VLAN project one afternoon side job, can be done remotely

plinkerton · Sep 2, 2014

Involves 2 VLAN's, one access point, 2 switches.
Should be easy for someone with VLAN knowledge.

PM me if interested.
Needs to be done by Thursday 9/4/2014.

Skins_Brew · Sep 2, 2014

If you post up the specifics we can probably walk you through it.

plinkerton · Sep 2, 2014

I have a Cisco WAP561 Access point that is currently on VLAN 77.
It has the ability to do multiple SSID's on different VLAN's
I need to add an SSID and another VLAN (I'm going to use 99) for some third party devices that don't need to access the corporate network.
The switch is a Cisco 3750 (yes I know they are EOL and not supported, I have several as spares)
VLAN 77 is 172.16.77.0/24
VLAN 99 is 172.16.99.0/24

The 3750 has two ports connected to the firewall, I need to apply 2 different sets of rules and different gateways on the firewall.

The access point is connected to fa2/0/2 on the 3750

On the firewall the 172.16.77.0 network port 1 is connected to 3750 port fa2/0/1.
The firewall address is 172.16.77.1, the VLAN 77 address on the 3750 is 172.16.77.2

On the firewall the the 172.16.99.0 network port 3 is connected to 3750 port fa2/0/3.
The firewall address is 172.16.99.1, the VLAN 77 address on the 3750 is 172.16.99.2

Did I 'splain myself clearly?

pwoolford · Sep 2, 2014

Skins_Brew said:
If you post up the specifics we can probably walk you through it.

Which part do you need help with? Is the WAP561 already configured to use VLAN77 or was it connected to an untagged port?

plinkerton · Sep 2, 2014

pwoolford said:
Which part do you need help with? Is the WAP561 already configured to use VLAN77 or was it connected to an untagged port?

It's connected to untagged port.

The WAP561 LAN address is on VLAN 77. (It's DHCP but is reserved address)

The new SSID is VLAN 99.

plinkerton · Sep 3, 2014

Still no luck if anyone is interested.

xref · Sep 3, 2014

Trunk ports should solve your issue:
http://www.cisco.com/c/en/us/suppor...y/wireless-lan-wlan/69773-vlan-ap-config.html

http://www.cisco.com/c/en/us/td/doc...guration/guide/3750xscg/swvlan.html#wp1100014

matt · Sep 3, 2014

plinkerton said:
Still no luck if anyone is interested.

Where are you? I'm free this evening.

Edit: NM- I'm not playing on 695.

Traveler · Sep 3, 2014

It is really not a good security practice to post this on an open forum. Makes you easier to attack.

boricuamaximus · Sep 3, 2014

Here's a labbed up example. You might want to consider using port channels for your uplink interface as well. for a port channel you will just issue

Current configuration : 2178 bytes
!
version 12.2
no service timestamps log datetime msec
no service timestamps debug datetime msec
service password-encryption
!
hostname NE-SWT
!
enable secret 5 $1$ccccOjDgUmPKrVvqyr10
enable password 7 0822ccccc415F
!
!
!
no ip domain-lookup
!
spanning-tree mode pvst
!
interface FastEthernet0/1
switchport access vlan 9
switchport mode access
switchport voice vlan 21
spanning-tree portfast
!
interface FastEthernet0/2
switchport access vlan 11
switchport mode access
switchport voice vlan 21
spanning-tree portfast
!
interface FastEthernet0/3
switchport access vlan 9
switchport mode access
!
interface FastEthernet0/4
switchport access vlan 9
switchport mode access
!

!
interface GigabitEthernet1/1
switchport trunk native vlan 20
switchport trunk allowed vlan 9,11,21,250 (or can use "all")
switchport mode trunk
!
interface GigabitEthernet1/2

!
interface Vlan1
no ip address
shutdown
!
** This makes your virtual interface for the admin vlan. That way you pass all traffic through g0/1 ***
interface Vlan20
description uplink address
ip address 10.10.20.3 255.255.255.224
!
banner motd ^C
WARNING BANNER. AUTHORIZED ACCESS ONLY. THIS COMPUTER SYSTEM IS MONITORED. ANY UNAPPROVED ACCESS WILL BE PROSECUTED!
^C
!
line con 0
!
line vty 0 4
login
privilege level 15
line vty 5 15
login
privilege level 15
!
!
end

int po1
desc XXXX

*** Clear Configure the interfaces you want to assign to a port channel prior to messing with it ***

int range <whichever int you decide min of 2>
channel group 1 mode active
no shut.

Do not configure individual interfaces beyond this point. Do all configs through po1.

int po1:
<configs trunk, native vlan and IP minimum>

matt · Sep 3, 2014

I'm home now- taking a quick look at it.
It appears you're sending the traffic to VLAN 99 tagged to to a port not configured for tagged traffic.
Like this
****
int Fa2/0/3
Switchport access VLAN 99
No shut
********

Try
******
Int fa2/0/3
Switchport mode trunk
Switchport trunk encapsulation dot1q
No shut
********

This is a very simplistic suggestion and I'm assuming you understand basic Cisco commands.

matt · Sep 3, 2014

plinkerton said:
I have a Cisco WAP561 Access point that is currently on VLAN 77.
It has the ability to do multiple SSID's on different VLAN's
I need to add an SSID and another VLAN (I'm going to use 99) for some third party devices that don't need to access the corporate network.
The switch is a Cisco 3750 (yes I know they are EOL and not supported, I have several as spares)
VLAN 77 is 172.16.77.0/24
VLAN 99 is 172.16.99.0/24

The 3750 has two ports connected to the firewall, I need to apply 2 different sets of rules and different gateways on the firewall.

The access point is connected to fa2/0/2 on the 3750

On the firewall the 172.16.77.0 network port 1 is connected to 3750 port fa2/0/1.
The firewall address is 172.16.77.1, the VLAN 77 address on the 3750 is 172.16.77.2

On the firewall the the 172.16.99.0 network port 3 is connected to 3750 port fa2/0/3.
The firewall address is 172.16.99.1, the VLAN 77 99 address on the 3750 is 172.16.99.2

Did I 'splain myself clearly?

See correction above- this fix it?

boricuamaximus · Sep 3, 2014

matt said:
See correction above- this fix it?

what this guy said.

Also use trunk ports and maybe a port channel for fault tolerance

VLAN project one afternoon side job, can be done remotely

The #1 community for Gun Owners of the Northeast

Member Benefits:

plinkerton

Ultimate Member

Skins_Brew

loves the smell of cosmo

plinkerton

Ultimate Member

pwoolford

AR15's make me :-)

plinkerton

Ultimate Member

Attachments

plinkerton

Ultimate Member

xref

Member

matt

No one special

Traveler

Lighten up Francis

boricuamaximus

Ultimate Member

matt

No one special

matt

No one special

boricuamaximus

Ultimate Member

Users who are viewing this thread

Latest posts

Forum statistics

Latest threads

Forum statistics

Share this page