Cisco 1841 vlan setup for interfaces

[jordanmfarmer]

Hello,

I am wanting to add vlans to fa0/1 for my LAN connection and I am a beginner working on my CCNA, I am wondering if anyone can help me get a second vlan setup of 10.10.20.0/24

Thank You,

Building configuration...

Current configuration : 1807 bytes
!
! Last configuration change at 14:17:04 UTC Mon Jul 2 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 1841r1
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$hB1U$LV3y9.vgMLl.**bleep**nSOWMV/
!
no aaa new-model
!
dot11 syslog
ip source-route
!
!
!
!
ip dhcp pool default-pool
network 10.10.10.0 255.255.255.0
dns-server 8.8.8.8
default-router 10.10.10.1
!
!
ip cef
ip domain name CCNA-Testing.org
ip name-server 75.75.75.75
no ipv6 cef
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO1841 sn FTX1036W2HR
username admin privilege 15 password 0 admin
!
redundancy
!
!
ip ssh version 2
!
!
!
!
!
!
!
interface FastEthernet0/0
description comcast modem
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
description lan
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
!
!
!
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line aux 0
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[Georg Pauwen]

Hello,

the easiest way to accomplish this is by creating subinterfaces as in the example below. Make sure you add the new IP address spaces to your NAT access list 101, and to configure the switch connected to FastEthernet0/1 as a trunk link on the switch side:

interface FastEthernet0/1.2
encapsulation dot1q 2
description lan
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
!
interface FastEthernet0/1.3
encapsulation dot1q 3
description lan
ip address 10.10.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto

[jordanmfarmer]

Thank you I am working on this now, How would I configure the port to be a trunk instead of access?

[jordanmfarmer]

Here is my new config, my switch is now unable to get any traffic out on vlan 1, is there anything I need to do on the switch?

Building configuration...

Current configuration : 2552 bytes
!
! Last configuration change at 15:52:01 UTC Tue Jul 3 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 1841r1
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$hB1U$LV3y9.vgMLl.**bleep**nSOWMV/
!
no aaa new-model
!
dot11 syslog
ip source-route
!
!
!
!
ip dhcp pool default-pool
network 10.10.10.0 255.255.255.0
dns-server 8.8.8.8
default-router 10.10.10.1
!
!
ip cef
ip domain name CCNA-Testing.org
ip name-server 75.75.75.75
no ipv6 cef
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO1841 sn FTX1036W2HR
username admin privilege 15 password 0 admin
!
redundancy
!
!
ip ssh version 2
!
!
!
!
!
!
!
interface FastEthernet0/0
description comcast modem
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
description lan
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1.2
description LAN
encapsulation dot1Q 2
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.3
description Vlan2
encapsulation dot1Q 3
ip address 10.10.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.4
description vlan3
encapsulation dot1Q 4
ip address 10.10.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 10.10.20.0 0.0.0.255 host 10.0.0.1
access-list 101 permit ip 10.10.30.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.20.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 deny ip 10.10.30.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.20.0 0.0.0.255 any
access-list 101 permit ip 10.10.30.0 0.0.0.255 any
!
!
!
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line aux 0
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[Georg Pauwen]

Hello,

add the lines marked in bold to your configuration. On the switch, make sure the port connected to interface FastEthernet0/1 on the router is configured with:

switchport mode trunk

switchport trunk encapsulation dot1q <-- this is optional and depends on your platform and IOS

Building configuration...

Current configuration : 2552 bytes
!
! Last configuration change at 15:52:01 UTC Tue Jul 3 2018
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 1841r1
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$hB1U$LV3y9.vgMLl.**bleep**nSOWMV/
!
no aaa new-model
!
dot11 syslog
ip source-route
ip dhcp excluded-address 10.10.10.1
!
ip dhcp pool default-pool
network 10.10.10.0 255.255.255.0
dns-server 8.8.8.8
default-router 10.10.10.1
!
ip cef
ip domain name CCNA-Testing.org
ip name-server 75.75.75.75
no ipv6 cef
!
multilink bundle-name authenticated
!
crypto pki token default removal timeout 0
!
license udi pid CISCO1841 sn FTX1036W2HR
username admin privilege 15 password 0 admin
!
redundancy
!
ip ssh version 2
!
interface FastEthernet0/0
description comcast modem
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
description lan
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1.1
description VLAN1
encapsulation dot1Q 1 native
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.2
description LAN
encapsulation dot1Q 2
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.3
description Vlan2
encapsulation dot1Q 3
ip address 10.10.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.4
description vlan3
encapsulation dot1Q 4
ip address 10.10.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Serial0/0/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
ip dns server
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp
!
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 10.10.20.0 0.0.0.255 host 10.0.0.1
access-list 101 permit ip 10.10.30.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.20.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 deny ip 10.10.30.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.20.0 0.0.0.255 any
access-list 101 permit ip 10.10.30.0 0.0.0.255 any
!
control-plane
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line aux 0
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
end

[jordanmfarmer]

So I have all of that configured on my router but my switch doesn't get connectivity out on vlan 2, Below is the config for my router and switch, please note that router config may be a little different as it is on my 2811 router at home and not my 1841 in the office.

Router Config
Building configuration...


Current configuration : 2846 bytes
!
! Last configuration change at 23:49:33 UTC Tue Jul 3 2018
version 15.1
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 2811r
!
boot-start-marker
boot-end-marker
!
!
enable secret 5 $1$bhW/$zDf80yUTXgZ4naYBrjsK/.
!
no aaa new-model
!
!
dot11 syslog
ip source-route
--More--
*Jul 3 23:49:33.203: %SYS-5-CONFIG_I: Configured from console by console
!
!
ip cef
!
ip dhcp excluded-address 10.10.10.1
ip dhcp excluded-address 10.10.10.1 10.10.10.4
ip dhcp excluded-address 10.10.20.1
!
ip dhcp pool Main-Pool
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
dns-server 8.8.8.8
!
ip dhcp pool VLAN2
network 10.10.20.0 255.255.255.0
dns-server 8.8.8.8
default-router 10.10.20.1
!
!
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
!
!
!
license udi pid CISCO2811 sn FTX1302A1ZS
username admin privilege 15 password 0 admin
!
redundancy
!
!
ip ssh version 2
!
!
!
!
!
!
!
!
interface FastEthernet0/0
description WAN (Comcast)
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1
description LAN
no ip address
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface FastEthernet0/1.1
description VLAN1
encapsulation dot1Q 1 native
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.2
description vlan2
encapsulation dot1Q 2
ip address 10.10.20.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface FastEthernet0/1.3
description VLAN3
encapsulation dot1Q 3
ip address 10.10.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Serial0/2/0
no ip address
shutdown
!
interface Serial0/3/0
no ip address
shutdown
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip dns server
ip nat inside source list 101 interface FastEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 10.0.0.1
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 dhcp
!
access-list 101 deny ip 10.10.10.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 10.10.10.0 0.0.0.255 host 10.0.0.1
access-list 101 permit ip 10.10.20.0 0.0.0.255 host 10.0.0.1
access-list 101 permit ip 10.10.30.0 0.0.0.255 host 10.0.0.1
access-list 101 deny ip 10.10.20.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 deny ip 10.10.30.0 0.0.0.255 10.0.0.0 0.0.0.255
access-list 101 permit ip 10.10.20.0 0.0.0.255 any
access-list 101 permit ip 10.10.30.0 0.0.0.255 any
!
!
!
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line aux 0
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login
transport input ssh
!
scheduler allocate 20000 1000
end

















Switch Config

Building configuration...

*Mar 1 22:10:58.455: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 3175 bytes
!
! Last configuration change at 22:10:58 UTC Mon Mar 1 1993
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 2960sw
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$2RzL$BwA5f6Y/JTOfOfKdisPBm/
!
no aaa new-model
system mtu routing 1500
!
!
!
!
crypto pki trustpoint TP-self-signed-1424111616
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1424111616
revocation-check none
rsakeypair TP-self-signed-1424111616
!
!
crypto pki certificate chain TP-self-signed-1424111616
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31343234 31313136 3136301E 170D3933 30333031 30303031
30315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34323431
31313631 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C5DE 474BB70D 04FE5651 E99E35DB F50277AA 4B69C5F8 D502BE6F F70DD356
A4FFA387 2B78DA8D DD83A83B 64B4E45F EFB14CDE 1B56946F FE155468 A93C494C
77F2AA33 736CB730 A7B6F052 B1F535A9 0353F415 DE5C3735 3E199012 44A5BDF0
53AD1B7A 09345638 6E22E3A6 9B8DD5D0 5B73EA6C EB6914EF 1367E391 620CACC6
ADB30203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14FA06D9 7BDBC6AE E6600DF4 AC5402DA 9636E9D5 7C301D06
03551D0E 04160414 FA06D97B DBC6AEE6 600DF4AC 5402DA96 36E9D57C 300D0609
2A864886 F70D0101 05050003 8181004F 6E6AB23D 0BD963AC 7CBB6ACA C70536A2
60C1CEE1 BB9D3C23 DDAF77B9 1434C4C6 07D45693 8DCD21E2 9E6CE0BD 8B614BE1
9139A27D A013C60A 6D636F78 935BD300 52276458 58B17F7C B704146F 840C07E8
F4DDD450 13F7125C 0FFDC829 8A4A4D37 495017C4 8013FDAD EF1C1819 36359B1C
1D3DC5D6 B2519DA1 F8392120 6AE375
quit
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 10.10.10.2 255.255.255.0
!
interface Vlan2
ip address 10.10.20.2 255.255.255.0
!
ip default-gateway 10.10.10.1
ip http server
ip http secure-server
!
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login
line vty 5 15
login
!
end

[Georg Pauwen · Accepted solution]

Hello,

the uplink port needs to be a trunk port. If e.g. FastEthernet0/1 on your switch is connected to the router, change the config as below.

Also, you don't need interface Vlan 2 on the switch.

Building configuration...

*Mar 1 22:10:58.455: %SYS-5-CONFIG_I: Configured from console by console
Current configuration : 3175 bytes
!
! Last configuration change at 22:10:58 UTC Mon Mar 1 1993
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 2960sw
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$2RzL$BwA5f6Y/JTOfOfKdisPBm/
!
no aaa new-model
system mtu routing 1500
!
crypto pki trustpoint TP-self-signed-1424111616
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1424111616
revocation-check none
rsakeypair TP-self-signed-1424111616
!
crypto pki certificate chain TP-self-signed-1424111616
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31343234 31313136 3136301E 170D3933 30333031 30303031
30315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34323431
31313631 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C5DE 474BB70D 04FE5651 E99E35DB F50277AA 4B69C5F8 D502BE6F F70DD356
A4FFA387 2B78DA8D DD83A83B 64B4E45F EFB14CDE 1B56946F FE155468 A93C494C
77F2AA33 736CB730 A7B6F052 B1F535A9 0353F415 DE5C3735 3E199012 44A5BDF0
53AD1B7A 09345638 6E22E3A6 9B8DD5D0 5B73EA6C EB6914EF 1367E391 620CACC6
ADB30203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14FA06D9 7BDBC6AE E6600DF4 AC5402DA 9636E9D5 7C301D06
03551D0E 04160414 FA06D97B DBC6AEE6 600DF4AC 5402DA96 36E9D57C 300D0609
2A864886 F70D0101 05050003 8181004F 6E6AB23D 0BD963AC 7CBB6ACA C70536A2
60C1CEE1 BB9D3C23 DDAF77B9 1434C4C6 07D45693 8DCD21E2 9E6CE0BD 8B614BE1
9139A27D A013C60A 6D636F78 935BD300 52276458 58B17F7C B704146F 840C07E8
F4DDD450 13F7125C 0FFDC829 8A4A4D37 495017C4 8013FDAD EF1C1819 36359B1C
1D3DC5D6 B2519DA1 F8392120 6AE375
quit
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface FastEthernet0/1
description Uplink to Router
switchport mode trunk
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 10.10.10.2 255.255.255.0
!
--> no interface Vlan2
ip address 10.10.20.2 255.255.255.0
!
ip default-gateway 10.10.10.1
ip http server
ip http secure-server
!
line con 0
exec-timeout 30 0
password admin
logging synchronous
login
line vty 0 4
exec-timeout 30 0
password admin
logging synchronous
login
line vty 5 15
login

[jordanmfarmer]

Thank you so much Georg as always you have fixed my issue and everything is working now.