Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

DHCP server and VLAN access issue...

Trying to setup guest access for a WAP4410N. It is plugged into a PoE port on a Catalyst 3750G. Currently LAN access works over VLAN 100, and clients reach the DHCP server and get an IP.

I have a 2nd SSID setup on VLAN 20 for guest access. I've setup a DHCP server in the switch for it:

ip dhcp excluded-address 192.168.20.1 192.168.20.9


ip dhcp pool GUEST-WIFI
    network 192.168.20.0 255.255.255.0
    domain-name domain.com
    dns-server 192.168.100.2 192.168.100.3
    default-router 192.168.20.240
    lease 8

And the PoE port that the WAP is configured as follows:

interface GigabitEthernet0/8

description Cisco WAP4410N

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 20,100

switchport mode trunk

switchport nonegotiate

srr-queue bandwidth share 10 10 60 20

srr-queue bandwidth shape  10  0  0  0

queue-set 2

mls qos trust cos

macro description cisco-wireless

auto qos voip trust

spanning-tree bpduguard enable

And then VLAN 20 is setup in the switch as follows:

interface Vlan20
description Guest Wi-Fi
ip address 192.168.20.247 255.255.255.0

However, I can't even ping, doing an extended ping and selecting vlan20, between 192.168.20.240 and .247. So I imagine I am missing one piece to make traffic flow. Anyone?

Everyone's tags (1)
10 REPLIES

Re: DHCP server and VLAN access issue...

Where is the device with ip 192.168.20.240 located? Normally, the switch vlan ip address is used as the def-gw.

Is it another router somewhere on the lan?

Then please check it's switchport config. Is it also in vlan 20?

New Member

Re: DHCP server and VLAN access issue...

192.168.20.240 is a sub-interface for the LAN port on the router/firewall.

And all of the port config and VLAN config I posted is all in one 3750G switch.

Purple

Re: DHCP server and VLAN access issue...

post a show run output pleaze.

Why did you put bpduguard on a trunk port? Isn't it putting the port in errdisabled state verify with show interface

Anyway I would get rid of this command on a trunk.

regards.

Don't forget to rate helpful posts.
Purple

Re: DHCP server and VLAN access issue...

  As another poster said the interface of the switch the .247 should be your gateway normally . If a device is not using the .247 as the gateway if its going anywhere else off  that subnet it won''t get there if .247 is not used.   If you do a show vlan  does vlan 20 show active with ports in it ? Also make sure your FW is not blocking ping somehow...

New Member

Re: DHCP server and VLAN access issue...

Ok, I have this in there now for Gigabit 0/8:


description Cisco WAP4410N
switchport access vlan 20
switchport trunk allowed vlan 20,100
switchport mode access
speed 100
duplex full
spanning-tree portfast

And the port is the only one that shows up on VLAN 20 when I do a sh ip bri. But still not giving a DHCP IP for VLAN 20...

New Member

Re: DHCP server and VLAN access issue...

Got DHCP working now with the below port settings:

description Cisco WAP4410N
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20,100
switchport mode trunk
switchport nonegotiate
speed 100
duplex full
spanning-tree portfast

However, since the edge router doesn't know about VLAN 20 (and it is managed by the ISP, I can't get into it), the internet connection isn't going out... maybe a route entry?

New Member

Re: DHCP server and VLAN access issue...

And here is the current, running config for the switch, this is a 3560 switch:

Using 10629 out of 524288 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
no aaa new-model
clock timezone PST -8
clock summer-time PDT recurring
ip subnet-zero
ip routing
ip dhcp excluded-address 192.168.102.1 192.168.102.9
ip dhcp excluded-address 192.168.102.101 192.168.102.254
ip dhcp excluded-address 192.168.20.1 192.168.20.9
!
ip dhcp pool DATA-LAN
   network 192.168.102.0 255.255.255.0
   domain-name domain.com
   dns-server 192.168.100.20 192.168.100.30
   default-router 192.168.102.240
   lease 8
!
ip dhcp pool GUEST-WIFI
   network 192.168.20.0 255.255.255.0
   dns-server 4.2.2.2 4.2.2.1
   default-router 192.168.20.240
   lease 8
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
description Connection to Voice GW 2811
switchport access vlan 200
switchport trunk encapsulation dot1q
switchport mode trunk
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/2
description Connection to PNT router
switchport access vlan 100
switchport mode access
!
interface FastEthernet0/3
description IPT Phone ports PoE
switchport access vlan 200
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/4
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/5
description Cisco WAP4410N
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20,100
switchport mode trunk
switchport nonegotiate
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/6
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/7
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/8
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/9
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/10
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/11
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/12
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/13
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/14
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/15
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/16
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/17
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/18
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/19
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/20
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/21
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/22
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/23
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/24
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/25
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/26
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/27
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/28
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/29
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/30
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/31
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/32
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/33
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/34
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/35
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/36
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/37
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/38
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/39
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/40
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/41
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/42
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/43
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/44
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/45
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/46
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/47
description IPT Phone ports PoE
switchport access vlan 100
switchport mode access
switchport voice vlan 200
speed 100
duplex full
spanning-tree portfast
!
interface FastEthernet0/48
description Management Interface
switchport access vlan 100
switchport mode access
speed 100
duplex full
spanning-tree portfast
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface Vlan1
no ip address
shutdown
!
interface Vlan20
description Guest Wi-Fi
ip address 192.168.20.246 255.255.255.0
!
interface Vlan100
ip address 192.168.102.246 255.255.255.0
!
interface Vlan200
ip address 192.168.202.246 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.202.240
ip http server
!
snmp-server community public RO
!
control-plane
!
!
line con 0
password password
login
line vty 0 4
password password
login
line vty 5 15
password password
login
!
ntp server 192.168.100.20 key 0 prefer
end

Switch#

New Member

Re: DHCP server and VLAN access issue...

Hi,

I just want to make sure first off that :

ip route 0.0.0.0 0.0.0.0 192.168.202.240

192.168.202.240 in your default route is actually your ISP's sub interface to you, on their equipment not yours?  If not it should be, but I don't see any other reference to it in your router config other than it looks like it belongs to vlan 200.

I have experienced problems with vlans and no trunking.  Basically I think if you want to maintain the vlan integrity all the way to your ISP, you would want to have them setup a trunk port to your router and you do the same to thiers.  I don't think this is terribly standard though.

Something that might be more flexible on your end is to setup a NAT on your router to NAT everything to a single ip address heading out and have that be default routed. That way the ISP only has to have one route statement to get traffic back to you and use only one or a smaller block of numbers to you.  Otherwise they will have to route both vlan's back individually I would guess.

I have not had this specific problem before, my connection to my ISP is ethernet and handled through a firewall which basically NAT's everything out.My internal default route is to my firewall and the firewalls default route is to my ISP's IP address assigned to me on his rotuer.  Where I get into trouble is when I add a seperate vlan and subnet I generally have to add a return route in my firewall and a NAT statement to make sure the ISP will pass the traffic out to the Internet.

Just a thought.

Cheer

Kevin

New Member

Re: DHCP server and VLAN access issue...

Kevin,

I think you are on the right path. Yes, that IP is on VLAN 200, and it is the voice VLAN. Unfortunately the router it goes to is managed by the ISP, and I just need to call them and change access for VLAN 20, make one NAT'ed route, or something else to change the config.

I was just thinking this might all be overly complicated for trying to setup Guest WiFi with the WAP4410N. I thought I wouldn't end up with a bunch of switch configuration, just to give some people internet access.

Maybe there is a better way to simply segregate the WiFi traffic?

New Member

Re: DHCP server and VLAN access issue...

I know just what you mean.  I recently setup guest access on a 1252 ap in my network.  I wanted to keep it private

so it wouldn't have access to my business network, and I also run 4 ssid's to 4 seperate vlans on my ap.

What I did was pretty similar to your ap config and I also had a 2950 as the next hop from the ap. You already setup the trunking whcih I hadn't done from the start, but was required to get the ap to send the various vlan traffic to the next hop.  From there I had 2 more switch plants to go throguh and had to have the vlans at least identified on each switch in the path.  These weren't vlan sub interfaces just the vlan declarations.  The other two switch plants were also trunked together and already passing other vlan traffic.

What I ended up doing was having my firewall by the default gateway for the guest access, which is unique to only this vlan.  I also had the firewall be the dhcp server for the guest access.  Since I had no vlan interfaces defined on any of my switches there was no routed access to my internal network and I blocked routed access on my firewall with a security-level statement that was a lower number than my business traffic.

Then all I had to do was to add the NAT statement in my firewall to NAT this traffic out an ISP accepted IP address and it worked perfectly.

The only true downside to this for me is that my guest access has zero access to me internal network, and without some additional configuration in the firewall, it never will.  This is what I wanted at the time, but I now can see it would be good to allow internal access for some applications to be truely flexible.  But since it is open guest access I still would rather not risk it.

As an off-topic I just want to make sure I understand but your voice vlan is actually up on your ISP's vlan?  Does that mean the ISp is your voice server?  We also have a voice vlan internally, and the only outside access to the internet we allow is for the voice server to pickup updates from Cisco.  My phone devices don't have any access to the Internet.

At any rate if you can get your ISP to handled the vlan 20 I think you will be golden on this issue, because it would be them who would determine the default route to the Internet I think at this point, so you may not even need to do the NAT on your end, I would guess your ISP would do the NAT for you along with your regular outgoing traffic.

So you might be done on your end at this point. I think a more normal way to do this that would keep your ISP out of the loop is to have your gateway be on your internal router of swtich that way all of this and any other changes you wanted to do internally to your network would only invovle you and not your ISP.  That would also keep your ISP from knowing your intenal network structure.  You could do this and still let them handle the firewall duties I think.

Cheers

Kevin Pulford

.

1503
Views
0
Helpful
10
Replies