Cisco WAN :: Catalyst 3560G - Limiting VLan Access?
Jan 27, 2011
I have three VLANS set up on my Catalyst 3560G switch. Each VLAN has its own subnet and I have enabled IP routing and set up my VLANS so that clients on VLANS 1 and 3 can get to VLAN 2 because they share a server located on VLAN 2. However, now they can also see and get to each others VLANS! How I can allow my clients on VLANS 1 and 3 access a server on VLAN 2 but not access the other VLANS? I don't want VLAN 1 to get to VLAN 3 or VLAN 3 to get to VLAN 1.
View 17 Replies
ADVERTISEMENT
Feb 21, 2012
cant assign cisco switch 3560G port g0/1to access vlan 10
main-switch(config-if)#switchport access vlan 10 Command rejected: Gi0/1 not a switching port.
View 5 Replies
View Related
Sep 27, 2010
a customer purchased a ESW-520-24p to be used in a VoIP project. Today we had difficulties connecting it to a Catalyst 3650G switch; We've tried setting the port to trunk, general, customer and access and changed all sorts of VLAN settings on the 3560G switch to no avail: the switches just wont interconnect. While sniffing we saw that ARP requests are even not answered, so something is wrong on a low level, probably with VLAN-ing.if these switches should be able to be interconnected and if yes, what needs to be done to do so?
Secondly; voice will be on seperate VLAN and the client will use SPA942 phones, which have an internal switch that allows to connect a PC to it. I've used this phoned successfully with Catalyst Express switches and I didn't have to do anything for VLAN-ing, this worked "out of the box". Can these phones work with the Small Business switches as well?
View 4 Replies
View Related
Oct 2, 2012
We have 2 catalyst 3560g-48-PoE protected by a 1000Va 800Watt tripp-lite and I was cheking to see if that is really sufficient. Looking at the charts from Cisco suppport I would think I should have more, but have not had any issues with a few power outages
View 1 Replies
View Related
Apr 11, 2012
to resolve a problem with L2 etherchannel -when I add VLAN on Portchannel, this VLAN does not appear in config Members of this Po, so after reboot Portchannel does not work: "...and will be suspended (vlan mask is different)"
I try to simulate it on test switch in office, but problem does not appear! Both switch are Catalyst3560G with same IOS.
1. SW in real network segment:
Model revision number : D0
Motherboard revision number : B0
[Code]...
View 6 Replies
View Related
May 25, 2013
I am trying to implement static route tracking on a Catalyst 3560G ( WS-C3560G-48PS, IOS version 12.2(35)SE5 and SW image C3560-IPBASE-M). The configuration is as follows:
track 101 rtr 1 reachability
!
rtr 1
type echo protocol ipIcmpEcho 10.199.101.2
rtr schedule 1 life forever start-time now
!
IP address 10.199.101.2 is reachable via ICMP (its the next-hop router).
The static routes configured are the following:
ip route 0.0.0.0 0.0.0.0 10.199.101.2 track 101
ip route 0.0.0.0 0.0.0.0 10.200.52.1 20
But only the secondary route(ip route 0.0.0.0 0.0.0.0 10.200.52.1 20) its being installed on the routing table by the switch.
View 8 Replies
View Related
Feb 26, 2012
I am trying to get the temperature reading from one of our 3560G Switches using SNMP. When I run an snmpget on the Switch it returns back to me a "1".
So when I run the following I get:
> snmpget -v1 -c public 192.168.x.xxx 1.3.6.1.4.1.9.9.13.1.3.1.3.1005
SNMPv2-SMI::enterprises.9.9.13.1.3.1.3.1005 = Gauge32: 1
But when I telnet to the device and run a "show env temperature status" I get:
# show env temp status
Temperature Value: 32 Degree Celsius
Temperature State: GREEN
Yellow Threshold : 51 Degree Celsius
Red Threshold : 61 Degree Celsius
So I'm not sure why I am getting a "1" when using snmpget on the OID 1.3.6.1.4.1.9.9.13.1.3.1.3.1005 which is (ciscoEnvMonTemperatureStatusValue)??
If I run the same OID on another 3560G Router I get the correct output from snmp....
View 4 Replies
View Related
Feb 10, 2011
I have used the following basic configuration to do rate limiting on a vlan interface on a 6509:
access-list 100 permit ip any any
class-map match-all ratelimit
match access-group 100
policy-map ratelimit-10Mb
class ratelimit
police 10000000 428750 conform-action transmit exceed-action drop
[code]....
How do I combine the two correctly to give me a vlan port rate limited at 10Mb up and down, but still setting aside (dynamically) 2Mb for voice?
View 1 Replies
View Related
Dec 1, 2011
I need to know the key functional differences between the Catalyst switches 3560E, 3560X and 3560G.
View 1 Replies
View Related
Nov 14, 2011
I have a 2960 that I need to limit the uplink port to 50Mbps for 3 vlans and 350Mbps for another vlan. Would the following config achieve that or is this even possible for the 2960?
class-map match-any VLAN50-51-52
match vlan 50-52
class-map match-any VLAN53
[Code].....
View 1 Replies
View Related
Nov 19, 2012
We have recently started as Internet service provider in an open metropolitan.
We use a Cisco 3560G Layer 3 switch, where we have all our vlan where we have konfiguerat ex. Switch (config) # interface vlan 150, an interface for each VLAN capabilities such as int vlan 1 - 10/10 int vlan 2 to 30/10, int vlan 3 100/10 and so on.
Our int vlan is configured as follows:
dhcp relay information trusted
ip address <x.x.x.x> <x.x.x.x>
ip helper-address <x.x.x.x>
Ports (ex. int Gigabit Ethernet 0/1) are configured as follows:
description Uplink
switchport access vlan x
[Code].....
Now the problem; we have a customer in ex. vlan 3 who needs to access a server provided by another customer in the same vlan (vlan 3), and access to each other in the same vlan is not possible. You can access the server from any other vlan, but when it comes to access to another host in the same vlan, you will not reach it.
We suspect that the energy company has configured with pvlan isolated. If we use the command ip local-proxy-arp on each vlan, it works to reach each other, but it seems that our 3560 becomes overloaded when ip local-proxy-arp is enabled and it streaming and use IP telephony it doesn't work. The response time at ping is longer and the loss of packets increase with ip local-proxy-arp enabled. The other operators in the metropolitan also uses Cisco 3560G so the hardware should be sufficient.
We have also tried to add no split-horizon, but it made no difference. How do we get around this without negative consequences? Probably need something that makes you allow to send out the same interface that it came from, because it works as long as you are in another vlan.
View 1 Replies
View Related
Nov 13, 2012
I have got 2 Cisco switches (3560G and a 3560X) connected by a trunk port. see config below:
3560G#sh run int gi0/26
Building configuration...
Current configuration : 130 bytes
[Code].....
I can't seem to get VLAN 79 through to the first switch (3560G). Beyond this switch there is a router with acts as default-gateway for the respective VLANs. For VLAN 79 it is 192.168.79.1. I can ping this from the first switch but can't ping it from the second (3560X) switch but can ping 192.168.25.1 which also is the default gateway for this switch.
View 7 Replies
View Related
May 1, 2013
I have a 3560G that I cannot apply a policy route-map to one of the VLAN interfaces. I am running up to date software, c3560-ipservicesk9-mz.150-2.SE2 and it accepts the command, but does not show it in the sh run of the interface. I updated to this code as I had seen previously someone said it needed to be version 15 before you could apply route-maps to VLAN interfaces.
View 4 Replies
View Related
Aug 2, 2012
I have the network described below, on which I am running PIM.
(network) ---- Embedded Linux Router --(vlan 5)-- CAT 3560G --(vlan 5)-- Cisco 1811 Router ---- Multicast Listener
The Linux Router and the 1811 have formed a PIM neighbor relationship. The multicast listener sends an IGMP Join and I can see the PIM join leave the 1811 router (via "debug ip pim"). Using tcpdump on my linux router I never see the Join come in, but I can see the PIM Hellos (which is why the neighbor relationship formed).
View 2 Replies
View Related
Jun 4, 2013
I have a 5500 controller that we use to manage our lightweight access-points. We have had complaints that the 'guest' vlan in the boardroom is not usable. Our guest vlan is in fact overloaded.
I went back to the original site survey and noticed that coverage for the room is not ideal so I would like to have a new lightweight access-point installed in the boardroom and somehow limit the access to it to only a few people.
View 11 Replies
View Related
Jul 24, 2012
Since two weeks I have a problem with the VLANs who I started to configure. I hope together we find the way.I have 5 VLANS configured in a CISCO 3560G switch. In my windows server 2003 I configured DHCP scope for each VLAN.One of the requirement to connect vlans each other is to put the IP of each vlan as gateway in the clients.So, how can I do to access to internet?. The ip of my Firewall are in one of the VLAN´s.When the configuration of the LAN only had one DHCP scope the gateway was the ip of my firewall. But now i don´t know how to configure the DHCP server, or the firewall, or the switch, or all of them To get access to internet.
View 2 Replies
View Related
May 14, 2013
I'm trying to set up per vlan routing on a 3560G switch but it's not performing as I would expect. I've got a server on the 109 vlan with a 10.1.9.100 address and a default gateway of 10.1.9.1 this address is an HSRP gateway and currently resides on 10.1.9.7. When I traceroute through to my user PC on the internal network it receives a response from 10.1.9.7 However, it is then denied by an ACL on the internal firewall which has been applied to interface Eth0/0. It should arrive at the firewall on Eth0/2.109 as it has the 10.1.9.4 address.
My goal here is to route traffic on the 101 vlan to a seperate interface on the internal firewall from 109 vlan traffic. I'm either doing something wrong or these routing commands aren't designed to work in the way I'm expecting (I couldn't find any documentation on the ip route command where it is followed by different gateways for different vlans)
interface GigabitEthernet0/12
description Internal-FW Eth0/2
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 109
switchport mode trunk(Code )
View 1 Replies
View Related
Feb 13, 2012
Is it possible to set up an RV110W to limit access to only specified websites according to a schedule? I can block access to specific sites using the Internet Access Policy settings under Firewall, but I can't figure out a successful way to block access to all sites except those specified. I also tried establishing access rules but that did not work either.
View 4 Replies
View Related
Feb 22, 2013
I am trying to limit HTTP access to my server on the local network to a specific IP address. I create an Access Rule in the firewall section, however that doesn't work. The only way it works is if I add the internal IP address of the server to the Forwarding section where I create a new HTTP forwarding rule.However, that is not good because that allows ALL HTTP traffic to that server instead of just by the single IP address.
View 2 Replies
View Related
May 1, 2011
Have cisco router 1921 and 3 cisco switch 3560G i want to configure the cisco router so as network 192.168.4.0/26,192.168.3.0/26,192.168.2.0/26, all to access internet R1921(config)# ip nat inside source list 102 int G0/0 overloadR1921(config)# access-list 102 permit ip ?
I am right to do this below?
R1921(config)# ip route 192.168.4.0/26 10.10.10.2R1921(config)# ip route 192.168.3.0/26 10.10.10.2R1921(config)# ip route 192.168.2.0/26 10.10.10.2
assist on access-list and ip route?
View 20 Replies
View Related
Jan 15, 2013
My first question is I have an access layer switch which is a single VLAN and I am trunking that VLAN to a distribution layer switch, I can ping the gateway on the distribution layer switch for THAT VLAN, But cannot ping the gateway address for the second VLAN I have on the distribution layer switch. I know it is simple, But I have forgotten and just need a push
Also I have a third VLAN set to route traffic not bound for those 2 VLANs out to a router is the statement "ip route 0.0.0.0 0.0.0.0 172.16.252.2" good enough and do I actually need to create a VLAN for that traffic? and if so, is an access switchport the best option?
View 2 Replies
View Related
Sep 13, 2011
Why aren't the fa ports that i assign to a voice vlan showing up when i issue show vlan?
View 2 Replies
View Related
Oct 24, 2011
I have got a catalyst cisco 2960G series switch and via this switch I want to creat serveral vlans. I am getting a dhcp IP from a router and I want to setup my own vlan networks.
I plugged in the Ethernet cable that came from the dhcp router to port 16 of the cisco switch and configured the ports 1,2 and 3 for vlan 1, 2 and 3
the dhcp router has given me this IP 192.168.10.158 defautl gateway is : 192.168.10.1
when I plug in a PC to port 1 or 2 of the cisco switch I still receiving the IP from range 192.168.10.* but not from the range that I configured for the vlan 1 or 2.
Below is my startup configuration:
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
[code].....
View 28 Replies
View Related
Nov 8, 2012
I have 3 VLANs here that need to be on the same network segment. They are going to be used by our Wi-Fi network (with Aironet APs), bound to 3 different SSIDs (as Aironet APs doesnt allow multiple SSID per VLAN), each one with a different authentication method and server.Is there a way to bridge those VLANs together with a Catalyst 3750 switch? I tryed configuring an IP address on one of the VLAN interfaces, then configuring a bridge with the vlan-bridge protocol (Catalyst 3750 doesnt have the "ieee" bridge protocol type) and put all 3 VLAN interfaces on the same bridge-group, but it didnt work (even with "bridge x route ip").I also tryed configuring IRB bridging, with the 3 VLAN interfaces on the same bridge-group and an IP address on the BVI interface (the way I used to do with old 2600 routers). Same result.(actually, I didint test to see if the interfaces are actually being "bridged", but I see neither of them can reach the router)
View 1 Replies
View Related
Apr 22, 2012
we have applied route-map on vlan interface in the form:
ip access-list extended TEST
permit ip 172.16.1.128 0.0.0.127 172.16.0.0 0.0.255.255
route-map TEST permit 10
match ip address TEST
set ip next-hop 172.16.111.1
interface Vlan11
ip policy route-map TEST
The problem is in the traffic matching by the rule - there is matches not only for 172.16.0.0/16 prefixes but for the whole traffic in that VLAN.
View 1 Replies
View Related
Feb 13, 2013
I would like to get using of course SNMP, list of client IPs connected to VLAN in Cisco Catalyst 3600.So far, I have pseudo-algorithm made by me which obtains those IP addresses, but I am not sure if this is done in right way :
1) Receive all IP addresses from Catalyst using oid 1.3.6.1.2.1.4.20.1.2. I get something like :
IP-MIB::ipAdEntIfIndex.10.10.2.1 = INTEGER: 152
IP-MIB::ipAdEntIfIndex.10.10.2.251 = INTEGER: 152
IP-MIB::ipAdEntIfIndex.10.10.3.251 = INTEGER: 151 and so on.
2) Get ifIndex of VLAN (oid 1.3.6.1.2.1.4.20.1.2.10.10.2.1.<IP_ADDRESS>) for particular IP address from above list :
IP-MIB::ipAdEntIfIndex.10.10.2.1 = INTEGER: 152
IP-MIB::ipAdEntIfIndex.10.10.2.251 = INTEGER: 152
IP-MIB::ipAdEntIfIndex.10.10.3.251 = INTEGER: 151
3) Get VLAN name (oid 1.3.6.1.4.1.9.9.46.1.3.1.1.4.1.<IF_INDEX>) If_index is borrowed from list above :
IP-MIB::ipAdEntNetMask.152 = No Such Instance currently exists at this OID
IP-MIB::ipAdEntNetMask.151 = No Such Instance currently exists at this OID
In the third step I have this problem, that instance can not be found in OID. It is weird, because for about forty IP addresses i can find about their 10 VLAN names to which they are connected.
View 1 Replies
View Related
Feb 12, 2004
i want to know if the new Catalyst 3750 Support Private Vlan ?
or any other small Switches
View 3 Replies
View Related
Jun 3, 2012
I'm getting this error message on syslog server (Kiwi syslog)access-list logging rate-limited or missed XXXX packets i did the following commands but still I'm getting the error :logging buffered 16386 debugginglogging rate-limit all 5000no logging consoleno logging monitorip access-list logging interval 30000ip access-list log-update threshold 30000 i don't want to report to the console or monitor i want to report direct to syslog server, because I'm monitoring all the traffic (permit ip any any log) !
View 2 Replies
View Related
Oct 24, 2011
i'd like to configure OSPF on a Catalyst 6503 IOS 12.2.17.i habe an Gi1/9 with the ip address 192.168.97.30/24 and a VLAN 19 with the IP Address 192.168.19.0/24.I configured OSPF like this
router ospf 1
network 192.168.97.0 0.0.0.255 area 10.5.0.0
network 192.168.19.0 0.0.0.255 area 10.5.0.0
on the ospf peer is see that the adjaceny is established but i don't get the routes for the 192.168.19.0 network i checked the ip ospf interface vlan 19; i got ospf is not enabled on the interface then i tried to configure
int vlan 19
ip ospf 1 area 10.5.0.0
but it does not access ip ospf 1
View 3 Replies
View Related
Apr 14, 2013
I have installed a Catalyst 2960-S and a 3750-X-12S and I am trying to setup a VLAN 51 for some VoIP phones. I have added the VLAN as an interface on both switches, but the 3750 is not showing VLAN 51 as active when i do a show vlan. Also, it omitts showing Gi1/0/1 & Gi1/0/3 which are uplinks to 2960-S switches plugged in and working on VLAN1.
Catalyst3750SFP#show vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/2, Gi1/0/4, Gi1/0/5
[Code].....
View 2 Replies
View Related
Oct 31, 2012
How can I configure Cisco 200 (SG200-08P) to learn Voice VLAN and CoS/DSCP from upstreamCatalyst 2960?
The Cat 2960 is today used together with LLDP-MED to announce config to Aastra IP Telephones. In some cases I need to use a small switch inbetween and plan to use the Cisco SG200-08P for this. However, I would like to avoid manual config of the Cisco 200 switch.
View 3 Replies
View Related
Jun 20, 2012
I'm configuring two etherchannel groups (2 ports in each) on a 3560 switch. I need to trunk multiple vlans over each channel group.
I created the vlan trunks and allowed vlans on each physical interface. I notice that I can also configure the vlan trunks on the port-channel interfaces that were created. Should I configure them under those interfaces, or leave them on the physical interfaces? Relevant config is below:
interface Port-channel1
!
interface Port-channel2
[Code].....
View 1 Replies
View Related
Apr 7, 2011
I have set up an ACL on my 3750 switch to deny icmp from PC A on our inside network to PC B on a different VLAN on our inside network using the following ACLs:
deny icmp host 10.1.17.15 host 10.3.10.4
deny icmp host 10.3.10.4 host 10.1.17.15
-- or --
deny icmp host 10.1.17.15 host 10.3.10.4 echo-replydeny icmp host 10.3.10.4 host 10.1.17.15 echo-reply
These ACLs belong to an access-list that also limits ip traffic to a few specific machines.When I try pinging from PC A I receive a reply message back from PC B. Shouldn't this configuration block any ICMP from PC A to PC B and from PC B to PC A? I would have expected the first ACL statement to block any packets associated with ICMP and when that didn't work I tried the second configuration.
View 6 Replies
View Related
