1

I have a Cisco 2960 running 12.2(58) SE2 with four VLANs configured (10.10.10.0/24 - 10.10.40.0/24) plus one uplink on a 192.168.1.0/24 network. I have enabled ip routing and the VLANs can talk between one another no problem, but my internet connectivity is not working.

My internet gateway is 192.168.1.1, and I have one interface (GigabitEthernet0/2) on the switch configured on 192.168.1.0/24 with an IP of 192.168.1.254. I tried creating a default route using:

ip route 0.0.0.0 0.0.0.0 192.168.1.1

but that is not working.

In DHCP I set the default gateway for each VLAN as the .1 address.

Here is the config:

!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname myswitch
!
!
no aaa new-model
clock timezone CST -6
system mtu routing 1500
udld aggressive
!
sdm prefer lanbase-routing
!
ip routing
!
ip subnet-zero
!
!
mls qos map cos-dscp 0 8 16 26 32 46 46 56
!
!
macro global description cisco-global
errdisable recovery cause link-flap
errdisable recovery interval 60
no file verify auto
!
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/3
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/4
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/5
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/6
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/7
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/8
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/9
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/10
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/11
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/12
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/13
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/14
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/15
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/16
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/17
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/18
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/19
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/20
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/21
 switchport access vlan 40
 switchport mode access
!
interface FastEthernet0/22
 switchport access vlan 40
 switchport mode access
!
interface FastEthernet0/23
 switchport access vlan 40
 switchport mode access
!
interface FastEthernet0/24
 switchport access vlan 40
 switchport mode access
!
interface GigabitEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/2
 switchport access vlan 192
 switchport trunk native vlan 192
 switchport trunk allowed vlan 10-192
 switchport mode trunk

!
interface Vlan1
!
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
 no ip route-cache
!
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 no ip route-cache
!
interface Vlan30
 ip address 10.10.30.1 255.255.255.0
 no ip route-cache
!
interface Vlan40
 ip address 10.10.40.1 255.255.255.0
 no ip route-cache
!
interface Vlan192
 ip address 192.168.1.254 255.255.255.0
 no ip route-cache
!
ip default-gateway 192.168.1.1
ip http server
!
ip domain-name domain.internal
ip name-server 10.10.10.2
!
ip dhcp pool vlan10
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 10.10.10.2
 domain-name domain.internal
 lease 0 1 0
 ip dhcp excluded-address 10.10.10.1 10.10.10.10
!
ip dhcp pool vlan20
 network 10.10.20.0 255.255.255.0
 default-router 10.10.20.1
 dns-server 10.10.10.2
 domain-name domain.internal
 lease 0 1 0
 ip dhcp excluded-address 10.10.20.1 10.10.20.10
!
ip dhcp pool vlan30
 network 10.10.30.0 255.255.255.0
 default-router 10.10.30.1
 dns-server 10.10.10.2
 domain-name domain.internal
 lease 0 1 0
 ip dhcp excluded-address 10.10.30.1 10.10.30.10
 !
ip dhcp pool vlan40
 network 10.10.40.0 255.255.255.0
 default-router 10.10.40.1
 dns-server 10.10.10.2
 domain-name domain.internal
 lease 0 1 0
 ip dhcp excluded-address 10.10.40.1 10.10.40.10
!
end

From the switch I can get to the internet no problem, but none of the clients connected to the switch can. I suspect it is a problem with my switchport configuration on GigabitEthernet0/2, but I am a server guy, not a network guru and in a bit over my head here.

Improve this question
5
  • 1. The DG for the clients should be the VLAN interface ip address in their respective VLAN. 2. I'm pretty sure you need to set up port GigabitEthernet0/2 as a routed port, not as an access port or a trunk port.
    – joeqwerty
    Mar 30, 2013 at 17:59
  • I think you need to configure some virtual interfaces. The 2960 isn't a true Layer 3 switch, and is quite limited in its routing capability. I also don't see ip routing on the that config. It would be better if you could post the whole thing.
    – Dan
    Mar 30, 2013 at 18:02
  • 2960 won't do routed ports, and you have to use 'sdm prefer lanbase-routing' to even get it to do basic routing. I'm also not sure that 12.2(44) will support the 2960 doing routing.
    – cpt_fink
    Mar 30, 2013 at 18:04
  • cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/… is the configuration guide page for setting up routing on a 2960
    – cpt_fink
    Mar 30, 2013 at 18:08
  • Updated with the entire config. @cpt_fink - you are correct, I actually looked at the wrong number, the switch is running 12.2(58) SE2
    – Gus
    Mar 30, 2013 at 18:12

3 Answers 3

Reset to default
3

You need to use the 'ip route 0.0.0.0 0.0.0.0 192.168.1.1' command like you mentioned instead of the existing 'ip default-gateway' command. 'IP route' commands work for all traffic while 'ip default-gateway' is only for traffic originated by that switch.

Also unless whatever is attached to Gi0/2 is a switch configured to trunk you don't want Gi0/2 to be a trunk, you just want it to be an access port.

int gi0/2
switchport mode access
switchport access vlan 192

And you also need to make sure that 192.168.1.1 knows to route 10.10.10.0/24, 10.10.20.0/24 10.10.30.0/24 and 10.10.40.0/24 back to 192.168.1.254.

Improve this answer
4
  • Awesome - thank you for the help! Adding the route back to 10.10.10.0/24 et. al. did the trick. This does present another problem though - This setup is to support a temporary network at a convention center, so I will most likely not have access to the upstream configuration. Is there any way to make this work without changing the upstream router?
    – Gus
    Mar 30, 2013 at 19:44
  • If you don't have control over the upstream router you would need to NAT the outbound packets so their source IP appears to be whatever IP the upstream is going to send back to you. A 2960 cannot do NAT.
    – cpt_fink
    Mar 30, 2013 at 19:47
  • Yikes - that's bad news... Maybe I can get their tech guys to fix me up. You've gotten me much closer though, thanks for the help! Actually - I can probably just stick a cheap linksys router between my switch and the convention center internet (the intranet performance is much more important that the internet, so I think that will work out).
    – Gus
    Mar 30, 2013 at 19:50
  • No prob. If you talk to the convention guys, depending on their setup they might be able to route some networks to you, or they might have other options to help you out.
    – cpt_fink
    Mar 30, 2013 at 19:51
3

Before reading the rest

Unfortunately, I don't have enough reputation on the SO-site to ask questions so I've made a lot of rough assumptions in the below answer. Please, please, please elaborate and ask questions before taking action on anything below.

The software version

The revision isn't the only important piece of information - the "train", or "feature family" is also important. Example;

 # show version | include image  
 System image file is "flash:me340x-metroipaccessk9-mz.122-55.SE5.bin"

In this example, I'm using metroipaccess on an ME3400-device. It has routing features and can do all sorts of interesting stuff.

The interesting stuff you want to do in this case is use routing features. The ip route xxx command will not do anything to the traffic coming from the clients unless you are using routing software as it only applies to the "administrative" traffic coming from the switch itself.

If you don't have access to the software (licenses are not cheap) but you have a router that is vlan-aware, you should instead do this.

Network design

Using a router

Assuming you have a vlan/trunk capable router, create interface vlans on the device and make them all part of a vrf/vrf-lite so that the router can push traffic between them. Make a default route in the VRF.

Here's an image of two possible ways: graphic!

Depending on your cabling, you can have a cable directly from the router (red line to cloud) or from the switch (black line to the cloud).

If you don't have inter-vlan/vrf capability...

Assuming 192.168.1.1 is a router that you control

Expand your /24 to a /22. Get rid of the vlans. You're going to have A THOUSAND possible hosts there. It's not pretty, but AFAICT from the above, you wanted to have indiscriminate inter-vlan routing anyway, only using vlans to cut down the size of your broadcast domain, which is important in itself, but if you don't have the right equipment, you have to make do.

Improve this answer
0

From what you're saying I don't see a point for doing this:

 interface GigabitEthernet0/2
  switchport access vlan 192
  switchport trunk native vlan 192
  switchport trunk allowed vlan 10-192
  switchport mode trunk
 ..
 interface Vlan192
  ip address 192.168.1.254 255.255.255.0
  no ip route-cache

You could just do:

interface GigabitEthernet0/2
 no switchport
 ip address 192.168.1.254 255.255.255.0

Otherwise you should either set the Gi0/2 port as an access port or make sure that the other end is either access or has a native vlan of 192.

By doing trunking you'll also bridge the vlans with the remote end which complicates things (unless of course you're doing that on purpose).

Finally, as it is alread mentioned, you need "ip route" and no "ip default-gateway".

Improve this answer
2
  • 1
    Except that 2960's (no matter the code or sdm version) cannot do layer 3 physical interfaces.
    – cpt_fink
    Mar 31, 2013 at 0:33
  • Right! My bad..
    – V13
    Mar 31, 2013 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .