|
|
|
Question : Problem: Creation of two VLAN's on Cisco 1711
|
|
Hey all,
I have slight issue with the creation of two vlan's on a Cisco 1711. A brief history is that I am trying to utilize one
Cisco 1711 (with 4 port switch) to create two vlan's that supports two LAN networks with the same hosts names on
each network. I know, confusing, but I have been tasked with this so now I need to make it happen.
I have created two vlan's. ( Vlan1 & Vlan2) with different subnets, but the problem is when connected, I am not able to
utilize both. Here is the config, and I will comment at the end to see if any of ya all have some ideas.
Current configuration : 3593 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HA-RTR-ROHI
!
boot-start-marker
boot-end-marker
!
no logging console
enable secret 5 XXXXX
!
username XXXX privilege 15 password 0 XXX
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
no aaa new-model
ip subnet-zero
!
!
!
!
ip cef
ip ids po max-events 100
no ftp-server write-enable
!
!
!
!
!
!
crypto isakmp policy 10
authentication pre-share
crypto isakmp key stuff address XX.XX.XX.XX
crypto isakmp key stuff address XX.XX.XX.XX
!
!
crypto ipsec transform-set myset esp-des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peerXX.XX.XX.XX
set transform-set myset
match address 101
crypto map mymap 20 ipsec-isakmp
set peer XX.XX.XX.XX
set transform-set myset
match address 102
!
!
!
interface FastEthernet0
ip address XX.XX.XX.XX 255.255.255.240
no ip route-cache cef
no ip route-cache
no ip mroute-cache
duplex auto
speed auto
!
interface FastEthernet1
switchport access vlan 2
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface Vlan2
description 2nd Hawth vlan
ip address 172.16.30.30 255.255.255.240
!
interface Vlan1
description This is a test for HAWTH
ip address 172.16.30.14 255.255.255.240
!
interface Async1
no ip address
!
ip classless
ip route 0.0.0.0 0.0.0.0 XX.XX.XX.XX
no ip http server
no ip http secure-server
!
!
!
access-list 98 permit XX.XX.XX.XX
access-list 98 permit XX.XX.XX.XX
access-list 98 permit XX.XX.XX.XX
access-list 98 permit 192.168.11.0 0.0.0.255
access-list 98 permit 172.16.30.0 0.0.0.255
access-list 101 permit ip 172.16.30.0 0.0.0.15 192.168.11.0 0.0.0.255
access-list 101 permit ip 172.16.30.16 0.0.0.7 192.168.11.0 0.0.0.255
access-list 102 permit ip 172.16.30.0 0.0.0.15 192.168.10.0 0.0.0.255
access-list 102 permit ip 172.16.30.16 0.0.0.7 192.168.10.0 0.0.0.255
!
!
control-plane
!
banner motd ^C
!
line con 0
line 1
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
exec-timeout 30 0
password stuff
login local
line vty 5 15
password stuff
login
!
end
OK, so here is my goal. I want to be able to have two networks like I said above, but have them on different subnets. For simplicity purposes, I have four pc's on the 172.16.30.0/28 (.1, .2, .3, .4) & four pc's on 172.16.30.16/28 (.17, .18, .19, .20) networks. I want to be able to use one Cisco 1711, & one 8 port unmanaged switch to support this network.
I have followed this article http://www.cisco.com/en/US/products/hw/routers/ps221/prod_configuration_basics09186a00801a055a.html
by creating the vlan's and then IP'ing them. But, without me configuring one of the switchports on the back of the router as
either switchport access vlan 2 or switchport mode trunk/switchport trunk allowed vlan all; the LAN's are not able to talk to the Cisco. The way I have it configured above, I can be one of the pc's on the 172.16.30.16/28 network and get to the Cisco, but from the other subnet of pc's, I get nothing. No ICMP, no telnet, nothing. Can anyone help me out, or at least point me in the right direction? Also, if I utilize the switchport trunk native vlan (some #) 1 or 2 in my case, I can switch which network has the ability to can access to the Cisco, but I want both to have access, but not access to one another.
Thanks in advance,
|
Answer : Problem: Creation of two VLAN's on Cisco 1711
|
|
>I want both to have access, but not access to one another.
>one 8 port unmanaged switch to support this network
You have two self-cancelling priorities. You can't get where you want to go with what you have.
You can uplink 2 ports from the router to the switch:
Router
1 2 3 4
| | | |
Switch VLAN1 users
| | | | | |
VLAN2 Users + VLAN1 users
You have some inherent issues with plugging both router interfaces into the same unmanged switch.
You also have no separation at Layer 2 and broadcasts will cross vlans no matter what you do.
What I suggest is to get yourself another 5/8 port switch
Router
1 2 3 4
| |
Switch1 Switch2
| | | | | | | |
VLAN2 Users VLAN1 users
Now that you have total Layer 1 and 2 separation between the VLAN's, you will also need to create access-lists on the vlan interfaces to prevent traffic from one subnet to the other at Layer 3
access-list 103 deny ip 172.16.30.30 0.0.0.15 172.16.30.14 0.0.0.15
access-list 103 permit ip 172.16.30.30 0.0.0.15 any
access-list 104 deny ip 172.16.30.14 0.0.0.15 172.16.30.30 0.0.0.15
access-list 104 permit ip 172.16.30.14 0.0.0.15 any
interface vlan1
access-group 104 in
interface vlan2
access-group 103 in
|
|
|
|
|
