SF302-08MP Config question - VLANs

[jpm122]

The different terminology used in these new SB switches is so confusing to me, and I'm having a hard time wrapping my brain around how to set up our simple environment.

The SF302 is replacing a 2950-12 switch; the existing 1721 router config isn't changing. We have VLANs created on the router, which hands our DHCP to the Voice, Data, Guest, and VIdeo VLANs. This has worked for years. It still works if I let the phones, PCs, and cameras all live together in VLAN1. But I'd rather not do that. And the phones don't get their DHCP configuration info for TFTP, etc.. We're using a single Fa0/0 interface on the 1721  with sub-interfaces:

interface FastEthernet0.1
encapsulation dot1Q 1 native
ip address 192.168.50.1 255.255.255.0
!
interface FastEthernet0.4
description Voice Network
encapsulation dot1Q 4
ip address 172.16.50.1 255.255.255.0
!
interface FastEthernet0.5
description Guest VLAN
encapsulation dot1Q 5
ip address 192.168.55.1 255.255.255.0
no cdp enable
!
interface FastEthernet0.6
description Video VLAN
encapsulation dot1Q 6
ip address 172.16.55.1 255.255.255.0
no cdp enable
!

The 1721 router is connected to switch port g1, which is in trunk mode, wide open.

What's confusing me is all the tagged/untagged, excluded/forbidden, general/trunk delineations that I've never had to deal with in Cisco land.

My questions:

What configuration do I use for ports e7 and e8, where I have IP cameras that should be on VLAN 6. VLAN 5 and 4 should be blocked from accessing the cameras.

The NVR recording server is on the second gigabit interface, g2. It should be able to talk to the cameras over VLAN 6, as well as computers on VLAN 1 and of course out over the wan connection on the 1721 router.

What is the proper config for ports with a Cisco 7940 IP phone plugged in and a PC connected to the phone for VLAN 1? I turned on the Voice VLAN stuff but I'm not sure how else to set the port, in Catalyst land that's an access or trunk port with the voice VLAN detected by the phone, but this seems different.

I do have the switch set in Layer 3 mode because I don't want the weak 1721 router doing all the inter-VLAN routing when the switch should be much more adept. Once I get my brain wrapped around how these switches work I'm sure they're great, but it sure is tough when you're used to the CLI....

Hope everyone has a good weekend.

[David Hornstein]

You said three weeks ago

My questions:

What configuration do I use for ports e7 and e8, where I have IP cameras that should be on VLAN 6. VLAN 5 and 4 should be blocked from accessing the cameras.

E7 and E8 will be untagged in VLAN6.

You can have a access list in the switch to block access from vlan5 and 4  IP networks  to VLAN6 IP cameras host addresses and have an allow for all other addresses on VLAN 6 and apply the list to associated ports. Below is an example of me blocking access to 10.1.1.11 from the 192.168.20.0 network. But I could still ping other Hosts in the 10.1.1.0 network. Just remember that the ACL has to be bound to interfaces so that it can pattern match the ingressing IP packets.

The NVR recording server is on the second gigabit interface, g2. It should be able to talk to the cameras over VLAN 6, as well as computers on VLAN 1 and of course out over the wan connection on the 1721 router.

What is the proper config for ports with a Cisco 7940 IP phone plugged in and a PC connected to the phone for VLAN 1? I turned on the Voice VLAN stuff but I'm not sure how else to set the port, in Catalyst land that's an access or trunk port with the voice VLAN detected by the phone, but this seems different.

Why not use the voice vlan functionality, but the switch trust DSCP by default, so hopefully QOS should not be a issue.

I do have the switch set in Layer 3 mode because I don't want the weak 1721 router doing all the inter-VLAN routing when the switch should be much more adept. Once I get my brain wrapped around how these switches work I'm sure they're great, but it sure is tough when you're used to the CLI....

These should have a supported CLI by the end of MAY

Hope everyone has a good weekend.