Problems with cat4003 vlans

mjw123 · ‎08-21-2002

In setting a up cat4003 I have 4 vlans configured through the supervisor's mod and when I go to the router module and type sh vlans it says that no vlans are configured. Anyone have any ideas why?

Also I can't get port 2 to stay up. When I type in no shut on the interface it goes up then down & down again. Again any ideas?

Thanks.

efrahim · ‎08-21-2002

The following URL will help you and explain about the architecture of the 4232-l3 modeule. G3 and G4 are the ports which are connected to port x/1 and x/2 on the switch side where X is the slt number for L3 module

http://www.cisco.com/warp/customer/473/28.html

mjw123 · ‎08-21-2002

Don't know if it will help, I'm only registered as a guest not a customer. Do you know another url I would be able to access as a guest?

Thanks.

efrahim · ‎08-21-2002

I don't think so. You can look at this

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/inst_nts/78_10164.htm

The router switch card shows 34 ports in the show module: 32 switched ports to the front panel and 2 gigabit switched ports directly connected to two of the router's ports:

bang> (enable) sh mod

Mod Slot Ports Module-Type Model Sub Status

--- ---- ----- ------------------------- ------------------- --- --------

1 1 0 Switching Supervisor WS-X4012 no ok

2 2 34 10/100/1000 Ethernet WS-X4232 no ok

3 3 Router Switch Card WS-X4232-L3 no ok

Mod Module-Name Serial-Num

--- ------------------- --------------------

1 JAB02380AYG

2 JAB03210B6Y

3 JAB0417055S

Mod MAC-Address(es) Hw Fw Sw

--- -------------------------------------- ------ ---------- -----------------

1 00-50-73-2a-f3-00 to 00-50-73-2a-f6-ff 1.0 4.5(1) 5.5(1)

2 00-50-73-42-a9-68 to 00-50-73-42-a9-89 1.6

3 00-01-42-06-73-a8 to 00-01-42-06-73-c9 1.0 12.0(7)W5( 12.0(7)W5(14.90

The only configuration added on the Catalyst 4000 side is related to the Gigabit- EtherChannel trunk to the router module:

bang> (enable) sh conf

# ***** NON-DEFAULT CONFIGURATION *****

!

set port channel all distribution mac both

!

#ip

set interface sl0 down

set interface me1 down

!

#set boot command

set boot config-register 0x102

set boot system flash bootflash:cat4000.5-5-1.bin

!

#port channel

set port channel 3/1-2 156

!

#module 1 : 0-port Switching Supervisor

!

#module 2 : 34-port 10/100/1000 Ethernet

!

#module 3 : 34-port Router Switch Card

set vlan 2 3/3

set vlan 3 2/3

set trunk 3/1 nonegotiate dot1q 1-1005

!--- NOTE : Trunk mode needs to be nonegociate as the router module

does not support DTP.

set trunk 3/2 nonegotiate dot1q 1-1005

set port channel 3/1-2 mode on

!--- NOTE : Channel mode needs to be force to ON as the router module

does not support PagP.

end

On the switch, the command show cdp neighbor displays the router module as if it was an external router connected via a Gigabit-EtherChanneling trunk on gigabit ports 3/1 and 3/2:

bang> (enable) sh cdp nei

* - indicates vlan mismatch.

# - indicates duplex mismatch.

Port Device-ID Port-ID Platform

-------- ------------------------------- ------------------------- ------------

2/3 daniella Ethernet0 cisco 2500

3/3 donald Ethernet0 cisco 2500

bang> (enable) sh trunk

* - indicates vtp domain mismatch

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

3/1 nonegotiate dot1q trunking 1

3/2 nonegotiate dot1q trunking 1

Port Vlans allowed on trunk

-------- ---------------------------------------------------------------------

3/1 1-1005

3/2 1-1005

Port Vlans allowed and active in management domain

-------- ---------------------------------------------------------------------

3/1 1-3

3/2 1-3

Port Vlans in spanning tree forwarding state and not pruned

-------- ---------------------------------------------------------------------

3/1 1-3

3/2 1-3

If you have the output of a show trunk command from your Cisco device, you can use Output Interpreter to display potential issues and fixes. To use Output Interpreter , you must be a registered user, be logged in, and have JavaScript enabled.

bang> (enable) sh port channel

Port Status Channel Admin Ch

Mode Group Id

----- ---------- -------------------- ----- -----

3/1 connected on 156 833

3/2 connected on 156 833

----- ---------- -------------------- ----- -----

Port Device-ID Port-ID Platform

----- ------------------------------- ------------------------- ----------------

3/1 bang-rp GigabitEthernet3 cisco Cat4232

3/2 Not directly connected to switch

----- ------------------------------- ------------------------- ----------------

If you have the output of a show port channel command from your Cisco device, you can use Output Interpreter to display potential issues and fixes. To use Output Interpreter , you must be a registered user, be logged in, and have JavaScript enabled.

Router Module Configuration

bang-rp#sh ver

Cisco Internetwork Operating System Software

IOS (tm) L3 Switch/Router Software (CAT4232-IN-M), Version 12.0(7)W5(14.90) INTERIM TEST SOFTWARE

Compiled Fri 26-May-00 15:26 by integ

Image text-base: 0x60010928, data-base: 0x605C8000

ROM: System Bootstrap, Version 12.0(7)W5(15b) RELEASE SOFTWARE

bang-rp uptime is 1 day, 22 hours, 7 minutes

System restarted by power-on

System image file is "bootflash:cat4232-in-mz.120-7.W5.14.90"

cisco Cat4232 (R5000) processor with 57344K/8192K bytes of memory.

R5000 processor, Implementation 35, Revision 2.1

Last reset from power-on

1 FastEthernet/IEEE 802.3 interface(s)

4 Gigabit Ethernet/IEEE 802.3z interface(s)

123K bytes of non-volatile configuration memory.

16384K bytes of Flash internal SIMM (Sector size 256K).

Configuration register is 0x1

bang-rp# sh run

Building configuration...

Current Configuration:

!

version 12.0

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname bang-rp

!

ip subnet-zero

!

interface Port-channel1

no ip redirects

no ip directed-broadcast

hold-queue 300 in

!

interface Port-channel1.2

!--- This interface is configured for dot1q routing with native vlan 1 to

match supervisor configuration.

encapsulation dot1Q 1 native ip address 1.1.1.2 255.255.255.0 no ip redirects no ip directed-broadcast

!

interface Port-channel1.3

encapsulation dot1Q 3

ip address 1.1.1.2 255.255.255.0

no ip redirects

no ip directed-broadcast

!

interface FastEthernet1

!--- This is the out of band interface that you can use for management.

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet1

ip address 3.3.3.2 255.255.255.0

no ip directed-broadcast

!

interface GigabitEthernet2

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet3

no ip address

no ip directed-broadcast

no negotiation auto

channel-group 1

!--- Both port gig 3 and gig 4 are part of the channel-group 1.

!

interface GigabitEthernet4

no ip address

no ip directed-broadcast

no negotiation auto

channel-group 1

!--- Both port gig 3 and gig 4 are part of the channel group 1.

!

router eigrp 1

passive-interface FastEthernet1

network 1.0.0.0

network 2.0.0.0

network 3.0.0.0

!

ip classless

!

arp 127.0.0.2 0050.732a.f300 ARPA

!

line con 0

transport input none

line aux 0

line vty 0 4

login

!

end

chris.mcpeak · ‎08-21-2002

TAC Notice: What's Changing on TAC Web

Help us help you.

Please rate this document.

Excellent

Good

Average

Fair

Poor

This document solved my problem.

Yes

No

Just browsing

Suggestions for improvement:

(256 character limit)

Configuration and Overview of the Router Module for the Catalyst 4000 Family (WS-X4232-L3)

--------------------------------------------------------------------------------

Interactive: This document offers customized analysis of your Cisco device.

--------------------------------------------------------------------------------

Contents

Introduction

Minimum Software and Hardware Requirements

Architecture Overview

Role of the WS-X4232-L3

Role of the Supervisor

Role of the User (Front Panel View)

Configuration of the WS-X4232-L3

Supervisor Engine

Router

Access List Support on the WS-X4232-L3

Sample Configurations

Switch Supervisor Configuration

Router Module Configuration

Conclusion and Tips

Related Information

--------------------------------------------------------------------------------

Introduction

This document describes the WS-X4232-L3 router module for the Catalyst 4000 family. In addition to describing the architecture and configuration of the WS-X4232-L3, we also provide a sample configuration using a Catalyst 4000 and its router module.

Minimum Software and Hardware Requirements

In order to run the router module on the Catalyst 4000, you need at least supervisor CatOS 5.5(1). The first Cisco ® IOS version on the router module is 12.0(7)W5(15d). The Cisco IOS image name of the WS-X4232-L3 starts with Catalyst 4232-, and is located in the software center in either the Catalyst 4232 section of LAN switching software, or in the Cisco IOS software download section with the platform name cat4232.

The router module is supported on both Catalyst 4003 with Supervisor 1, and on Catalyst 4006 with Supervisor 2.

Note: For details on the software features that are supported on the router module (WS-X4232-L3), please refer to the Features section of the Catalyst 4003 and 4006 Layer 3 Services Module Installation and Configuration Note.

Architecture Overview

Role of the WS-X4232-L3

The core of the router module is a 4-gigabit routing switch fabric (similar to the one used on the Catalyst 2948G-L3 and the Catalyst 4908G-L3). Two of the gigabit connections of this routing engine go to the front panel, making gigabit router ports. The two remaining are connected to the backplane. The WS-X4232-L3 also has 32 10/100M ports, which are pure Layer 2 ports and not linked to the routed part.

Role of the Supervisor

The supervisor offers 6 gigabit connections to the WS-X4232-L3 (similar to other modules).

The first two gigabit connections go to 2 gigabit port of the routing engine.

The last four gigabit connections are dedicated to the 32 Layer 2 switch ports (like on WS-X4232-GB-RJ).

Role of the User (Front Panel View)

The WS-X4232-L3 has two gigabit ports and 32 10/100M ports on its front panel. The two gigabit ports are routed ports and the 32 10/100 ports are usually Layer 2 switch ports.

Configuration of the WS-X4232-L3

Supervisor Engine

The show port command will display two gigabit ports and 32 10/100M ports numbered from 1 to 34.

Note: The two gigabit ports seen from the supervisor are not the two port we see on the front panel, they are just the two switched ports that connect to the routing engine. You then need to configure them as switch ports. It is actually like the Multilayer Switch Module (MSM) on the Catalyst 6000. So the more common configuration for these ports will be to set them as Gigabit EtherChannel and trunking, so that we can route between all VLANs on the router.

Note: You can access the router module from the supervisor by issuing the session command. This is similar to accessing the RSM in a Catalyst 5000.

Router

If you are seeing a router prompt, you will see four gigabit interfaces numbered from 1 to 4 (gigabit 1, gigabit 2, and so on) and a FastEthernet out-of-band interface.

Here is the default configuration:

Router# sh run

Building configuration...

Current configuration:

!

version 12.0

service config

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname Router

!

ip subnet-zero

!

interface FastEthernet1

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet1

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet2

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet3

no ip address

no ip directed-broadcast

no negotiation auto

!

interface GigabitEthernet4

no ip address

no ip directed-broadcast

no negotiation auto

!

ip classless

!

arp 127.0.0.2 0050.732a.f300 ARPA

!

line con 0

transport input none

line aux 0

line vty 0 4

!

end

Note: In this configuration, gigabits 3 and 4 are the connection going to the backplane; gigabits 1 and 2 are the user ports on the front panel (routed ports). Most of the time, as on an MSM, you will configure port 3 and 4 to be part of the same interface port channel and you will configure subinterfaces on it (ISL or 802.1q encapsulated) . As on the MSM, the configuration of gigabits 3 and 4 on the router module needs to be consistent with the configuration of port slot/1 and slot/2 on the switch side. You can then check the traffic between the router and the switch by entering the commands sh int port-channel or sh int gigabit .

Access List Support on the WS-X4232-L3

Both control-plane and data-plane Access Control Lists (ACLs) are supported on the WS-X4232-L3 module.

Control-plane ACLs: ACLs used to access control data that is processed by the CPU of the WS-X4232-L3 module (for example, distribution of routing information, IGMP joins, IPX SAPs and GNS packets, and so on)

Data-plane ACLs: ACLs used to access control user data being routed through the WS-X4232-L3 in hardware (for example, denying TCP sessions between two hosts, controlling access to devices in an IPX network, and so on). These ACLs are applied to an interface in the input or output direction using the ip access-group or ipx access-group command.

The following restrictions apply when using data-plane ACLs on the WS-X4232-L3:

ACLs are not supported on Gigabit EtherChannel (GEC) interfaces (that is, you cannot configure a data-plane ACL on a port-channel interface)

ACLs are not supported on subinterfaces of Gigabit EtherChannel (GEC) interfaces (that is, you cannot configure a data-plane ACL on a port-channel subinterface).

Reflexive and dynamic ACLs are not supported

ACL logging, ACL hit counters, and access-violations accounting are not supported

The implication of these restrictions is that you cannot configure the two internal Gigabit Ethernet interfaces as an EtherChannel bundle if you also wish to use data-plane ACLs to control traffic flow between VLANs.

The alternative is to configure each internal gigabit interface as a separate 802.1q trunk, each carrying different VLANs. This alternative is possible because configuring data-plane ACLs on subinterfaces of a main interface is allowed. (See the examples below.)

WS-X4232-L3 Access List Examples

Allowed

interface gig 3

ip address 192.168.100.1 255.255.255.0

ip access-group 101 in

Allowed

interface gig 3.10

encapsulation dot1q 10

ip address 192.168.100.1 255.255.255.0

ip access-group 99 out

Not Allowed

interface gig 3

channel-group 1

interface gig 4

channel-group 1

interface port-channel 1

ip address 192.168.100.1 255.255.255.0

ip access-group 101 in

Not Allowed

interface gig 3

channel-group 1

interface gig 4

channel-group 1

interface port-channel 1.10

encapsulation dot1q 10

ip address 192.168.100.1 255.255.255.0

ip access-group 99 out

Sample Configurations

Our setup is the following (see diagram). We have:

Bang: a Catalyst 4000 with router module in slot 3

Liki: a router attached in gigabit 1 on the router module

Donald: a router attached in VLAN 2 on port 3/3 (one of the Layer 2 port of the router module) of bang

Daniella: a router attached in VLAN 3 on port 2/3 of bang

We are going to create a Gigabit-EtherChannel between the router module and the Catalyst 4000. We will also configure trunking on this Gigabit-EtherChannel. The Gigabit-EtherChannel configuration is quite standard. All the commands specific to this setup will be moved into the port-channel subinterfaces.

This is the configuration and the output of some show commands on the supervisor of the Catalyst 4000 and of the router module to allow routing between the three subnets (VLAN 1, VLAN 2, and the router attached to Gigabit 1).

Switch Supervisor Configuration

The router switch card shows 34 ports in the show module: 32 switched ports to the front panel and 2 gigabit switched ports directly connected to two of the router's ports:

bang> (enable) sh mod

Mod Slot Ports Module-Type Model Sub Status

--- ---- ----- ------------------------- ------------------- --- --------

1 1 0 Switching Supervisor WS-X4012 no ok

2 2 34 10/100/1000 Ethernet WS-X4232 no ok

3 3 Router Switch Card WS-X4232-L3 no ok

Mod Module-Name Serial-Num

--- ------------------- --------------------

1 JAB02380AYG

2 JAB03210B6Y

3 JAB0417055S

Mod MAC-Address(es) Hw Fw Sw

--- -------------------------------------- ------ ---------- -----------------

1 00-50-73-2a-f3-00 to 00-50-73-2a-f6-ff 1.0 4.5(1) 5.5(1)

2 00-50-73-42-a9-68 to 00-50-73-42-a9-89 1.6

3 00-01-42-06-73-a8 to 00-01-42-06-73-c9 1.0 12.0(7)W5( 12.0(7)W5(14.90

The only configuration added on the Catalyst 4000 side is related to the Gigabit- EtherChannel trunk to the router module:

bang> (enable) sh conf

# ***** NON-DEFAULT CONFIGURATION *****

!

set port channel all distribution mac both

!

#ip

set interface sl0 down

set interface me1 down

!

#set boot command

set boot config-register 0x102

set boot system flash bootflash:cat4000.5-5-1.bin

!

#port channel

set port channel 3/1-2 156

!

#module 1 : 0-port Switching Supervisor

!

#module 2 : 34-port 10/100/1000 Ethernet

!

#module 3 : 34-port Router Switch Card

set vlan 2 3/3

set vlan 3 2/3

set trunk 3/1 nonegotiate dot1q 1-1005

!--- NOTE : Trunk mode needs to be nonegociate as the router module

does not support DTP.

set trunk 3/2 nonegotiate dot1q 1-1005

set port channel 3/1-2 mode on

!--- NOTE : Channel mode needs to be force to ON as the router module

does not support PagP.

end

On the switch, the command show cdp neighbor displays the router module as if it was an external router connected via a Gigabit-EtherChanneling trunk on gigabit ports 3/1 and 3/2:

bang> (enable) sh cdp nei

* - indicates vlan mismatch.

# - indicates duplex mismatch.

Port Device-ID Port-ID Platform

-------- ------------------------------- ------------------------- ------------

2/3 daniella Ethernet0 cisco 2500

3/3 donald Ethernet0 cisco 2500

bang> (enable) sh trunk

* - indicates vtp domain mismatch

Port Mode Encapsulation Status Native vlan

-------- ----------- ------------- ------------ -----------

3/1 nonegotiate dot1q trunking 1

3/2 nonegotiate dot1q trunking 1

Port Vlans allowed on trunk

-------- ---------------------------------------------------------------------

3/1 1-1005

3/2 1-1005

Port Vlans allowed and active in management domain

-------- ---------------------------------------------------------------------

3/1 1-3

3/2 1-3

Port Vlans in spanning tree forwarding state and not pruned

-------- ---------------------------------------------------------------------

3/1 1-3

3/2 1-3

If you have the output of a show trunk command from your Cisco device, you can use Output Interpreter to display potential issues and fixes. To use Output Interpreter , you must be a registered user, be logged in, and have JavaScript enabled.

bang> (enable) sh port channel

Port Status Channel Admin Ch

Mode Group Id

----- ---------- -------------------- ----- -----

3/1 connected on 156 833

3/2 connected on 156 833

----- ---------- -------------------- ----- -----

Port Device-ID Port-ID Platform

----- ------------------------------- ------------------------- ----------------

3/1 bang-rp GigabitEthernet3 cisco Cat4232

3/2 Not directly connected to switch

----- ------------------------------- ------------------------- ----------------

If you have the output of a show port channel command from your Cisco device, you can use Output Interpreter to display potential issues and fixes. To use Output Interpreter , you must be a registered user, be logged in, and have JavaScript enabled.

Router Module Configuration

bang-rp#sh ver

Cisco Internetwork Operating System Software

IOS (tm) L3 Switch/Router Software (CAT4232-IN-M), Version 12.0(7)W5(14.90) INTERIM TEST SOFTWARE

Compiled Fri 26-May-00 15:26 by integ

Image text-base: 0x60010928, data-base: 0x605C8000

ROM: System Bootstrap, Version 12.0(7)W5(15b) RELEASE SOFTWARE

bang-rp uptime is 1 day, 22 hours, 7 minutes

System restarted by power-on

System image file is "bootflash:cat4232-in-mz.120-7.W5.14.90"

cisco Cat4232 (R5000) processor with 57344K/8192K bytes of memory.

R5000 processor, Implementation 35, Revision 2.1

Last reset from power-on

1 FastEthernet/IEEE 802.3 interface(s)

4 Gigabit Ethernet/IEEE 802.3z interface(s)

123K bytes of non-volatile configuration memory.

16384K bytes of Flash internal SIMM (Sector size 256K).

Configuration register is 0x1

bang-rp# sh run

Building configuration...

Current Configuration:

!

version 12.0

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname bang-rp

!

ip subnet-zero

!

interface Port-channel1

no ip redirects

no ip directed-broadcast

hold-queue 300 in

!

interface Port-channel1.2

!--- This interface is configured for dot1q routing with native vlan 1 to

match supervisor configuration.

encapsulation dot1Q 1 native ip address 1.1.1.2 255.255.255.0 no ip redirects no ip directed-broadcast

!

interface Port-channel1.3

encapsulation dot1Q 3

ip address 1.1.1.2 255.255.255.0

no ip redirects

no ip directed-broadcast

!

interface FastEthernet1

!--- This is the out of band interface that you can use for management.

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet1

ip address 3.3.3.2 255.255.255.0

no ip directed-broadcast

!

interface GigabitEthernet2

no ip address

no ip directed-broadcast

shutdown

!

interface GigabitEthernet3

no ip address

no ip directed-broadcast

no negotiation auto

channel-group 1

!--- Both port gig 3 and gig 4 are part of the channel-group 1.

!

interface GigabitEthernet4

no ip address

no ip directed-broadcast

no negotiation auto

channel-group 1

!--- Both port gig 3 and gig 4 are part of the channel group 1.

!

router eigrp 1

passive-interface FastEthernet1

network 1.0.0.0

network 2.0.0.0

network 3.0.0.0

!

ip classless

!

arp 127.0.0.2 0050.732a.f300 ARPA

!

line con 0

transport input none

line aux 0

line vty 0 4

login

!

end

bang-rp#sh cdp nei

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge

S - Switch, H - Host, I - IGMP, r - Repeater

Device ID Local Intrfce Holdtme Capability Platform Port ID

liki Gig 1

160 T S

WS-C3508G-Gig 0/1

!--- Liki is connected to gig 1 on the router. We only see Liki from

the router, we do not see it from the supervisor.

JAB02380AYG(bang)Port-channel1 148 T S WS-C4003 3/2

JAB02380AYG(bang)Port-channel1 147 T S WS-C4003 3/1

Conclusion and Tips

Some key points to remember when configuring the routing module on the Catalyst 4000:

The gigabit interfaces you see on the front panel are not the same as the gigabit interfaces you see when you issue show port from the supervisor. These are the interface gigabit 1 and interface gigabit 2 on the router .

The 32 10/100M ports on the front panel are independant of the router module and are configured only from the supervisor as Layer 2 ports.

Configuring the two gigabit connections between the switch and the router as two port Gigabit Ether Channel is just an option (probably the most efficient), but it is not mandatory. You can configure them as independent trunks or as access ports. It just needs to remain consistent with the configuration of the gigabit ports on the switch side.

You can reach the router module from the supervisor prompt by using the session command.

When you configure a native VLAN for 802.1q trunking, make sure you are using the native VLAN only for management traffic and not for data traffic. If you have data traffic on a native VLAN, you will see a performance drop for this traffic because all traffic coming in over the native VLAN on an 802.1q trunk is sent to the CPU to be processed by software instead of routed in hardware.

--------------------------------------------------------------------------------

Related Information

LAN Technical Tips

Catalyst 4000 Product Documentation

--------------------------------------------------------------------------------

Updated: Apr 30, 2002 Document ID: 6198

--------------------------------------------------------------------------------

mjw123 · ‎08-21-2002

I already had those pages printed off but I am new at this and might have missed something. Also does the cat4003 need a Router Switch Card ? The one I'm working on doesn't. It only has a supervisor's module in slot 1 & a routing module in slot 2.

Thanks.

efrahim · ‎08-21-2002

The cat4003 can do routing across vlans with 4232-L3 module which i think you have it in slot 2. Use the above mentioned link to create the VLAns and port channel interfaces to route across the vlans.

mjw123 · ‎08-22-2002

Thanks alot for your help, this has been a great experience trying to get this working.

The url has been helpful.

Thanks again.