Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to networking and was looking for some assistance. First off I'm using packet tracer to diagram my scenario as I will be receiving my equipment next week to deploy.

Hardware to be used:

  1. 2 catalyst 3560 switches

  2. all connect to a sonic wall router

I have two companies that work in the same office space. I need to keep these companies separate on their own vlan. They will however need to share the phone system.

(Packet tracer file uploaded to give those who have the time to see what I put together.)

http://dl.dropbox.com/u/86234623/network%20build.pkt

Here is my current test scenario:

on switch 0 I have:

  • company A on vlan 2 computers 172.16.1.100 and 101 255.255.0.0 FA0/10 FA0/11
  • company B on vlan 3 computers 172.16.2.102, 255.255.0.0 FA0/12
  • PBX on a trunk port 172.16.0.5, 255.255.0.0 FA0/5
  • trunk port on FA0/1 to connect the switches

on switch 1 I have:

  • company A on vlan 2 computers 172.16.1.102, 255.255.0.0
  • company B on vlan 3 computers 172.16.2.100 and 101, 255.255.0.0
  • trunk port on FA0/1 to connect the switches

I can ping the respective computers on the same vlan but cant ping company A to B which is what I want. However neither company can talk (ping) the PBX.

Here are the commands I used to configure what I have:

switch 0

en
conf t

vlan 2
name A

vlan 3
name B

int fa0/10
switchport mode access
switchport access vlan 2
int fa0/11
switchport mode access
switchport access vlan 2
int fa0/12
switchport mode access
switchport access vlan 3

int fa0/5
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3



int fa0/1 (to connect the switches)
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3

Switch 1

en

conf t

vlan 2
name A

vlan 3
name B

int fa0/10
switchport mode access
switchport access vlan 3

int fa0/11
switchport mode access
switchport access vlan 3

int fa0/12
switchport mode access
switchport access vlan 2

int fa0/1 (to connect the switches)
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3
share|improve this question
    
Only those of us with Packet Tracer can view your file. How about uploading an image of some sort? –  joeqwerty Oct 26 '12 at 17:34
    
It seems you want to reach two different subnets from each other, so you need something which will route. What is the default gateway of the clients and is it on a trunkport too? If not it might be a problem –  Gabor Vincze Oct 26 '12 at 17:49
    
heres a screen shot. imageshack.us/photo/my-images/824/1026201215556pm.png –  Matt Oct 26 '12 at 20:59

1 Answer 1

up vote 1 down vote accepted

You've put all your hosts in the same subnet, but have separated them into different VLAN's. Please see note 7.

You need to configure different IP subnets for each vlan if you want any hope of IP routing between them working. The first thing to do is to change the subnet mask on your hosts to 255.255.255.0. This will put company A, company B, and the server on different Vlans and different subnets like so:

  1. Company A - Vlan 2 - Subnet 172.16.1.0 /24
  2. Company B - Vlan 3 - Subnet 172.16.2.0 /24
  3. Server - Vlan 4 - Subnet 172.16.3.0 /24

Give the server an ip address of 172.16.3.n 255.255.255.0 Don't make it a trunk port, that's just added complexity you don't need right now.

Now that you have sane VLANs and subnetting, you need IP routing between them. You can use either of the 3560's for this, or the sonicwall. But I hate sonicwall so I'm going to tell you how to do it with the 3560.

Choose a 3560 to be your router, it doesn't matter which one. Give it three layer 3 vlan interfaces: With the following commands, in configure mode:

ip routing
Interface vlan 2
  ip address 172.16.1.1 255.255.255.0
Interface vlan 3
  ip address 172.16.2.1 255.255.255.0
interface vlan 3
  ip address 172.16.3.1 255.255.255.0
exit
ip route 0.0.0.0 0.0.0.0 ip.address.of.sonicwall

Now make the default gateway of your hosts point to the vlan interface in each respective VLAN that you just set up. So 172.16.1.100 would have a gateway of 172.16.1.1, etcetera.

Once you have this set up, you should be able to have IP connectivity between your 3 vlans, and also to the internet through your sonicwall.

To deny traffic between VLAN 2 and 3, you can use a VACL, like so:

ip access-list extended deny2to3
 deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
 permit ip any any
ip access-list extended deny3to2
 deny ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255
 permit ip any any
interface vlan 2
 ip access-group deny2to3 in
interface vlan 3
 ip access-group deny3to2 in

Note 7: This will not work.

share|improve this answer
    
Smithian, thanks for your reply. I have a few more questions. I for one dont have my equipment yet so I cant acutally try this. I have packet tracer so I can somewhat do these steps but the program cant simulate a sonicwall router. however I enabled the routing on one of the switches and got to the point of entering the sonic wall address with command ip route 172.16.0.1 255.255.255.0 and it told me incomplete command. also I assume the router would have to be connected with the routes addeded that you posted in order for the inner vlan routing to occur? –  Matt Oct 26 '12 at 20:32
    
Also from the switch I imagine I need to configure a trunk port to the sonicwall along with creating sub interfaces on it? or does enabling the layer 3 routing on the 3560 eliminate this? sorry for the newbie questions.... sigh.. –  Matt Oct 26 '12 at 21:05
    
Smithian, ok I seem to have it working now. however vlans 2 and 3 can talk to one anonther. I want to prevent that. but they can now both talk to the pbx server so thats a + :) –  Matt Oct 26 '12 at 21:19
    
Hi Matt, if you are entering the default route, you need to put in: ip route 0.0.0.0 0.0.0.0 172.16.0.1. the routes for the vlans will be automatically added to the routing table when you create the vlan interfaces. –  smithian Oct 26 '12 at 21:51
    
I would not bother with a trunk port to the router unless you need it for some reason. –  smithian Oct 26 '12 at 21:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.