Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a setup, where the single port 2600 router is in port 0/2 in the switch, outside network is on port 0/1, and the rest (0/3-0/24) should be clients for the second network that would be managed by the 2600 router.

I configured everything with two VLANs: 100 for outside (0/2-0/24), 200 for inside (0/1-0/2). 0/2 is a trunk port for the two VLANs.

The issue that came about is that I can't have two VLANs on at once: software doesn't allow it.

Now, I can ping the outside network devices (172.16.7.1, 172.16.7.103), and even google (8.8.8.8) from the router, but not the switch. Devices on connected get a DHCP lease properly but can't ping outside the network, just the router - 172.17.7.1 and the switch itself, 172.17.7.7.

The configuration for both the router and the switch are here, as well as below.

Router:

rt.throom#sho run
Building configuration...

Current configuration : 1015 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname rt.throom
!
enable password To053cret
!
!
!
!
!
no ip subnet-zero
ip dhcp excluded-address 172.17.7.1 172.17.7.2
ip dhcp excluded-address 172.17.7.3 172.17.7.4
ip dhcp excluded-address 172.17.7.5
!
ip dhcp pool VLAN200
   network 172.17.7.0 255.255.255.0
   default-router 172.17.7.1
   dns-server 8.8.8.8
!
ip audit notify log
ip audit po max-events 100
!
!
!
!
!
!
!
interface Ethernet0/0
 no ip address
!
interface Ethernet0/0.100
 encapsulation dot1Q 100
 ip address 172.16.7.15 255.255.255.0
 ip nat outside
!
interface Ethernet0/0.200
 encapsulation dot1Q 200
 ip address 172.17.7.1 255.255.255.0
 ip nat inside
!
router eigrp 20
 network 172.16.0.0
 network 172.17.0.0
 no auto-summary
 no eigrp log-neighbor-changes
!
no ip classless
no ip http server
!
access-list 1 permit 172.17.7.0 0.0.0.255
!
!
line con 0
line aux 0
line vty 0 4
 login
!
end

Switch:

sw.throom#sho run
Building configuration...

Current configuration:
!
version 11.2
no service pad
no service udp-small-servers
no service tcp-small-servers
!
hostname sw.throom
!
enable password Oh5053cret
!
!
no spanning-tree vlan 100
no spanning-tree vlan 200
ip subnet-zero
!
!
interface VLAN1
 no ip address
 no ip route-cache
!
interface FastEthernet0/1
 switchport access vlan 100
 spanning-tree portfast
!
interface FastEthernet0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/3
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/4
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/5
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/6
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/7
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/8
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/9
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/10
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/11
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/12
 switchport access vlan 200
 spanning-tree portfast
!        
interface FastEthernet0/13
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/14
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/15
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/16
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/17
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/18
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/19
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/20
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/21
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/22
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/23
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/24
 switchport access vlan 200
 spanning-tree portfast
!
!
line con 0
 stopbits 1
line vty 0 4
 login
line vty 5 9
 login
!
end

sho ip route gives:

Gateway of last resort is 172.16.7.1 to network 0.0.0.0

172.17.0.0/24 is subnetted, 1 subnets
C       172.17.7.0 is directly connected, Ethernet0/0.200
172.16.0.0/24 is subnetted, 1 subnets
C       172.16.7.0 is directly connected, Ethernet0/0.100
S*   0.0.0.0/0 [1/0] via 172.16.7.1

EDIT 1: This is the configuration that worked:

ROUTER:

rt#sho run
Building configuration...

Current configuration : 1018 bytes
!
version 12.1
no service single-slot-reload-enable
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname rt
!
enable password To053cret
!
!
!
!
!
no ip subnet-zero
ip dhcp excluded-address 172.17.7.1 172.17.7.2
ip dhcp excluded-address 172.17.7.3 172.17.7.4
ip dhcp excluded-address 172.17.7.5
!
ip dhcp pool VLAN200
   network 172.17.7.0 255.255.255.0
   default-router 172.17.7.1
   dns-server 8.8.8.8
!
ip audit notify log
ip audit po max-events 100
!
!
!
!
!
!
!
interface Ethernet0/0
 no ip address
!
interface Ethernet0/0.100
 encapsulation dot1Q 100
 ip address 172.16.7.15 255.255.255.0
 ip nat outside
!
interface Ethernet0/0.200
 encapsulation dot1Q 200
 ip address 172.17.7.1 255.255.255.0
 ip nat inside
!
ip nat inside source list 1 interface Ethernet0/0.100 overload
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.7.1
no ip http server
!
access-list 1 permit 172.17.7.0 0.0.0.255
!
!
line con 0
line aux 0
line vty 0 4
 password To053cret
 login
!
end

SWITCH:

sw#sho run
Building configuration...

Current configuration:
!
version 11.2
no service pad
no service udp-small-servers
no service tcp-small-servers
!
hostname sw
!
enable password Oh5053cret
!
!
no spanning-tree vlan 100
no spanning-tree vlan 200
ip subnet-zero
ip name-server 8.8.8.8
!
!
interface VLAN1
 ip address 172.17.7.7 255.255.255.0
 no ip route-cache
 shutdown
!
interface VLAN100
 no ip route-cache
 shutdown
!
interface VLAN200
 ip address 172.17.7.7 255.255.255.255
 no ip route-cache
!
interface FastEthernet0/1
 switchport access vlan 100
 spanning-tree portfast
!
interface FastEthernet0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/3
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/4
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/5
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/6
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/7
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/8
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/9
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/10
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/11
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/12
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/13
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/14
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/15
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/16
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/17
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/18
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/19
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/20
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/21
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/22
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/23
 switchport access vlan 200
 spanning-tree portfast
!
interface FastEthernet0/24
 switchport access vlan 200
 spanning-tree portfast
!
ip default-gateway 172.17.7.1
!
line con 0
 stopbits 1
line vty 0 4
 password Oh5053cret
 login
line vty 5 9
 login
!
end

Thank you all for your help!

share|improve this question
1  
Just looking over your config: 1) I don't see a default route? 2) You should be using the ip classless command 3) You may need an ip routing command. but that may only be for switches. –  SpacemanSpiff Dec 4 '12 at 23:45
    
4) What is the DG set to on the computer(s)? 5) Can you post the switch config? –  joeqwerty Dec 4 '12 at 23:49
    
DHCP on the router is handing out the router's VLAN200 interface: 172.17.7.1. The switch config is also at his pastebin. The only problem I see is the lack of a default route on the router, and maybe the ip classless command –  SpacemanSpiff Dec 4 '12 at 23:50
    
@Slava - Can you post the output of "sh ip route" from the router? Also, what's the point of having eigrp configured? Are you exchanging routes with the router for the outside network? –  joeqwerty Dec 4 '12 at 23:57
    
@Slava - Also, run a tracert from a computer to 8.8.8.8. If the trace reaches your router then the problem is between your router and the outside network. –  joeqwerty Dec 5 '12 at 0:08
show 5 more comments

3 Answers

up vote 1 down vote accepted

Since the switch is on the inside in your configuration, it needs a default route to reach outside devices, just like any device on the inside does. At layer three (TCP/IP), the switch acts like an ordinary device.

share|improve this answer
    
I believe on that class switch the command is ip default route –  SpacemanSpiff Dec 5 '12 at 1:34
    
I think the core problem is that the computers connected to the switch can't get beyond the router. It's not really about the switch not being able to. –  joeqwerty Dec 5 '12 at 2:07
    
@joeqwerty: If so, the solution is to troubleshoot. For example, first test: Can they ping their default gateway? –  David Schwartz Dec 5 '12 at 2:16
    
I can ping the Cisco router from client computers and the switch. Neither can ping the outside gateway though: 172.16.7.1. The router, on the other hand, can ping everywhere and everything. –  Slava Maslennikov Dec 5 '12 at 4:46
    
@SlavaMaslennikov: It sounds like NAT is not properly set up on the router. –  David Schwartz Dec 5 '12 at 5:41
show 3 more comments
  1. Why would you have the outside network connected to the switch instead of the router?

  2. If you're referring to assigning an ip address to more than one VLAN then you're correct. That model switch only supports an ip address for management purposes and only allows one VLAN to be assigned an ip address. As for the VLAN's themselves, it certainly supports having more than one.

  3. It's a layer 2 switch and therefore doesn't support SVI (InterVLAN routing) and therefore only allows you to assign an ip address to one VLAN... for managing the switch.

EDIT 1

My apologies for not catching this earlier. Does the outside router have a route for the 172.17 network? You've got EIGRP enabled on the inside router but there are no routes learned via EIGRP (as evidenced by the sh ip route output from the inside router), which means the outside router probably doesn't have a route in it's routing table for the 172.17 network. If the outside router doesn't have a route to the 172.17 network then it can't reply to (or route traffic) back to the 172.17 network.

EDIT 2

Here's the problem. Again, my apologies for not catching it earlier. Sometimes the obvious things escape us.

  1. The D-Link router only knows about networks that it is directly connected to. IT IS NOT directly connected to the 172.17 network and therefore doesn't know how to route traffic to that network. You need to configure the D-Link to route traffic for the 172.17 network through the inside router.

  2. For EIGRP to work, both routers must be using and participating in EIGRP. Your D-Link router is most definitely not using EIGRP, hence it doesn't have a route to the 172.17 network via the inside router. The evidence for this is that the inside router doesn't show any EIGRP learned routes in it's routing table. That means it's not recieving EIGRP routing table updates from the D-LINK router... because the D-LINK router is not using EIGRP.

So to recap: You need to configure a route on the D-LINK router for the 172.17 network via the inside router.

share|improve this answer
    
1. It's a one-port router. 2. Yeah, i have more than one, but only one can be on at once. 3. Alright. So is there a way around this? –  Slava Maslennikov Dec 4 '12 at 23:48
1  
2. You can have more than one VLAN... but the switch doesn't support InterVLAN routing so you can only assign an ip address to one VLAN... for management purposes. 3. Your router needs to have a sub-interface for each VLAN (which it looks like you already have configured), the switch/router port needs to be configured as a trunk port for the VLAN's that you want to route for (which it looks like you already have configured), and the hosts need to have the ip address of the appropriate router sub-interface set as their Default Gateway (which it looks like you already have configured). –  joeqwerty Dec 5 '12 at 0:05
    
And yet it's not working.. oddly. –  Slava Maslennikov Dec 5 '12 at 4:34
    
The outside - 172.16.7.1 - router is a crap d-link that's not extremely configurable. I didn't make any changes in the d-link's interface at all yet. Also, I'm not completely sure what eigrp does, the only reason I have that is because someone I know who knows cisco said it's not bad to have it. Would it help if I removed it? –  Slava Maslennikov Dec 5 '12 at 5:45
    
See my second edit. –  joeqwerty Dec 5 '12 at 6:02
show 4 more comments

Your NAT config doesn't do anything, my guess would be devices on the outside can't route back to the 172.17.1.0/24 net

Need to translate 172.17.1.0/24 to 172.16.17.15

IP Nat inside source list 1 interface ETH 0/0.100

Give that a whirl - and some show commands from router would be interesting

Sh IP Nat trans

Sh IP route

share|improve this answer
    
Do you mean 172.17.7.0, not 172.17.1.0? That's the inside network - vlan200. –  Slava Maslennikov Dec 5 '12 at 4:35
1  
Added sho ip route to main question, sh ip nat trans shows a blank line. Also, as I commented earlier, I don't seem to have the command "ip nat inside source". It ends at "ip nat inside" or "ip nat outside" –  Slava Maslennikov Dec 5 '12 at 4:44
    
Now that I understand this thanks to David Schwartz's link (firewall.cx/cisco-technical-knowledgebase/cisco-routers/…), it worked perfectly. Thank you! –  Slava Maslennikov Dec 5 '12 at 8:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.