I'm having problems with a Cisco Catalyst 2950 switch, specifically I'm unable to connect to the router/get internet access through it. The setup is as follows:

  • WAN connected to Router (MikroTIK model, no actual server here)
  • Router connected to Switch 1
  • Switch 1 connected via fiber to switches 2 and 3, also Catalyst 2950 models

Connections over switches 2 and 3 work, as far as I can tell, quite well. When attempting to patch a new client on switch 1, however, all I get is an "Unidentified Network" and no DHCP lease. Setting a static IP and the router's IP as DNS server and gateway also does not give network access. This behaviour is consistently showing whether the client runs Windows 7, 8.1 or Ubuntu.

The physical connection seems to be working fine, Wireshark shows me ARP packets aplenty flying around. That is the only thing I see, though. Since several different client OS show the same problem, I'm thinking the cause is somewhere in the network. Is there any way a user could introduce such an error? It does, however, only seem to affect new clients, since I have no angry mob of tenants lynching me for this (recently was volunteered to administrate the network of a housing unit, little prior experience in the field).

I also tried adding ARP entries for clients on the router and vice versa, to no avail. Right now I'm looking to gain access to the switch configuration, and would be grateful for any answer as to which settings might cause it.

  • What vlans are on the switches or the router? – Drifter104 Jun 4 '15 at 16:13

[Not sure how much experience you have with switches or Ciscos, so this is a detailed answer just in case. I'm also guessing from a common case, it's possible there's something more advanced and different happening.]

NB. You can gain access to the 2950 by resetting the password without losing the configuration, if you do not know the password - but it requires rebooting the switch so there is some downtime, and it involves a serial connection using a Cisco style console cable. Instructions:


When you have access, use enable to put it in administration mode, and run show running-config. It will list all the settings.

Look for the ports, like:

interface FastEthernet0/1
    switchport access vlan 50

interface FastEthernet0/2
    switchport access vlan 50

Compare the existing working interfaces with the ones you are trying to use that don't work. e.g.

  • The working interfaces have switchport access vlan *n* and you need to add that to the ones you are using:
    • configure terminal
    • interface FastEthernet0/*number*
    • switchport access vlan *number*
    • end
  • or the "broken" interfaces have switchport mode trunk and you need to remove that command from them:
    • configure terminal
    • interface FastEthernet0/*number*
    • no switchport mode trunk
    • end
  • There may be other commands, e.g. relating to port security, which are causing it, but by comparing the working ports and the not-working ports, you should be able to see what's different - and then either add missing lines, or use no xyz to remove extra lines.

Remember to write at the end to save the config changes, or it will be lost when you reboot.

  • This should be exactly what I needed. Especially the password reset without factory reset is incredibly helpful, I didn't even think to look for a way to do that. Thank you very much. – tacito Jun 5 '15 at 16:27
  • 1
    Thanks to TessellatingHeckler's tip on gaining access despite the previous admin losing all passwords (big thank you again), it turns out all ports just had the port-security mac-address sticky flag set. This, coupled with a maximum of 1 for secure MAC addresses and the port-security violation restrict flag caused restricted access for any and all new users/devices, as far as I understand. Apparantly this was not an issue since tenants didn't move in/out for about a year, so the mistake went under the radar. Thanks again. – tacito Jun 5 '15 at 18:57
  • Sounds good! (I've not seen port-security in use ever, so it's more interesting that it turned out to be that, and not VLANs). – TessellatingHeckler Jun 5 '15 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.