Multiple vlans access to shared pbx system

Question

I'm new to networking and was looking for some assistance. First off I'm using packet tracer to diagram my scenario as I will be receiving my equipment next week to deploy.

Hardware to be used:

1. 2 catalyst 3560 switches

2. all connect to a sonic wall router

I have two companies that work in the same office space. I need to keep these companies separate on their own vlan. They will however need to share the phone system.

(Packet tracer file uploaded to give those who have the time to see what I put together.)

http://dl.dropbox.com/u/86234623/network%20build.pkt

Here is my current test scenario:

on switch 0 I have:

• company A on vlan 2 computers 172.16.1.100 and 101 255.255.0.0 FA0/10 FA0/11
• company B on vlan 3 computers 172.16.2.102, 255.255.0.0 FA0/12
• PBX on a trunk port 172.16.0.5, 255.255.0.0 FA0/5
• trunk port on FA0/1 to connect the switches

on switch 1 I have:

• company A on vlan 2 computers 172.16.1.102, 255.255.0.0
• company B on vlan 3 computers 172.16.2.100 and 101, 255.255.0.0
• trunk port on FA0/1 to connect the switches

I can ping the respective computers on the same vlan but cant ping company A to B which is what I want. However neither company can talk (ping) the PBX.

Here are the commands I used to configure what I have:

switch 0

en
conf t

vlan 2
name A

vlan 3
name B

int fa0/10
switchport mode access
switchport access vlan 2
int fa0/11
switchport mode access
switchport access vlan 2
int fa0/12
switchport mode access
switchport access vlan 3

int fa0/5
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3



int fa0/1 (to connect the switches)
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3

Switch 1

en

conf t

vlan 2
name A

vlan 3
name B

int fa0/10
switchport mode access
switchport access vlan 3

int fa0/11
switchport mode access
switchport access vlan 3

int fa0/12
switchport mode access
switchport access vlan 2

int fa0/1 (to connect the switches)
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 1-3

Answer 1

You've put all your hosts in the same subnet, but have separated them into different VLAN's. Please see note 7.

You need to configure different IP subnets for each vlan if you want any hope of IP routing between them working. The first thing to do is to change the subnet mask on your hosts to 255.255.255.0. This will put company A, company B, and the server on different Vlans and different subnets like so:

1. Company A - Vlan 2 - Subnet 172.16.1.0 /24
2. Company B - Vlan 3 - Subnet 172.16.2.0 /24
3. Server - Vlan 4 - Subnet 172.16.3.0 /24

Give the server an ip address of 172.16.3.n 255.255.255.0 Don't make it a trunk port, that's just added complexity you don't need right now.

Now that you have sane VLANs and subnetting, you need IP routing between them. You can use either of the 3560's for this, or the sonicwall. But I hate sonicwall so I'm going to tell you how to do it with the 3560.

Choose a 3560 to be your router, it doesn't matter which one. Give it three layer 3 vlan interfaces: With the following commands, in configure mode:

ip routing
Interface vlan 2
  ip address 172.16.1.1 255.255.255.0
Interface vlan 3
  ip address 172.16.2.1 255.255.255.0
interface vlan 3
  ip address 172.16.3.1 255.255.255.0
exit
ip route 0.0.0.0 0.0.0.0 ip.address.of.sonicwall

Now make the default gateway of your hosts point to the vlan interface in each respective VLAN that you just set up. So 172.16.1.100 would have a gateway of 172.16.1.1, etcetera.

Once you have this set up, you should be able to have IP connectivity between your 3 vlans, and also to the internet through your sonicwall.

To deny traffic between VLAN 2 and 3, you can use a VACL, like so:

ip access-list extended deny2to3
 deny ip 172.16.1.0 0.0.0.255 172.16.2.0 0.0.0.255
 permit ip any any
ip access-list extended deny3to2
 deny ip 172.16.2.0 0.0.0.255 172.16.1.0 0.0.0.255
 permit ip any any
interface vlan 2
 ip access-group deny2to3 in
interface vlan 3
 ip access-group deny3to2 in

Note 7: This will not work.