View 4 Replies View Related

Cisco Switching/Routing :: InterVLAN Routing On Switch 3750X?

May 22, 2013

my company pay a switch 3750 X. WS-C3750X-24T-E. It uses IP services basically but I failed to configure InterVLAN routing. why interVLAN routing doesn't work on my switch?

View 10 Replies View Related

Cisco Switching/Routing :: 2600 / 3550 - InterVLan Routing

Dec 2, 2011

I've been working with these two Cisco devices in my home off and on for several months now but I just can't take it anymore, I'm about to throw them away and go back to Linksys router.
I have a Cisco 2600 Router with only one Ethernet card in it so I have to trunk from my 3550 Switch to that device.  I'd like to have my ISP and all users plug into switch and all trunk back to the router's sub interfaces. Currently, I have started over...again, and am unable to simply get the router and switch to ping each other if I put sub-interfaces on the router.  See my configs:
2600 ROUTER:
Router#sho run
Building configuration...
Current configuration : 555 bytes

3550 SWITCH:
Switch#sho run
Building configuration...
Current configuration : 2302 bytes
version 12.2
Port F0/24 is in VLAN 1, as are all ports but Port F0/1 which is my desktop PC. I mocked it up in Packet Tracer and it works just fine.  This is just a simple setup and I'm making sure I can ping between switch and router before I move to each next step.

View 40 Replies View Related

Cisco Switching/Routing :: 5520 Configure Traffic Flow Between Computers Inside VLANs And Routed Port

Jul 7, 2012

How to configure traffic flow between  computers inside VLANs and a routed port? Here is the setup details:
1. Switch 3750-X
2. VLAN 100 - ( SVI IP address /24)
3. VLAN 200 - ( SVI IP address /24)
4. routed port gi1/0/48 (IP address /24). Note: this port is directly connected to a firewall ASA 5520 port IP /24
Ip routing is enabled on the switch and inter vlan traffic is flowing ok. I can ping the routed port gi1/0/48 from  any computer connected in the VLAN 100 or 200. For example computer with IP can ping the routed port Switch can ping firewall port and the 'sh ip route' command shows the network /24 as directly connected network.
any computer in the two VLANs CANNOT ping firewall ASA port   Is it because inter VLAN routing does not work with a routed port on L3 switch? I looked up fallback bridging, but it is meant for non IP traffic.The goal is I am trying to set the ASA port as an internet gateway for VLANs. 

View 4 Replies View Related

Cisco Switching/Routing :: SF300-24p / Access Internet On VLANs

Mar 16, 2013

i have one SF300-24p switch where i setup some Vlans and echolife hg8245 ONT router to access internet. the diagram is the following
VLAN1 (Subnet of users) -----> Switch SF300-24p 
VLAN2 (Subnet of users) -----> Switch SF300-24p 
VLAN3 (HG8245)  -----> Switch SF300-24p
 VLAN4 (Servers) -----> Switch SF300-24p 
i want to control access to internet on VLAN1 and VLAN2 (access on VLAN3), while providing access to VLAN4.My problem is in connecting to internet, i can't find a way to "route back traffic to VLANs 1 and 2 since HG8245 don't seem to provide proper static routing ON LAN interface. Maybe without resorting to changing the HG8245 router ?

View 1 Replies View Related

Cisco Switching/Routing :: 3550 / VLans Not Able To Access Internet?

Jun 12, 2012

We have cisco 3550 switch i have configured 3 vlans in this switch vlans are not able to accessing internet

View 7 Replies View Related

Cisco Switching/Routing :: SG300 No Internet Access On New VLANs

Apr 16, 2012

I am trying to setup VLAN's in the company I work for and I am almost there but missing the part when the internet works.I have an SG300 as a L3 Router IP have created VLAN20 and VLAN40 Assigned VLAN20 and VLAN40
The static routes have been created and a default router going to the Sonicwall firewall at 24 is configured as Untagged VLAN1, Untagged VLAN20 and VLAN40 in trunk mode and going to the Sonicwall NSA 2400. [code]
Working to move all 192.168.0.x network off of VLAN1 and move it a management switch.I have DHCP helper on pointing to the DHCP server.Both VLAN's once the DHCP server is configured to Gateway can get an IP from the correct subnet either 192.168.2.x or 192.168.4.x
All PC's are getting a GW IP of pr test PC's on both VLAN's can ping each other and any server with the correct GW.When I try to ping or open a web page and try it times out.

View 3 Replies View Related

Cisco Switching/Routing :: 6509 - Configure Multiple Dhcp Pools On Switch For Multiple VLANs

Mar 9, 2010

Is it possible to have multiple dhcp pools for multiple VLANs? The switch is a 6509 and/or 4506 catalyst. I don't want to use server-based products.

View 5 Replies View Related

Cisco Switching/Routing :: 2900 Will Work As Access Port For More Than Vlans

Mar 27, 2012

I have came across this topic, and I am wondering if this images can be uploaded to any 2900 series switches or not, and if this will work as access port for more than vlans. URL...

View 2 Replies View Related

Cisco Switching/Routing :: 6509 / Restrict Access To Sensitive VLANs?

Jun 4, 2012

We have a network of 30 VLANS and currently all the vlans have access to everything. We are using Cisco 6509 switch for Layer3 routing.I would like to prevent some VLANs accessing the server VLANs. How can i resrict access to the server VLANs? Do i need to implement access-lists on the 6500 switch? or do i need to create VLANS on the firewall so that all traffic i filtered?

View 3 Replies View Related

Cisco Switching/Routing :: Sharing Internet Access Through A 3550 With 2 Vlans?

Apr 27, 2013

They have a locked Cisco Router which is from the ISP and its confed on a fa 0/0 interface to share Internet access on the network. The ip on that interface is and i tried it with a PC (set my personal ip to .218 and entered their dns info ( and it is working. The question is now. My friend found a 3550 laying around and since the ISP wont let them conf their router he wants to use the 3550 to create 2 vlans with internet access and without access to eachother. Vlan 10 for the desktops and Vlan 20 for the wireless (Moving on to some netgear wireless switches) How would you configure the 3550 for this to work?

View 23 Replies View Related

Cisco Switching/Routing :: 2950 / Vlans And Internet Access Sharing?

Apr 5, 2013

i am trying to set up a cisco 2950 with a vlan to seperate all of the pos machines on the network (4 of them) from all other machnes in the building (3 hard wired and wi-fi).  i was going to use vlan 1 as a trunk to allow internet access to go from fa0/1 to both vlans (vlan 10 and vlan 20).  i have read things about the acl having an explicit deny at the end, so i'm thinking that is my  problem.  i am testing it at my house before deploying it to the network.  i have 1 laptop setup with an ip of, and the other is .60.  my router is  i have the ethernet from the router plugged into fa0/1, the 1st laptop on fa0/2 and the other at fa0/3. before i set the vlans up, i checked the communication by just plugging them in and trying to ping, they could both ping each other, the router and  when i finished setting up the test vlans, they could not ping each other(what i wanted) and laptop 1 can ping the router, and  laptop 2 cannot ping anything. 
the only thing i did was create vlan 10 and 20, set port fa0/2 to vlan 10 and no sh, fa03 to vlan 20 and no sh, fa0/1 to vlan 1 and no sh.  then i did switchport mode trunk on fa0/1, and switchport native vlan 1.  this seems to be how i was supposed to do it, but it's been a while since i have worked with switches.  i'm sure it's simple, but after searching the internet and poring over my cisco books for 5 hours, it is turning out not to be the case. here are some details:

greenhouse#sh int fa0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q


View 10 Replies View Related

Cisco Switching/Routing :: 3650 / 5505 / 1252 - Access Between VLANs

Dec 22, 2012

I have set up a scenario for a small business and have some questions about how to manage the access between the VLANs. Is there is a better / another way to do it. See the attached picture for the topology / info.
My question is:  
My switches is set up with x numbers of VLANs and a routed port (no switch port) to the ASA for internet connectivity. How is the best (or only??) way to manage the access between the VLANs?  Is it ACL's on the switch?
And by "managing access" I mean VLAN 50 (public WiFi) only have access to the internet, only management servers have access to management VLAN, Client VLAN only have RDP access to server VLAN and so on. Is there any way to do this in the ASA (or add another (gigabit) router to the topology)) or it the only way to have lots of ACL's on the switch itself? I have thought about "router on a stick", but then I imagine there will be a bottleneck between the switch and the ASA?  

(Equipment is 2 x 3650G, ASA5505, AP1252 - see attached file).         

View 3 Replies View Related

Cisco Switching/Routing :: Internet Access For 3550 Switch VLANs?

Feb 22, 2012

I have a small cisco switch cluster (seven different 2924, 3524cisco switches) with 3550 as a cluster control which does all the inter vlan routing that works fine.
This cluster is in semi production PBX interop testing lab. This is a closed network without internet access and not connected to our corporate network.However now I have to add this capability so some equipment in the lab can get Microsoft updates over the internet.
I've created a port on a 3550 (fa0/19) and connected it to another network that has internet access. It picked an ip address and when I'm logged in to the 3550 I can ping hosts on the outside network. However I can't ping any hosts on that network from any hosts that are connected to my vlans.I've tried a few different things, but still can't make it to work.
Here is a short version of my 3550 configuration:

version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption


View 13 Replies View Related

Cisco Switching/Routing :: 3750x - Denying VLAN Access To Other VLANs

Mar 18, 2013

I've got a 3750x stack set up as my core switch (only a small-ish environment) - I'm shortly going to be deploying an enterprise wireless network with Corporate and Guest SSID's. I'm going to be putting all traffic from the Guest SSID in VLAN 244, and don't want it to have access to any of the other VLANs (1 (Legacy Eqpt), 4, 8, 12, 16, 20, 24, 28, 32, 248 & 252).
IP ranges for all the main VLANs are:
1: 10.0.0.x/22
4: 10.0.4.x/22
8: 10.0.8.x/22
12: 10.0.12.x/22
16: 10.0.16.x/22 etc etc (you get the pattern)
I'll probably give Guest traffic (VLAN 248) the IP range 192.168.10.x/22 (not because I NEED that many addresses, but it's easier for everyone to remember/understand if I keep the subnet masks the same all round). However I also have a CCTV VLAN (252) which already has the range 192.168.0.x/24, which some people in other VLANs WILL need access to.
So my question is: What is the syntax for the ACL on my 3750x (IP base - 15.0.2) to prevent traffic from VLAN 244 gaining access to any of my other VLANs. I'm making a broad assumption here that a layer 3 switch is perfectly capable of supporting that function? I need ALL the syntax for setting up ACL's - I've never done it before
My gateway device by the way is, and I do have inter-VLAN routing set up on the core switch (obviously).

View 3 Replies View Related

Cisco Switching/Routing :: 3560 - Vlans Unable To Access Internet

Feb 23, 2012

I have configured vlans in 3560G switch but vlans notable to accessing Internet

View 6 Replies View Related

Cisco LAN :: C3750 InterVLAN Routing - No Internet Access For Client Switches

Oct 11, 2012

I have a test setup of a C3750 stack as a core and some 2960's as access switches.[URL] - The switches at the bottom is the new network (VLANNED). The switches on the left is the current production network ( From the C3750 to the router is a /30 network.
There will be 6 VLANs but at the moment I have one configured. VLAN50 - From the C3750 I can ping my current production network, internet, other VLANs in the testsetup, ... Everything.From the C2960 I can ping other VLAN's, reach the gateway, reach the router, reacht the currenct production network. But I can't reach internet. I've configured "ip default-gateway" on the C2960. C3750 relevant config is down below.How is it that I can reach other networks connected to the router and not internet from the access switches? I'm just trying to ping
ip routing
interface GigabitEthernet1/0/1
no switchport
ip address


View 5 Replies View Related

Cisco Switching/Routing :: 6509 Switch To Restrict Access To Sensitive Vlans

Feb 20, 2012

We have a network of 30 VLANS and currently all the vlans have access to everything. We are using Cisco 6509 switch for Layer3 routing.I would like to prevent some VLANs accessing the server VLANs. How can I restrict access to the server VLANs?Do i need to implement access-lists on the 6500 switch? or do i need to create VLANS on the firewall so that all traffic i filtered ?

View 9 Replies View Related

Cisco Switching/Routing :: 3560 Extend VLANs Out To Remote Access Clients

Mar 31, 2013

I am not sure if what I am trying to accomplish is possible. On my internal network I have the following VLANs setup (102, 104, 106) and they map one to one to a subnet (ie: 102 =, 104 =, etc).All interVLAN routing is done on a 3560 via vlan SVI. Connected to the 3560 via a routed port is a ASA 5510. The routed port has IP and the ASA interface on the other side of that routed port has IP I use 802.1x on the wired network to assign users (based on their department) into a specific VLAN. I want to extend this concept to Remote VPN access. Therefore I setup multiple Group Policies (policy is applied based on an LDAP attribute) where each policy defines a different DHCP scope. This has successfully allowed me to login wtih different users who get assigned to different Group policies and they obtain the correct DHCP IP address from the internal DHCP server (ie: an engineering person logins remotely and gets an IP in range). However the issue (and as I was planning this out I knew this would come up) is that traffic can be routed out from the VPN client to its destination but there is no return path.

View 3 Replies View Related

Cisco Switching/Routing :: 2911 / 2960S - Multiple VLANs With Different Internet Access

Feb 17, 2013

We need to give differentiated internet access to three VLANs. Each one of this VLANs is used for totally different purposes, so traffic between the VLANs is not allowed. Each VLAN has its own internet access provided for the data center using one fast ethernet connection.

We're thinking about using cisco 2911 for Internet access, VPN and firewall. I suppose that best option for VLANs is using Catalyst 2960S or a swithing module for the 2911, but these two options are too expensive for us. We're thinking about using swtiches from the SB series (maybe a SG-200).

We're totaly newbies to VLANs so we have many doubts. This are our questions:

1) The 2911 has three on board ethernet interfaces; we have three VLANs and three internet connections, so we need to use HWICs to get three more ethernet ports. That's right?
2) We need three HWICs or there is some kind of HWIC with more that one ethernet interface?
3) The routing solution is to assign static routes in the 2911 for each interface connected to a VLAN through a 2911's interface connected to internet?
4) Simply connecting three different router interfaces with three different switch ports, each one of them assigned to one of the three different VLAN, are we going to get internet access for all devices in those VLANs? or do we need to configure something else like trunking, VSIs...?
5) Can we achieve our goals using the SG-200 switch?
6) We have the chance to use older routers, is this possible? We're specially interested in knowing if a 1841 or a 2801 router could be used for this setup.
7) This is not a production environment so we can use refurbished equipment.

View 4 Replies View Related

Copyrights 2005-15, All rights reserved