topic Cisco 3750X And VLANS in Wireless

Cisco 3750X And VLANS

dcgtechnologies — Tue, 14 Oct 2025 03:55:34 GMT

Hi All,

I am not a stranger to Cisco Switches, but a newbie to VLANs and have had some confusion with them. I am trying to implement a 9800 wireless lan controller. but I am putting it on hold until I get all my Vlans Setup correctly.

I have a total of five vlans. See below

vlan 100 - Internal network with RADUIS server and domain and main network with Default Gateway out to the internet

vlan 200 - Wifi SSD For separate devices to connect to vlan 100 and go out to the internet that are not on the domain

vlan 300 - Wifi SSD for devices for my smart home automation and nest protect etc.

vlan 400 - For an SSID for my garage for internet access

vlan 900 - management of all network and server devices

Here are a couple sample ports that are assigned out to physical devices from a port on the switch and I am running two 3750X switches and all other ports are on native vlan 100. See below:

Vlan100 - Internal Network - About 50% of the ports are assigned to this vlan as this is the native Vlan for Internal network

interface GigabitEthernet1/0/12
switchport access vlan 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

Vlan200 and VLAN300 Share This Port - Three Wifi SSID's

iinterface GigabitEthernet1/0/48
switchport access vlan 100
switchport trunk allowed vlan 100-300,900
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

VLAN400 - 1 Wifi SSID

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

Vlan900 - Management network

interface GigabitEthernet1/0/2
switchport access vlan 900
switchport trunk encapsulaton dot1q
switchport trunk native vlan 900
switchport mode trunk

I run a Zyxel Firewall and right now my Default Gateway is an untagged interface on the zyxel firewall. I would like it to be put under VLAN100. This device does all my routing within my network. Right now it is not working correctly, because when I introduce the VLAN100 profile with ip address 192.168.100.1 my whole network drops and loses access to everything and I have to rollback to the untagged interface for the firewall. I am keeping the same ip address of 192.168.100.1 as I do not want to Re-IP all my devices.

Here is the port that is configured to connect to firewall. See below:

interface GigabitEthernet1/0/1
switchport access vlan 100
switchport trunk allowed vlan 100-400,100
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

I am working with my vendor and they do not understand Cisco switches, but I have a small understanding but trying to understand if my vlan configuration is correct based on the sample set of ports I have provided. I want all VLANS to have access to VLAN100 for internet and also pull resources from the servers etc. I will be using the 9800 WLC on vlan100 and vlan900. I can hit everything if I leave the untagged interface on the Zyxel with no vlan on it, but as soon as I move to the VLAN100 profile nothing works at all. Does anyone have any tips or things I should check? Thank you.

Re: Cisco 3750X And VLANS

Mark Elsen — Tue, 14 Oct 2025 06:27:58 GMT

- @dcgtechnologies Did you also create the vlans on the switch ?

Re: Cisco 3750X And VLANS

balaji.bandi — Tue, 14 Oct 2025 06:41:28 GMT

You have not mentioned how you connected the WLC 9800 and the Cat switch. Do you have a high-level diagram of how these are linked? (or am i missing to read here ?)

If you connected a port-channel between the WLC and the Cat 3750, you need to configure it that way to achieve high availability.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#Linkaggregationmode

Re: Cisco 3750X And VLANS

dcgtechnologies — Tue, 14 Oct 2025 15:50:25 GMT

Hi Mark,

All vlans are on the switch as follows. See below:

1 default active Gi1/1/2, Gi1/1/3, Gi1/1/4
100 Internal_Network active Gi1/0/11, Gi1/0/14, Gi1/0/15
Gi1/0/16, Gi1/0/19, Gi1/0/20
Gi1/0/21, Gi1/0/22, Gi1/0/25
Gi1/0/26, Gi1/0/27, Gi1/0/28
Gi1/0/29, Gi1/0/30, Gi1/0/38
Gi1/0/42, Gi1/0/43, Gi1/0/45
Gi1/0/46
200 Wifi1_Network active
300 Wifi2_Network active
400 Wifi3_Network active
900 Mgmt_Network active Gi1/0/6

They are all on switches and labeled. I am just trying to see if my base configuration is setup correctly before I even move on with the 9800 WLC.

When I run the command show vlan br a port below for example

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

should show here. See below

400 Wifi3_Network active

but it does not that is why I am confused. Should it show there when that command is ran?

Thank you Mark.

Re: Cisco 3750X And VLANS

dcgtechnologies — Tue, 14 Oct 2025 15:34:49 GMT

Right now I am not concerned with 9800 WLC as I am more concerned with the VLAN setup on the switches to make sure they are configured correctly so I can then I can move back to the 9800 WLC. Thank you.

Re: Cisco 3750X And VLANS

Mark Elsen — Tue, 14 Oct 2025 15:56:41 GMT

- @dcgtechnologies On the switch this looks all good. As far as the connection with the Zyxel firewall is concerned,
you will have to make sure that the firewall understands vlans and vlan tagging AND
that the port on the firewall are configured in the correct vlan and allow traffic from it.
For the 9800 I understood you where using vpsphere ; you must also
then make sure that those vlans become known in vsphere and can be made available
on the (virtual) interfaces of the 9800 virtual controller.

Re: Cisco 3750X And VLANS

dcgtechnologies — Tue, 14 Oct 2025 16:55:53 GMT

Hi Mark.....Thank you for all your replies. I am working with the vendor on this for my firewall and I think I have narrowed the issue down to my Dell VRTX which runs a R1-2401 switch inside the VRTX so I am working with Dell to get the VRTX configured correctly as I am using two of the four blades for vsphere. Right now I am halting all progress on the 9800 WLC until I get all my Vlans configure correctly to support the WLC.

On the second part I was curious. When I run the command show vlan br a port below for example

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

should show here. See below

400 Wifi3_Network active

and also with

900 Mgmt_Network active

interface GigabitEthernet1/0/2
switchport access vlan 100
switchport trunk allowed vlan 100,900
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

I have six of these ports and they do not show up when I run show vlan br and are not located on that table at all. Any idea why? Thank you Mark!

Re: Cisco 3750X And VLANS

Rich R — Tue, 14 Oct 2025 21:13:27 GMT

@dcgtechnologies You have those ports configured as Trunk ports - which is why they don't show. Only access port VLANs will show there.

Note that there is special configuration required on VMware to support 9800-CL (I presume that is what you are planning to deploy?). Refer to https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#C9800CLconsiderations and the 9800-CL installation and setup guides.

If your firewall only needs to access VLAN 100 then why do you want to use VLAN tagging on the port? Why not just make it an access port in VLAN 100? (don't make it more complicated than it needs to be).

Re: Cisco 3750X And VLANS

dcgtechnologies — Tue, 14 Oct 2025 22:58:07 GMT

@Rich R Hello Rich,

Thank you for the explanation about the first point and yes I did follow that guide you mentioned as well as four others out there so I have a good grasp on the setup, but I need my network and VLAN's fixed before I proceed, because the Dell VRTX r1-2401 switch is not configured correctly, which I am working through now.

What would this configuration look like? I do want it to have access to VLAN100 and I think I have over complicated my VLAN setup now that I understand the concepts after reading a lot over the past couple of days. Thank you.

Re: Cisco 3750X And VLANS

Mark Elsen — Wed, 15 Oct 2025 06:10:41 GMT

- @dcgtechnologies This one isn't correct :
interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

You set the port in vlan 100, but only allow vlan 400 on the trunk, so in that case the line protocol on
vlan 100 would remain down, because there is no active physical connection possible,

Re: Cisco 3750X And VLANS

Rich R — Wed, 15 Oct 2025 06:36:55 GMT

@Mark Elsen switchport access vlan 100 is ignored by the switch because switchport mode trunk

Re: Cisco 3750X And VLANS

Rich R — Wed, 15 Oct 2025 06:39:01 GMT

> What would this configuration look like?
interface GigabitEthernet1/0/1
switchport access vlan 100
switchport mode access

Re: Cisco 3750X And VLANS

Mark Elsen — Wed, 15 Oct 2025 06:43:33 GMT

- @Rich R Then I would still remove 'switchport access vlan 100 ' from the port's configuration because of
consistency.

Re: Cisco 3750X And VLANS

Rich R — Wed, 15 Oct 2025 07:44:37 GMT

> Then I would still remove 'switchport access vlan 100 ' from the port's configuration because of consistency.
100% yes - but actually - since the trunk port only has one VLAN (400) and it's the native VLAN (untagged) there is no point in even making this a trunk port - it should be an access mode port in VLAN 400...

Re: Cisco 3750X And VLANS

Mark Elsen — Wed, 15 Oct 2025 08:29:41 GMT

- @Rich R Completely correct; what I would also like to point out for @dcgtechnologies is that when
an SVI (Vlan) is created and not attached to an active connected Gi-interface then the
Vlan will be up , but the line protocol will remain down (as you already observed).

Re: Cisco 3750X And VLANS

dcgtechnologies — Wed, 15 Oct 2025 18:04:20 GMT

@Mark Elsen @Rich R The config for that port would look like this. See below:

Interface GigabitEthernet1/0/47
switchport mode allowed vlan 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

This is how I read it and basically there is no need to make it an access port because it is on the trunk, because of "switchport mode trunk" command. I want its native VLAN to be 400 and it needs access to resources on VLAN100. Is this accurate? Thank you.

Re: Cisco 3750X And VLANS

Rich R — Thu, 16 Oct 2025 06:10:03 GMT

No! It is either trunk or access mode - it can't be both.
"allowed" is not a valid mode for switchport.
"switchport trunk allowed vlan" must list all the VLANs allowed on the port.

interface GigabitEthernet1/0/47
switchport trunk allowed vlan 100,400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

Re: Cisco 3750X And VLANS

balaji.bandi — Thu, 16 Oct 2025 06:36:18 GMT

Configure trunk to allow the required VLAN is the best option

Re: Cisco 3750X And VLANS

srimal99 — Thu, 16 Oct 2025 10:05:58 GMT

show interface trunk on cisco switch will displays information about the active trunk interfaces on a switch, including the mode, encapsulation type, status, and allowed VLANs for each trunk port. You can verify the link upon configuring.

Re: Cisco 3750X And VLANS

dcgtechnologies — Thu, 16 Oct 2025 17:10:47 GMT

@Rich R Thank you for the wonderful explanation. So I have some switch work to do as my config is really messed up.