Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SG500-52 VLAN routing



first of all I'm new on Cisco switches. In the past I worked with Moxa industrial ethernets switches, but not that deep in detail.


So now I have to install a new network for our laboratory.

I have to use three Cisco SG500-52 switches in stacking mode.


The concept is as following:

For different teams there are different VLANs to be independent and not running in to trouble because of double IP-Addresses.

It's not forseen to configure the VLAN on the computers, since the people shall be able to connect easily with project hardware.

All computers have static IPs.

There are some servers (1 Linux and several Windows Server 2008) which should be accessible (especially for data storage) from all VLANs.


The VLANs on the switches are configured and working well. PCs from different teams are not able to access to other teams PCs.


My problem is i.e.:

PC 1:




VLAN: 30





Server 1:

VLAN 2000 (could be changed if necessary)


All PCs should be able to access the server and to store data on it.


How could I realize this?

I thought it should be possible to configure the switch to handle this routing.


Thanks in advance



New Member

Hi, Kindly share the subnet



Kindly share the subnet mask for PC 1, 2 and 3 and Server 1.

also CLI output for:

show run

show vlan

show vlan brief



New Member

Hi,attached, find the output


attached, find the output of show run and show vlan unfortunately show vlan brief was not recognized by the switch. If you look in the files, don't wonder, I had to remove the most VLAN names.

I changed the configuration to the following:


VLAN 410

Port 2/1/8



VLAN 3000

Port 2/1/38



VLAN 2000

Port 1/1/41



New Member

Dos anyone has an idea?

Dos anyone has an idea?

Hi Steffenmock,First of all,

Hi Steffenmock,

First of all, please keep in mind that I'm not familiar with that model, but let me try to help.

A couple of things, what mode your swich is running? "sh system mode", the other thing is that all ports attached to the end hosts should be in access not in trunk, even if that would work in some cases based on the untagged vlan you set on the trunk, but I would suggest to change them to access ports.



New Member

Hi Aref, system mode is

Hi Aref,


system mode is Router. Okay so to VLAN 2000 is the server allocated. Should I change the port where the server is connected as well to access?

I'm not so familiar with access trunk etc. but if I change to access then I'm only able to select one VLAN, aren't I? But if I have the client which is allocated to VLAN 3000 and the server in 2000, I should somehow access to both, shouldn't I?

Thanks in advance for your help.



Hi Steffen,There are several

Hi Steffen,

There are several conditions you need to take into consideration:

1. edge devices should be in one VLAN and port in access mode

2. trunk would be use if you want to extend isolation between switches or other infrastructure devices such as AP or routers

3. your router on your network SG500-52 should have IP address interface for each VLAN

4. edge devices should have default gateway set to the IP address of the respective VLAN on the switch

5. windows firewall by default would not allow traffic from different subnets and would require some adjustment; for testing you can just simply disable

I am not sure what are the default gateway settings on your PC used for testing, please check it.



All end hosts has to be on

All end hosts has to be on switch access ports, unless you have some compatibility on the end host nic to tag the vlans, but that would not be your case. Try to set all the end hosts (pcs and server) switch port to access, assign each one to its vlan and remove any trunk configuration on any port since in your scenario there is no router on a stick or another switch connected. The routing between vlans should be done by the switch itself and it has nothing to do with trunking.



New Member

Hi,first of all thanks for


first of all thanks for the replies.


With Access configuration on the ports and default gateways on the PCs to its switch IP interface, I'm able to ping all other VLAN IP interfaces. So that's so far even a good result :-)

But I'm not able to ping the IP of PC, located in the other VLAN.

So I'm getting to the switch's IP interface of the VLAN where I want to go, but somehow not to the PCs, located in that VLAN.


You are very welcome

You are very welcome Steffenmock.

As Aleksandra mentioned, by default pcs operating systems has the host firewall enabled by default and most likely block any icmp traffic in inbound direction, so it might be that your ping messages arrive at those pcs but they would be dropped because of the deny rules on their firewalls. Try to disable any firewall/security softwares on one pc and try again, or to configure a shared folder on a pc and try to access it from another.



New Member

Hi,thanks so far.It is partly


thanks so far.

It is partly working now.

I configured all ports as adviced to access, configured the standard gateway of each computer to the switchs IP-Interface and I'm able to connect to my servers,

But now the problem is, I'm as well able to connect from one PC in a VLAN to a PC in another VLAN. I tried to solve it with forbidden settings on the ports, but it didn't help.

Any suggestions?


Thanks in advance



That's because the intervlan

That's because the intervlan routing is enabled. If you can please post your configs for review, anyway, you would do something similar to this, let's say you are going to enable traffic from vlan 1 network to the server, block it towards vlan 2 network and allow it to anyone else:

Switch(config)#ip access-list extended ONLY-TO-SERVER
Switch(config-ip-al)#permit ip
Switch(config-ip-al)#deny ip
Switch(config-ip-al)#permit ip any

interface vlan 1
 service-acl input ONLY-TO-SERVER


Switch(config)#ip access-list extended ONLY-TO-SERVER
Switch(config-ip-al)#deny ip
Switch(config-ip-al)#permit ip any

interface vlan 1
 service-acl input ONLY-TO-SERVER

Also please check out this guide:



CreatePlease login to create content