Cisco Switching/Routing :: Vlan Bridging On ASR1001?
Mar 25, 2013
I have following requirements to implement on cisco asr1001 router.
1.G0/0/0 and G0/0/1 interfaces are connected to a swith through trunk. Multiple customers are will be using this trunk interface . Each customer will have subinterface with dot1q tag.
2 I want both sides of the ASR1001 to be in same segment .
3 If above two is possible I would like to implement shaping on each customers sub-interface level
is above implementation is possible on asr1001. configration and ios information. I found a technology called EVC . but I am not sure is that the one suited for me.
I am trying to have F4 (the WAN interface) bridged to a VLAN interface. I have put my VLAN interface and my F4 in the same bridge-group, set an IP in the BVI Interface, and made sure that VLAN was properly trunked and configured on one of the router's switch ports
In other words, I need F4 to be treated as a switchport in access mode on my VLAN 10.
To enable netflow export on ASR1001, do i need the firewall feaure license or not ?Docs are not really clear, NBAR requires FW license, but i am unsure about Netflow?
I am trying to bridge the traffic(including different vlan traffic) from rtrA to rtrB using "bridge-group" functionality.I achived the same using a 7200 using the below configuration. [code] When I tried the same using 7600 router ping failed between rtrA and rtrB. Then from the documents it seems "bridge irb" is not supported in 7600.Is there any other way we can achieve the same fuctionality ( eg: using switchport also fine) ?
NETWORK 1:EOC connection fro ISP going into a router (not the RV042) with a static WAN address from ISP. This router is hooked up to a switch that all the computers are connected to. All the computers on this network are using 192.168.1.x addresses. Most of these addresses are static, but the router is running DHCP in case we hook up temporary computers like laptops or client machines to this network.
NETWORK 2:DSL connection going into a router (not the RV042) with a static block of IPs from ISP. (8 IPs, 5 usable for the WAN interface, 1 static IP is being used for WAN interface). This router has a VPN connection set up for remote access to the linux machines on this network. This router is running DHCP on the LAN interface for this network with addresses 172.16.1.x. All the computers on this network are tied together with another switch, completely seperate from the 192.168.1.x network switch.
PROBLEM:We needed computers on the 192 network to be able to access computers on the 172 network. Someone decided to just run a cat 5 cable from the 192 switch to the 172 switch (not the routers, the switches). This "worked" - badly. Appearently there is a DHCP conflict (or something else going on) that was causing the router on the 172 network to try and assign addresses to the 192 network computers, and it was also "resetting" a connection about once an hour. This crashed our server on the 192 network. I disconnected that cat 5 cable between the two siwtches, and now each of the two networks are working properly, but they are now completely isolated from one another.
I need to create a bridge between the 2 networks so that machines on the 192 network can access machines on the 172 network while filtering out DHCP broadcasts from either network router to the other network. (I may need to filter out other protocols as well, but don't know yet.)So, I see 3 potential ways of doing this but don't know if they will work:
1) Can I just set up multiple subnets on the LAN interface of the RV042 and just run 2 cat5 cables from each switch on the two networks to the LAN ports of the RV042?
1a) If I do set up multiple subnets on the LAN interface of the RV042, do I need to assign the two ports to different VLANs? (I don't see any way to set each port to a specific IP address.)
2) Can I set up the 2 WAN ports on the RV042, one static for each network, and will the RV042 route traffic from 1 WAN port to the second WAN port?
3) Is there some other way I should consider setting this up?
Finally, someone mentioned that once I get the RV042 set up correctly as a bridge, I will need to route 172 addresses on the 192 network to the 192 interface of the RV042 via the DHCP router on the 192 network, and conversely, I will need to route 192 addresses on the 172 network from the DHCP router to the 172 IP interface of the RV042. I think this will be easy enough to set up in each of the DHCP routers...
I currently have a 2811 and a LAN setup via a sub-interface FA0/1.3 and using a HWIC-AP I have a sub-interface dot11radio 0/1.5. I have them setup to work and surf the inet great, but I have recently been overly annoyed with the fact that the wifi cannot access windows shares on desktops and visa versa with the laptops.
The trick to make this happen is currently they are not on the same subnet. I know the answer is bridging the interfaces but when I do this using the simple commands:
bridge 1 protocol ieee interface x & y bridge-group 1
Although what should be simple has failed (good thing I tftp'd my working config). Here is my current configuration.
interface FastEthernet0/1.30 encapsulation dot1Q 30 ip address 192.168.3.1 255.255.255.0
I have a network where if an end user attaches an hub to the network, or rather one of those cheap unmanaged 8-port mini-switches and then plugs the two ends of the same cable into two ports of that mini-switch, all the network goes down. Loops are generated and many uplinks are shut down in err-disable state due to the loopback reason.
I know I could discourage the use of those mini-switches using port security. I even have NAC (cisco) deployed on the network, but there are cases where that mini-switches are allowed by the managment.In those cases, is not possible to exactly know wich hosts (mac addresses), and even how many of them will attach the network concurrently.As I know, they could even chain many mini-switch one to another. Of course, when even a single mini-switch is allowed on the network, it raises as a security hole.
Is there a way to allow the use of those devices without the risk of network outages? Some STP protection method? The best would be to have the Cisco access switch to get aware of the loop on its affected switchport (where the mini-switch is attached), immediately shutting down that port (to avoid loops on the network) and maybe sending an SNMP trap or a syslog message.
We are using Cisco Catalyst 2950 and 2960 for our access layer.
I need to bridge 2 subinterfaces; F0/0.301 and F0/0.302 on a single router.The router interfaces with a Cisco 2960 (LAYER-2) switch.QUESTION is, does a Cisco router support bridging on subinterfaces on the same physical interface?Currently this is NOT operational Spaiing-tree on F0/0.301 and F0/0.302 is down, switch side is forwarding for both Vlans.show ip interface brief shows up/down status of F0/0.301, F0/0.301 and BVI6 is down/down?
: SETUP: bridge irb ! ! Interface F0/0 no ip address
I have faced a problem with configuring Cisco 3750G series switches as Sever farm switches with redudance.
servers have 2NIC (1GBps) and both are bridged for redundant connections.In both switches all ports get green coluor except one port on Secondary SW. I saw some Spanning tree block port status on that switch.when i type Show cdp neghbor command on switch i can see other switch through a server connected port. Also Spannig tree root bridge election is occured through that port . Simply i need to configure both switches to pass traffic through there uplinks them selves.. but it seems like Secondry switch pass its traffic through primary switch ( i think according to STP ) usinginterconnection of bridge port of a server. [code]
I have a Cisco 2801 with a 4 port Layer2 switch card installed (HWIC-4ESW).
How do I bridge Ethernet0/1 to the 4ESW so if you were to plug a computer into the 4ESW, it would be on the same network as Eth0/1? see my config below:
interface FastEthernet0/1 description Internal Interface ip address 10.1.2.1 255.255.0.0
We have a customer that is relocating thier headquarters. They have a temporary requirement to bridge multiple vlans or a router T3 link to the new location as they cannot change the IP subnets. Setup is 3560 switch connecting to a 3845 then T3 to remote 3845 and 3560. I need to bridge multiple VLANs. I have seen a good example on how to do it over sonet but I don't see how to translate that to an HDLC or Frame Relay encapsulation for the T3 Link.
I'm a little stuck with a 4400 7.0.220.0 + RAP 1550 + MAP 1260 Ethernet bridging issue. I'm using the VLAN tagging functionality and I'm finding that periodically a VLAN that I've tagged on the MAP will deregister from the backhaul and stop passing traffic. If I go into the Mesh tab on the MAP, select the wired interface, remove the VLAN from the list of tagged VLAN IDs and then add it right back to the list, its starts passing traffic again
Between our hosting and a customer we have an extended vlan, traveling on a fiber, between two cisco 3560 switches.The thing is, that we want to create one or more vlans inside that extended vlan, in some way if possible?
I have two networks at two sites with a dot1q trunk between the two L3 switches at both sites (no routers involved)
SITE A - Cisco 3750 L3 - VLAN ID 50 10.10.50.0/24
SITE B - Cisco 3750 L3 - VLAN ID 50 10.20.50.0/24
I would like to extend the SITE A VLAN to SITE B so that I can move hosts from SITE A to SITE B without needing to change their IP address but the vlan ID is already in use. Obviously the easy solution is to change the VLAN ID for one or other of the sites but both sites contain hosts that run 24/7. Is there a way to join two VLANs with different IDs together.So for example I create a new VLAN 60 at SITE B and associate it with VLAN 50 at SITE A.
but on interface gi 1/0/1 i want to have data from vlan 10 tagged as VLAN 20. At this time i have solved this issue very primitively
I have set up gi 1/0/2 as int mode acces, acces vlan 20 and i have connected gi 1/0/2 with gi 1/0/3 with eth cable. int gi 1/0/3 is switchpor mode acces, switchport acces vlan 10
I have a 3750G switch in my production network that only has VLAN 1 on it. All ports are in a default state and VLAN 1 is disabled. The switch is passing traffic but shouldn't having the default VLAN shut down cause the ports not to pass traffic? If I start to create VLANs will that cause the switch to stop passing traffic?
I am trying to setup a L2tpv3 VLAN-to-VLAN tunnel.My setup has two Cisco 890 router with Cisco IOS Software version 15.0(1) M4. These routers are connected directly on FastEthernet port 8.
One linux machine is connected on FastEthernet port 0 on each router. The two linux machines are on same vlan. I am trying to establish a vlan-to-vlan tunnel between the routers and send traffic between the linux machines.
I followed the case study 11.4 from [URL] and configured the l2tp-class and pseudowire-class. However, the vlan interface configuration is different on 890 router.
We have a low bandwith (15-20 Mbit/s) to the ASA from our Client vlan. If i connect the Client to the same vlan as the ASA is, the bandwith (90 Mbit/s) is good.
And we have following error message in the log from the switch:
%PLATFORM_UCAST-4-PREFIX:
One or more specific prefixes could not be programmed into TCAM and are being covered by a less specific prefix, and the packets may be software forwarded I first get the idea that the switch is overloaded with router traffic. Thats why i assuming i have to check the sdm templates, but i'm not sure if this resolves the issue.
I have got a PC at work (Windows XP Pro SP3) that is on two networks with the IPs 10.20.30.167, subnet 255.255.255.0 (internet enabled) and 10.0.0.20, subnet 255.255.255.0 (no internet). On the 10.0.0.X network there is a gateway with the IP 10.0.0.200 allowing access to another network; 192.168.60.X, subnet 255.255.255.0 (no internet). I have added the route on my work PC to access the 192.168.60.X network via this gateway and I can access all PCs on all three networks from this PC.Now, I am using LogMeIn Hamachi so that I can access the networks at work from home. The PC at work is the 'gateway' PC on the Hamachi network. When installing Hamachi it created a new network connection and bridged this connection with my 10.20.30.167 network adapter to allow access to the 10.20.30.X network from an external PC when connected using the Hamachi VPN connection. I have manually configured my Hamachi connection on my PC at home to the IP 10.20.30.169, subnet 255.255.255.0, with the default gateway set to 10.20.30.167. I can ping all computers on the 10.20.30.X network from my PC at home.
I then added a route on my PC at home for 10.0.0.X to go via 10.20.30.167 (the 'gateway' on the Hamachi network). I also enabled IP forwarding on the 'gateway' PC (my PC at work). I can not ping any PC on the 10.0.0.X network from my PC at home apart from 10.0.0.20 (the other NIC in the Hamachi gateway PC) and 10.0.0.30 (another PC on the 10.20.30.X network that is also on the 10.0.0.X network).Now, with IP forwarding enabled on the Hamachi gateway PC I would assume after adding the route on my PC at home for 10.0.0.X traffic to go via 10.20.30.167 that I would be able to ping all PCs on the 10.0.0.X network...I also tried adding a route on my home PC to send all traffic for the 192.168.60.X network via 10.20.30.167 which has a route via 10.0.0.200 to the 192.168.60.X network, but this also did not work.I then tried adding the 10.0.0.20 network adapter into the network bridge that the Hamachi connection made, also keeping both IPs (10.20.30.167 and 10.0.0.20) on this network bridge by adding them into the 'IP Settings' in the 'Advanced TCI/IP Settings'. I also added the 10.0.0.200 gateway for good measure. I still cannot ping any PC on the 10.0.0.X or 192.168.60.X networks from my PC at home.
I have also added the route to the 10.20.30.X network on a PC on the 10.0.0.X network to go via 10.0.0.20 and tried pinging a PC on the 10.20.30.X network but this also has not worked. Also setting the default gateway on a PC on the 10.0.0.X network to 10.0.0.20 does not allow this...Surely bridging the networks 10.20.30.167 and 10.0.0.20 on my work PC would allow another PC on the 10.0.0.X network to access the 10.20.30.X network after adding the route or setting 10.0.0.20 as the default gateway?
Any "best practices" or recommendations on how to migrate from a fixed router (3745) to vlan routing on Catalyst 4507 switches in order to minimize the disruption to the network.
I have a network with a Catalyst 3750 as the main switch and then some Catalyst 2960 switches that are plugged in to that. I have a server running windows server 2008 with a couple of virtual machines running in Hyper-V. I created 4 VLANS listed below and gave the 3750 the following IP Address.I would like the 3750 to only be configurable from VLAN 40 but currently every VLAN can connect to it, I noticed in the standard web page settings there was a setting for "Management VLAN" but it was set to 1 and would not let me change it, I kinda assumed that was for the management port in the back.-Now the tricky part, I was trying to set up routing between the VLANs and so far I have only been able to get a sort of "all or nothing" routing to work. I can turn IP routing on and add two or more VLANs to the routing and it works fine. But what I was hoping to do is create a couple of "junction vlans" that would only route to one or two other vlans. For instance, I wanted to create a VLAN 100 that routed to VLAN 20 and 30 but nothing else. I also want to route VLAN 1 just to VLAN 30, and so on. I am able to do each one of the cases but only one, it seems like the switch only supports one "routing table" am I missing something or is this just a limitation of the switch?
I have a network with several catalyst 2960 switches and one catalyst 3750. I have created two VLAN and set up the proper routing and everything is working fine there. I have a client/server application that used multicast in the initial start up for the client to determine available servers, the issue is one of my clients is on a different VLAN then the server. I am able to route the multicast using MVR as long as both the server and the client are plugged into the 3750 by creating a static route, making the server a source port and the client a receive port. Unfortunately I need the client and the server plugged in to different 2960s. My question is how do I establish multicast routing between the two and perferably do it dynamically (always route multicast traffic from one VLAN to another).
I have a DC topology based on 2 layers, access and aggregation, based on 2 pairs of N5548Ps, both without L3 Daugher Cards. My intent is to use the aggregation N5K pair as L3 inter VLAN layer, so I configured all the VLAN default GWs there. The 2 layers are interconnected via vPC, in a double-sided vPC topology for some N2Ks and some vSwitches. The point is that, despite connecitivity is working fairly ok, for some applications, like file transfer via either FTP or HTTP, between hosts in different VLANs, the performance is too poor. The file transfer starts ok, but after a while it becomes lower and lower. ICMP is working, but I can see some strange random behaviour, like having some packets taking more that 20 ms (sometimes 40 or more), whilst average is 2 ms.
I read through some articles saying that until you don´t have the L3 license (the one coming with L3 Daughter Cards) you can expect some weird behaviour on L3 level. Is that true?. What can I do apart of purchasing L3 Daughter Cards?. Can I enable L3 Basic license at the moment (I don´t need dynamic routing for now).
Here some excerpts of what I´m saying:
PING results: 10000 packets transmitted, 10000 packets received, 0.00% packet loss round-trip min/avg/max = 0.809/2.496/57.559 ms System version: 5.0(3)N2(1)
License and features on the N5Ks:
switch# sho license usage Feature Ins Lic Status Expiry Date Comments Count -------------------------------------------------------------------------------- FCOE_NPV_PKG No - Unused - FM_SERVER_PKG No - Unused - ENTERPRISE_PKG No - Unused -
I have been looking into this for a while and I can't seem to figure out why my 2nd vlan is not able to connect properly to the net.
My switch has 12 ports where my devices connects directly, they are all on Vlan 1 and they all work perfectly. on Port 12 I have a dlink router that is connected to a cable modem. the dlink router has an Ip address of 192.168.0.20
I created a second vlan (vlan2) and enabled dhcp relay on it. then I assigned port 9 on the switch to (vlan2)my laptop which is connected to port 9 seems to get an ip address fine and able to ping only some devices on my network (vlan1) and is not able to go out to the internet. I think it has to do with the routes. [code]
We have two Cisco 5505 firewalls connecting to two ISP's . The two internal LAN's on the firewalls are 192.168.184.0/24 & 192.168.186.0/24. We also have a Cisco C3560x layer3 switch with vlan interfaces 184.3 & 186.3. We have two DGS-3100 Dlink layer 2 switches connecting our users to the Layer 3. Ip routing is enabled for intervlan communication & I can reach the Switch interfaces & firewall gateways from machines on both on the vlans.We have pbr enabled on the 3560 & users only on the .186 network can get to the internet. The switch is running the ipservices license & the sdm template is "desktop routing" .
Users on the .184 cannot access the internet but we can ping the layer3 interface & the firewall gateway. [code]
In 3750 switch,I have configured intervlan routing.I have three vlans Vlan 10,vlan 20,Vlan 30 and I have assigned IP address for that Vlan.In vlan 10,I have connected one systen gigabitethernet 0/1 interface.From my system I am able to ping vlan 10 ip address but I can't able to ping other vlan ip address (vlan 20,vlan 30).Is it possible to up the protocol for all that time.
I recently set up a small photography business and am trying to get a Cisco 877 and Cisco SG300-10 switch to talk to each other.
What I want is for the Cisco 877 to handle the internet and the SG300-10 to handle the local network,
I have set up 2 vlans in trunk mode on the switch and want vlan2 to manage local traffic and vlan3 to handle the internet.
I have got the 877 connecting to the internet what I dont have, traffic going to vlan2 on the switch from the 877
Look at the running configs for the switch and the router and tell me how to get the vlan on the router to pass traffic to the switch. In a nutshell I am inserting the internet into the switch but am not sure how to progress. I have the c870-advipservicesk9 image file on the router.
I am working for a large campus network. The network has more than 70 VLANS in a Layer 3 Switch(Catalyst 4503). Customer wants to stop intervlan routing between all vlans except 2 vlans. How will i do that? I have also a Firewall (ASA 5520) & a Router (2811) in up of the switch. Besides this, I have run HSRP in Layer 3 Switches for redundancy.how will i stop intervlan routing between VLANS except 2, with ACL or any other process has?
I have an environment of 3 X 3560G of which I have 1st switch-CORE(f0/10) connecting to the VPN router(CE) interface-f0/0. Remaining 2 Cisco 3560's(Access) are connected to Gi0/1 and Gi0/2 on the 1st switch-CORE via gi0/1 . On all three switches I have created multiple VLANs and assigned ports to these VLAN. The switch to switch connection is trunk allowing all VLANs created on all these 3 switches. Now the issue is how I am going to have all these VLANs routed through single interface on the routeri-e f0/0, as all these subnets will communicating to remote site over VPN. What should be default gateway on the 2 Access switches and the CORE switch, also what static route should be on router to reach all subnets(VLANs) created on these 3 switches.
I have read inter-VLAN routing i-e creating sub interfaces on router but dont want to proceed with that and looking for any other way to have my VLANs talk on all three switches and then are accessible to remote site ove VPN?
