Solved: Re: ACL's on VLAN not isolating traffic - Page 3

lovembsc89 · ‎05-18-2010

I am trying to isolate network 192.168.100.x 255.255.255.0 from the rest of our network. I have connected the two switches via a cable between port 24 on each, and placed those ports on VLAN700. When we connect to the isolated network, we still have access to the other networks. No matter what I do, VLAN700 still says "shutdown" too. I have posted the config of both switches. Any suggestions? Thanks in advance for the assistance.

Configuration of Catalyst 4507:

vtp domain *****
vtp mode transparent
ip subnet-zero
!

no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
power redundancy-mode redundant
!

redundancy
mode sso
!
!
!
vlan internal allocation policy asce
!
vlan 10
!
vlan 100
!
vlan 200
!
vlan 300
!
vlan 400
!
vlan 500
!
vlan 600
!
vlan 700
name wireless
shutdown
!
vlan 800
shutdown
!
interface GigabitEthernet1/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/2
!
interface GigabitEthernet2/1
switchport trunk encapsulation dot1q
!
interface GigabitEthernet2/2
!
interface GigabitEthernet3/1

switchport access vlan 100
!
interface GigabitEthernet3/2
switchport access vlan 100
!
interface GigabitEthernet3/3
switchport access vlan 100
!
interface GigabitEthernet3/4
switchport access vlan 100
!
interface GigabitEthernet3/5
switchport access vlan 100
!
interface GigabitEthernet3/6
switchport access vlan 100
!
interface GigabitEthernet4/1
switchport access vlan 100
!
interface GigabitEthernet4/2
switchport access vlan 100
!
interface GigabitEthernet4/3
switchport access vlan 100
!
interface GigabitEthernet4/4
switchport access vlan 100
!
interface GigabitEthernet4/5
switchport access vlan 100
!
interface GigabitEthernet4/6
switchport access vlan 100
!
interface GigabitEthernet5/1
switchport access vlan 100
!
interface GigabitEthernet5/2
switchport access vlan 100
!
interface GigabitEthernet5/3
switchport access vlan 100
!
interface GigabitEthernet5/4
switchport access vlan 100
!
interface GigabitEthernet5/5
switchport access vlan 100
!
interface GigabitEthernet5/6
switchport access vlan 100
!
interface GigabitEthernet6/1
!
interface GigabitEthernet6/2
!
interface GigabitEthernet6/3
!
interface GigabitEthernet6/4
!
interface GigabitEthernet6/5
!
interface GigabitEthernet6/6
!
interface GigabitEthernet7/1

switchport access vlan 500
switchport mode access
!
interface GigabitEthernet7/2
switchport access vlan 600
switchport mode access
!
interface GigabitEthernet7/3
switchport access vlan 400
switchport mode access
!
interface GigabitEthernet7/4
switchport access vlan 200
switchport mode access
!
interface GigabitEthernet7/5
switchport access vlan 300
switchport mode access
!
interface GigabitEthernet7/6
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/7
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/8
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/9
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/10
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/11
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/12
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/13
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/14
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/15
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/16
switchport access vlan 100

switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/17
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/18
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/19
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/20
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/21
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/22
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/23
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/24
switchport access vlan 700
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet7/25
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/26
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/27
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/28
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/29
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/30
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/31
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/32
switchport access vlan 100
switchport mode access

!

interface GigabitEthernet7/33
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/34
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/35
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/36
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/37
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/38
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/39
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/40
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/41
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/42
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/43
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/44
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/45
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/46
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/47
switchport access vlan 100
switchport mode access
!
interface GigabitEthernet7/48
!
interface Vlan1
ip address 192.168.10.1 255.255.255.0
!

!
interface Vlan100
ip address 172.16.0.1 255.255.0.0
ip access-group 101 in
!
interface Vlan200
ip address 192.168.20.1 255.255.255.0
!
interface Vlan300
ip address 192.168.30.1 255.255.255.0
!
interface Vlan400
ip address 192.168.40.1 255.255.255.0
!
interface Vlan500
ip address 192.168.50.1 255.255.255.0
!
interface Vlan600
ip address 192.168.60.1 255.255.255.0
!
interface Vlan700
ip address 192.168.100.24 255.255.255.0
ip access-group 102 in
!
interface Vlan800
ip address 192.168.80.1 255.255.255.0
!
router eigrp 100
redistribute static
network 172.16.0.0
network 192.168.10.0
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 172.16.0.25
ip route 10.8.2.0 255.255.255.0 172.16.0.111
ip route 10.8.151.0 255.255.255.0 172.16.0.111
ip route 10.9.1.0 255.255.255.0 172.16.0.111
ip route 10.9.2.0 255.255.255.0 172.16.0.111
ip route 10.10.9.0 255.255.255.0 172.16.0.111
ip route 10.10.10.0 255.255.255.0 172.16.0.111
ip route 10.10.120.0 255.255.252.0 172.16.0.111
ip route 10.255.200.0 255.255.255.0 172.16.200.30
ip route 100.15.0.0 255.255.0.0 172.16.0.240
ip route 192.168.15.0 255.255.255.0 172.16.0.12
ip route 192.168.66.0 255.255.255.0 172.16.0.12
ip route 192.168.250.0 255.255.255.0 172.16.0.12
no ip http server
!
!
!
access-list 102 deny ip 192.168.100.0 0.0.0.255 172.16.0.0 0.0.0.255
access-list 102 permit ip 192.168.100.0 0.0.0.255 any

Configuration of Catalyst 3500XL

!
ip subnet-zero
no ip domain-lookup
!
!
!
interface FastEthernet0/1
spanning-tree portfast
!
interface FastEthernet0/2
spanning-tree portfast
!
interface FastEthernet0/3
spanning-tree portfast
!
interface FastEthernet0/4
spanning-tree portfast
!
interface FastEthernet0/5
spanning-tree portfast
!
interface FastEthernet0/6
spanning-tree portfast
!
interface FastEthernet0/7
spanning-tree portfast
!
interface FastEthernet0/8
spanning-tree portfast
!
interface FastEthernet0/9
spanning-tree portfast
!
interface FastEthernet0/10
spanning-tree portfast
!
interface FastEthernet0/11
spanning-tree portfast
!
interface FastEthernet0/12
spanning-tree portfast
!
interface FastEthernet0/13
spanning-tree portfast
!
interface FastEthernet0/14
spanning-tree portfast
!
interface FastEthernet0/15
spanning-tree portfast

!
interface FastEthernet0/16
spanning-tree portfast
!
interface FastEthernet0/17
spanning-tree portfast
!
interface FastEthernet0/18
spanning-tree portfast
!
interface FastEthernet0/19
spanning-tree portfast
!
interface FastEthernet0/20
spanning-tree portfast
!
interface FastEthernet0/21
spanning-tree portfast
!
interface FastEthernet0/22
spanning-tree portfast
!
interface FastEthernet0/23
spanning-tree portfast
!
interface FastEthernet0/24
switchport access vlan 700
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree portfast
!
interface GigabitEthernet0/1
mtu 1600
duplex full
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet0/2
!
interface VLAN1
ip address 172.16.0.15 255.255.0.0
no ip directed-broadcast
no ip route-cache
!
interface VLAN200
no ip directed-broadcast
no ip route-cache
shutdown
!
interface VLAN700
ip access-group 102 out
no ip directed-broadcast
no ip route-cache
shutdown
!
ip default-gateway 172.16.0.1
snmp-server engineID local 0000000902000004C12B05C0
snmp-server community private RW
snmp-server community public RO

lovembsc89 · ‎05-19-2010

Let me try to clarify this situation.

We have a meeting/training room that needs wireless internet access. Outside the scope of our department, the decision was made to purchase a 3Com OfficeConnect 108Mbps Cable/DSL Router, which we need to make work. The router is set up with a DHCP range, which it assigns to any clients who attach. We are trying to isolate this traffic from the rest of our network, which, at this site is the 172.16.0.x network. There are also 192.168.20,30,40,50, and 60.x networks/subnets at our other sites, which are connected by 100MB fiber in a star topology. (Ideally, we would put the wireless router on our DMZ and assign addresses from there. Unfortunately, we are have a need for many of our DMZ addresses, and are anticipating more of these wireless setups in our other conference rooms at this site, so we don't want to allocate too much of the DMZ address pool for this.)

The only NAT that can be done on this 3Com device is 1 to 1 NAT. The only way I can think of to make that work is to assign them addresses on teh 172.16.0.x network, and that would once again allow access to our internal network, which I'm trying to avoid. If it would allow Hide NAT, we'd be set, but it doesn't.

If this is not a workable solution, feel free to let me know. I would really like to isolate this segment without use of a boatload of DMZ addresses.

The wireless router settings are as follows:

WAN interface: 192.168.100.1 mask 255.255.255.0

There is no place for a gateway.

DHCP Client pool: 192.168.100.2 - 192.168.100.23

The router is jacked into the wall, and from the panel to port0/20 on the 3500XL. There is a cable from port0/24 on the 3500XL to the GB7/24 port on the 4507, which we have trunked. The vlan700 interface on the 4507 has an ip address of 192.168.100.24.

Does this help/make sense?

Richard Burts · ‎05-19-2010

Terri

Yes this information is helpful. What you are telling us is that the wireless router is set up in bridging mode where the address on its outside/WAN interface is in the same subnet/network as its LAN interface and the DHCP pool. And it sounds like the wireless router is not translating addresses for the client addresses.

Can you confirm what the PCs connected to the wireless get for their default gateway? I believe that in a previous post you indicated that their default gateway is the wireless router but can we confirm that? Assuming that is true, then is there an way to set a DHCP parameter to specify a different default gateway for the clients? If so, then set the default gateway for the client workstations to be 192.168.100.24 which is the address of the VLAN 700 interface on the 4507 switch.

HTH

Rick

HTH

Rick

lovembsc89 · ‎05-19-2010

ipconfig on the client shows the WAN address of the Wireless router is the default gateway for the client. I contacted 3Com support and there is no way to feed a different gateway to the clients.

Jon Marshall · ‎05-19-2010

lovembsc89 wrote:

ipconfig on the client shows the WAN address of the Wireless router is the default gateway for the client. I contacted 3Com support and there is no way to feed a different gateway to the clients.

Terri

If it is a wireless router then you need to do this -

1) leave the clients with their 192.168.100.x addresses and the default-gateway as the wireless router

2) use a different IP subnet for vlan 700 and allocate an IP address from this new subnet to the ethernet interface on your wireless router and the 4507 vlan 700 interface.

3) Add a default route on the wireless router -

ip route 0.0.0.0 0.0.0.0 <- note syntax will be different on the wireless router but you should be able to work it out.

4) on the 4507 add a route for the 192.168.100.x network -

ip route 192.168.100.0 255.255.255.0

5) make sure your firewall knows how to route to the 192.168.100.x network ie. send traffic to the 4507

Obviously this means the wireless router will not be running in bridge mode but routing between subnets.

Jon

lovembsc89 · ‎05-19-2010

What I gathered from your response was to put the vlan on the 4507 on a different subnet, such as 192.168.200.x with the WAN address of the wireless router, and have the wireless router assign IP addresses to clients from the original 192.168.100.x subnet. Is that correct?

Apparently this wireless router is not capable of routing between subnets. For instance, if I put 192.168.200.1 as the WAN address of the router, the DHCP pool must be in that same subnet. This product, from what I can tell, is basically made to hang off an internet connection such as a Cable or DSL line and allow small groups access to the internet through it.

Sounds like we're at an impasse. Thoughts?

Jon Marshall · ‎05-19-2010

Terri

Apparently this wireless router is not capable of routing between subnets.

Then it's not a wireless router then is it ?

I think you need to revisit the choice of wireless device because it seems so basic as to be almost unuseable for anything other than home use.

Jon

lovembsc89 · ‎05-19-2010

Thanks so much for your assistance. My original instinct was to buy another device, but with the economy and a non-returnable device, we felt the need to try everything to make it work. At least now everything should be in place when we get another device.

Enjoy your day!

Richard Burts · ‎05-19-2010

Terri

I agree with Jon that this wireless router seems a strange choice. There is a question that I would propose: is it possible to configure a route (or more specifically a default route) on the wireless router. In a previous post you say that it is not possible to set a gateway on the wireless router. But is it possible to configure a route? If so then configuring a default route on the wireless with the next hop being the address of VLAN 700 on the 4507 might solve the problem.

HTH

Rick

HTH

Rick

lovembsc89 · ‎05-19-2010

It will take a static route, but won't use it as a "default" route. It just won't see that hop. We've decided to look for another device.

Thanks for your assistance! I appreciate it.

lovembsc89 · ‎05-19-2010

Not sure what's going on with the ranking, but I clicked on the last star for you for "Extremely Helpful"

and it just highlighted the first one "Not helpful" and I can't change it.

Richard Burts · ‎05-19-2010

Terri

It has been an interesting discussion. I am sorry that we have not come up with a solution for the existing device. But I agree that you would do better with a different device.

I appreciate your use of the rating system to indicate that this discussion has been helpful. If the last rating turned into a 1 rather than a 5 it is not a big deal. At least I know that it was an accident and not an indication that the response was not helpful.

Best of luck.

HTH

Rick

HTH

Rick

228340tarun · ‎05-19-2010

On the 4507 switch, use the command to make the vlan alive

interface VLAN700

no shutdown

Also what seems to me is that you have made the 7/24 port as a trunk port and an access port, so use:

int gi7/24

no switchport access vlan 700

this will make the port 7/24 as trunk port

In 3500 switch, use the following commands:

int vlan 700

no shutdown

and

int fa0/24

no switchport access vlan 700

no spanning-tree portfast

donno if u have defined access list 101 in this switch as its not visible in the config u have pasted.

228340tarun · ‎05-19-2010

In 4500 series switch :

interface GigabitEthernet7/24
no switchport access vlan 700

interface VLAN700
no shut

In 3500 series switch :

interface FastEthernet0/24
no switchport access vlan 700

interface VLAN700
no shut

Also not sure you have defines access list 101, as its not visible in the config that u pasted here.