Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco 877 and 2960 to share ADSL - config problem.

Hi All,

I've got a new 877 and 2960 switch that I'm trying to setup so each port can only see the router via the trunk port and not each other.

I've configured and confirmed 802.1q trunking between fa0/1 and fa0 and can ping between a workstation attached to the switch and the router.

As soon as I create the vlan and assign the workstation port to the vlan I can no longer communicate with the router.

The vlan is in the allowed range - what am I missing?

Thanks is advance.

W

5 REPLIES

Re: Cisco 877 and 2960 to share ADSL - config problem.

Hi Warren

can you post out the config of both your router and the switch ?

regds

New Member

Re: Cisco 877 and 2960 to share ADSL - config problem.

Configs as requested... Don't worry too much about the names and time settings etc, once the setup is working correctly I'll correct the simple stuff.

Thanks again!

switch#show vlan

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/5

Fa0/6, Fa0/7, Fa0/8, Fa0/9

Fa0/10, Fa0/11, Fa0/12, Fa0/13

Fa0/14, Fa0/15, Fa0/16, Fa0/17

Fa0/18, Fa0/19, Fa0/20, Fa0/21

Fa0/23, Gi0/1, Gi0/2

22 laptop active Fa0/22

24 desktop active Fa0/24

1002 fddi-default act/unsup

1003 token-ring-default act/unsup

1004 fddinet-default act/unsup

1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1 enet 100001 1500 - - - - - 0 0

22 enet 100022 1500 - - - - - 0 0

24 enet 100024 1500 - - - - - 0 0

1002 fddi 101002 1500 - - - - - 0 0

1003 tr 101003 1500 - - - - - 0 0

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2

---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------

1004 fdnet 101004 1500 - - - ieee - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0

Remote SPAN VLANs

------------------------------------------------------------------------------

Primary Secondary Type Ports

------- --------- ----------------- ------------------------------------------

switch#show run

Building configuration...

Current configuration : 1460 bytes

!

version 12.2

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname switch

!

enable secret 5 $1$hNTN$eWkptt9QSN1k7Gx/FsvcB/

enable password cisco1

!

no aaa new-model

ip subnet-zero

!

no ip domain-lookup

!

!

!

no file verify auto

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

interface FastEthernet0/1

switchport mode trunk

!

interface FastEthernet0/2

!

interface FastEthernet0/3

!

interface FastEthernet0/4

!

interface FastEthernet0/5

!

interface FastEthernet0/6

!

interface FastEthernet0/7

!

interface FastEthernet0/8

!

interface FastEthernet0/9

!

interface FastEthernet0/10

!

interface FastEthernet0/11

!

interface FastEthernet0/12

!

interface FastEthernet0/13

!

interface FastEthernet0/14

!

interface FastEthernet0/15

!

interface FastEthernet0/16

!

interface FastEthernet0/17

!

interface FastEthernet0/18

!

interface FastEthernet0/19

!

interface FastEthernet0/20

!

interface FastEthernet0/21

!

interface FastEthernet0/22

switchport access vlan 22

!

interface FastEthernet0/23

!

interface FastEthernet0/24

switchport access vlan 24

!

interface GigabitEthernet0/1

!

interface GigabitEthernet0/2

!

interface Vlan1

ip address 10.10.10.2 255.255.255.0

no ip route-cache

!

ip default-gateway 10.10.10.1

ip http server

!

control-plane

!

!

line con 0

line vty 0 4

password cisco1

no login

line vty 5 15

password cisco1

no login

!

end

switch#

New Member

Re: Cisco 877 and 2960 to share ADSL - config problem.

And router :

Router :

yourname#show run

Building configuration...

Current configuration : 6143 bytes

!

version 12.4

no service pad

service tcp-keepalives-in

service tcp-keepalives-out

service timestamps debug datetime msec localtime show-timezone

service timestamps log datetime msec localtime show-timezone

service password-encryption

service sequence-numbers

!

hostname yourname

!

boot-start-marker

boot-end-marker

!

security authentication failure rate 3 log

security passwords min-length 6

logging buffered 51200 debugging

logging console critical

enable secret xxx

!

no aaa new-model

!

resource policy

!

clock timezone PCTime 10

clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 2:00

no ip source-route

ip cef

!

!

no ip dhcp use vrf connected

ip dhcp excluded-address 10.10.10.1

!

ip dhcp pool sdm-pool1

import all

network 10.10.10.0 255.255.255.0

default-router 10.10.10.1

!

!

ip tcp synwait-time 10

no ip bootp server

no ip domain lookup

ip domain name yourdomain.com

ip ssh time-out 60

ip ssh authentication-retries 2

ip inspect name DEFAULT100 cuseeme

ip inspect name DEFAULT100 ftp

ip inspect name DEFAULT100 h323

ip inspect name DEFAULT100 icmp

ip inspect name DEFAULT100 netshow

ip inspect name DEFAULT100 rcmd

ip inspect name DEFAULT100 realaudio

ip inspect name DEFAULT100 rtsp

ip inspect name DEFAULT100 esmtp

ip inspect name DEFAULT100 sqlnet

ip inspect name DEFAULT100 streamworks

ip inspect name DEFAULT100 tftp

ip inspect name DEFAULT100 tcp

ip inspect name DEFAULT100 udp

ip inspect name DEFAULT100 vdolive

!

!

crypto pki trustpoint TP-self-signed-786425023

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-786425023

revocation-check none

rsakeypair TP-self-signed-786425023

!

!

crypto pki certificate chain TP-self-signed-786425023

username cisco1 privilege 15 secret 5xxx

!

!

!

!

!

!

interface ATM0

no ip address

no ip redirects

no ip unreachables

no ip proxy-arp

ip route-cache flow

no atm ilmi-keepalive

dsl operating-mode auto

!

interface ATM0.1 point-to-point

description $ES_WAN$$FW_OUTSIDE$

no snmp trap link-status

pvc 8/35

pppoe-client dial-pool-number 1

!

!

interface FastEthernet0

switchport mode trunk

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface Vlan1

description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$

ip address 10.10.10.1 255.255.255.0

ip access-group 100 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip nat inside

ip virtual-reassembly

ip route-cache flow

ip tcp adjust-mss 1412

!

interface Dialer0

description $FW_OUTSIDE$

ip address negotiated

ip access-group 101 in

no ip redirects

no ip unreachables

no ip proxy-arp

ip mtu 1452

ip nat outside

ip inspect DEFAULT100 out

ip virtual-reassembly

encapsulation ppp

ip route-cache flow

dialer pool 1

dialer-group 1

no cdp enable

ppp authentication pap callin

ppp pap sent-username aaaa password xxx

!

ip route 0.0.0.0 0.0.0.0 Dialer0

!

!

ip http server

ip http authentication local

ip http secure-server

ip http timeout-policy idle 60 life 86400 requests 10000

ip nat inside source list 1 interface Dialer0 overload

!

logging trap debugging

access-list 1 remark INSIDE_IF=Vlan1

access-list 1 remark SDM_ACL Category=2

access-list 1 permit 10.10.10.0 0.0.0.255

access-list 100 remark auto generated by Cisco SDM Express firewall configuratio

n

access-list 100 remark SDM_ACL Category=1

access-list 100 deny ip host 255.255.255.255 any

access-list 100 deny ip 127.0.0.0 0.255.255.255 any

access-list 100 permit ip any any

access-list 101 remark auto generated by Cisco SDM Express firewall configuratio

n

access-list 101 remark SDM_ACL Category=1

access-list 101 deny ip 10.10.10.0 0.0.0.255 any

New Member

Re: Cisco 877 and 2960 to share ADSL - config problem.

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any time-exceeded

access-list 101 permit icmp any any unreachable

access-list 101 deny ip 10.0.0.0 0.255.255.255 any

access-list 101 deny ip 172.16.0.0 0.15.255.255 any

access-list 101 deny ip 192.168.0.0 0.0.255.255 any

access-list 101 deny ip 127.0.0.0 0.255.255.255 any

access-list 101 deny ip host 255.255.255.255 any

access-list 101 deny ip host 0.0.0.0 any

access-list 101 deny ip any any

dialer-list 1 protocol ip permit

no cdp run

!

!

!

!

control-plane

!

banner login ^CAuthorized access only!

Disconnect IMMEDIATELY if you are not an authorized user!^C

!

line con 0

login local

no modem enable

transport output telnet

line aux 0

login local

transport output telnet

line vty 0 4

privilege level 15

login local

transport input telnet ssh

!

scheduler max-task-time 5000

scheduler allocate 4000 1000

scheduler interval 500

!

webvpn context Default_context

ssl authenticate verify all

!

no inservice

!

end

New Member

Re: Cisco 877 and 2960 to share ADSL - config problem.

Okay, figured it out. Was trying way too hard... Thought I'd post this in case someone else has the same query.

The 2960 switch has a 'protected' mode function on a per-port basis. Use the command 'switchport mode protected' and this will force the switch to send all traffic to a l3 device - the dsl router.

No vlans, no trunking, simple.

375
Views
0
Helpful
5
Replies