Cisco 2960 inter-vlan routing - unable to access internet

[job]

I'm working with a C2960 running c2960-lanbasek9-mz.122-55.SE12 that supports routing.  I added a couple of VLANs (we'll call them vlan2, vlan3,vlan4, vlan5 and vlan6 etc...) in addition to vlan1 that is created by default.  The VLAN IP's assigned to vlan1 is DHCP (192.168.1.101), vlan2 is 192.168.2.1, vlan3 is 192.168.3.1)

IP routing is enabled.  

When I put a host on vlan2, it can ping the IP address of vlan1 (192.168.1.101) but nothing else on that VLAN.  As my default gateway is on vlan1, hosts on vlan2 or others get no internet access.

Any pointers on where I should be looking?

please help

Building configuration...

Current configuration : 4132 bytes
!
version 12.2
no service pad

no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
!
no AAA new-model
system MTU routing 1500
IP routing
!
IP DHCP pool vlan2
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
!
IP DHCP pool vlan3
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
!
IP DHCP pool vlan4
network 192.168.4.0 255.255.255.0
default-router 192.168.4.1
!
IP DHCP pool vlan5
network 192.168.5.0 255.255.255.0
default-router 192.168.5.1
!
IP DHCP pool vlan6
network 192.168.6.0 255.255.255.0
default-router 192.168.6.1
!
!
!
!

!
!

certificate self-signed 01
3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31343533 37393430 3438301E 170D3933 30333031 30303032
30315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34353337
39343034 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100CB35 B8A65710 1B2AD283 77931DBC 76C1BC1E 25059AFC DA9D2CDD C317EB77
4AD4D9C8 E2FA44F3 7F015C2D F7626C86 CCBBD3EF 2CAF3BEC 089CF7EE 6E9E4FAC
727AD419 85189BC5 525C13AB 73D6C8D6 57506F44 2FB2F391 EEEB1475 8EE97C99
9B4DB79E F25EAE05 A358CA45 563B4115 28CEEB9E DF059F3D 3EBA7969 7A100E09
60D50203 010001A3 67306530 0F060355 1D130101 FF040530 030101FF 30120603
551D1104 0B300982 07537769 7463682E 301F0603 551D2304 18301680 145CC483
6125D8B4 A6CC1C89 B2877F3E F2F51812 34301D06 03551D0E 04160414 5CC48361
25D8B4A6 CC1C89B2 877F3EF2 F5181234 300D0609 2A864886 F70D0101 04050003
818100C2 5E2FA06C B2701E7C F16434AE 1310F355 AC33DFF9 76F1C913 5785DF7F
5A5EAA6E 0C4A8C36 8B3BE429 5190436D 43B7CA34 0F05B081 52A6DBC6 790E38FD
CD55AC20 ED6C186D B623AD2A 7210CF6C C11D85AA 666F75B9 703378AB DFD591D0
3F1058B7 EFABBAD0 9C94EB35 886AB687 AF78C6E6 9D072A43 48EA6D38 8ABD0D94 71F885
quit
!
!
!
spanning-tree mode PVST
spanning-tree extend system-id
!
VLAN internal allocation policy ascending
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
switchport access VLAN 2
switchport mode access
!
interface FastEthernet0/4
switchport access VLAN 3
switchport mode access
!
interface FastEthernet0/5
switchport access VLAN 4
switchport mode access
!
interface FastEthernet0/6
switchport access VLAN 4
switchport mode access
!
interface FastEthernet0/7
switchport access VLAN 4
switchport mode access
!
interface FastEthernet0/8
switchport access VLAN 5
switchport mode access
!
interface FastEthernet0/9
switchport access VLAN 5
switchport mode access
!
interface FastEthernet0/10
switchport access VLAN 6
switchport mode access
!
interface FastEthernet0/11
switchport access VLAN 6
switchport mode access
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
IP address 192.168.1.101 255.255.255.0
!
interface Vlan2
IP address 192.168.2.1 255.255.255.0
!
interface Vlan3
IP address 192.168.3.1 255.255.255.0
!
interface Vlan4
IP address 192.168.4.1 255.255.255.0
!
interface Vlan5
IP address 192.168.5.1 255.255.255.0
!
interface Vlan6
IP address 192.168.6.1 255.255.255.0
!
IP http server
IP http secure-server
IP route 0.0.0.0 0.0.0.0 192.168.1.1
 

!
line con 0
line VTY 0 4
login
line VTY 5 15
login
!
end

[balaji.bandi]

When I put a host on vlan2, it can ping the IP address of vlan1 (192.168.1.101) but nothing else on that VLAN.  As my default gateway is on vlan1, hosts on vlan2 or others get no internet access.

If the Inter vlan working like example :

192.168.2.X IP able to ping 192.168.2.1 and 192.168.1.101 - the Routing working

are you able to get Internet IP range 192.168.1.X ? , you need to add new subnets in NAT uplink router and route back towards switch.

what is the device holding IP address 192.168.1.1 ?

[Richard Burts]

I have 2 comments about this post:

1) the original post tells us "When I put a host on vlan2, it can ping the IP address of vlan1 (192.168.1.101) but nothing else on that VLAN." I am puzzled about this. The posted config shows a very simplified DHCP but does correctly set client default gateway as the vlan IP address. So I would expect that inter vlan routing would allow any device on any of these vlans to have IP connectivity to any other device on these vlans. If ping to devices in other vlans does not work I think we need to look for explanations other than routing problems. My first suggestion would be to check whether there are any firewalls running on these other devices that do not allow ping. In investigating this further it might be helpful if we could see the output of show ip interface status and of show ip route.

2) the original post says "As my default gateway is on vlan1, hosts on vlan2 or others get no internet access" The fact that hosts in other vlans do not have Internet access almost certainly is not related to where the default gateway is but are caused by issues with address translation. It is very likely that the upstream device has address translation configured for 192.168.1.0 but not for any other networks. This will prevent Internet access for those other networks. It is also likely that the upstream device does not have routing information for these other private IP networks.

[job]

sir

1, i don't have firewalls running on the network, i only have cisco 4321 router and ge0/0/0 isp ip and ge0/0/1 192.168.1.1 and it assigns dhcp to the switch 

2, i dont give default-gateway to vlan 1 it uses dhcp from the router but internet works other vlans dont get internet.

how do i give for upstream devices a routing information

Switch#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

C   192.168.1.0/24 is directly connected, Vlan1
S*  0.0.0.0/0 [1/0] via 192.168.1.1

Switch#show ip int
Vlan1 is up, line protocol is up
Internet address is 192.168.1.101/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
Vlan2 is up, line protocol is down
Internet address is 192.168.2.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
Vlan3 is up, line protocol is down
Internet address is 192.168.3.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
Vlan4 is up, line protocol is down
Internet address is 192.168.4.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
Vlan5 is up, line protocol is down
Internet address is 192.168.5.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
Vlan6 is up, line protocol is down
Internet address is 192.168.6.1/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: Check hwidb
FastEthernet0/1 is up, line protocol is up
Inbound access list is not set
FastEthernet0/2 is up, line protocol is up
Inbound access list is not set
FastEthernet0/3 is down, line protocol is down
Inbound access list is not set
FastEthernet0/4 is down, line protocol is down
Inbound access list is not set
FastEthernet0/5 is down, line protocol is down
Inbound access list is not set
FastEthernet0/6 is down, line protocol is down
Inbound access list is not set
FastEthernet0/7 is down, line protocol is down
Inbound access list is not set
FastEthernet0/8 is down, line protocol is down
Inbound access list is not set
FastEthernet0/9 is down, line protocol is down
Inbound access list is not set
FastEthernet0/10 is down, line protocol is down
Inbound access list is not set
FastEthernet0/11 is down, line protocol is down
Inbound access list is not set
FastEthernet0/12 is up, line protocol is up
Inbound access list is not set
FastEthernet0/13 is down, line protocol is down
Inbound access list is not set
FastEthernet0/14 is down, line protocol is down
Inbound access list is not set
FastEthernet0/15 is down, line protocol is down
Inbound access list is not set
FastEthernet0/16 is up, line protocol is up
Inbound access list is not set
FastEthernet0/17 is down, line protocol is down
Inbound access list is not set
FastEthernet0/18 is up, line protocol is up
Inbound access list is not set
FastEthernet0/19 is up, line protocol is up
Inbound access list is not set
FastEthernet0/20 is down, line protocol is down
Inbound access list is not set
FastEthernet0/21 is down, line protocol is down
Inbound access list is not set
FastEthernet0/22 is down, line protocol is down
Inbound access list is not set
FastEthernet0/23 is down, line protocol is down
Inbound access list is not set
FastEthernet0/24 is up, line protocol is up
Inbound access list is not set
GigabitEthernet0/1 is down, line protocol is down
Inbound access list is not set
GigabitEthernet0/2 is down, line protocol is down
Inbound access list is not set

[job]

Switch#show ip int brief
Interface IP-Address OK? Method Status Protocol
Vlan1 192.168.1.101 YES NVRAM up up
Vlan2 192.168.2.1 YES manual up down
Vlan3 192.168.3.1 YES manual up down
Vlan4 192.168.4.1 YES manual up down
Vlan5 192.168.5.1 YES manual up down
Vlan6 192.168.6.1 YES manual up down
FastEthernet0/1 unassigned YES unset up up
FastEthernet0/2 unassigned YES unset up up
FastEthernet0/3 unassigned YES unset down down
FastEthernet0/4 unassigned YES unset down down
FastEthernet0/5 unassigned YES unset down down
FastEthernet0/6 unassigned YES unset down down
FastEthernet0/7 unassigned YES unset down down
FastEthernet0/8 unassigned YES unset down down
FastEthernet0/9 unassigned YES unset down down
FastEthernet0/10 unassigned YES unset down down
FastEthernet0/11 unassigned YES unset down down
FastEthernet0/12 unassigned YES unset up up
FastEthernet0/13 unassigned YES unset down down
FastEthernet0/14 unassigned YES unset down down
FastEthernet0/15 unassigned YES unset down down
FastEthernet0/16 unassigned YES unset up up
FastEthernet0/17 unassigned YES unset down down
FastEthernet0/18 unassigned YES unset up up
FastEthernet0/19 unassigned YES unset up up
FastEthernet0/20 unassigned YES unset down down
FastEthernet0/21 unassigned YES unset down down
FastEthernet0/22 unassigned YES unset down down
FastEthernet0/23 unassigned YES unset down down
FastEthernet0/24 unassigned YES unset up up
GigabitEthernet0/1 unassigned YES unset down down
GigabitEthernet0/2 unassigned YES unset down down

[job]

192.168.2.X IP able to ping 192.168.2.1 and 192.168.1.101 - the Routing working, yes it can ping this example works, but

am getting internet  from ip range 192.168.1.x and i dont know how to add new subnets in NAT uplink router and route back towards switch.

i have router cisco 4321  0/0 isp ip and 0/1 192.168.1.1 and it can assigns dhcp to the switch 

[balaji.bandi]

1, i don't have firewalls running on the network, i only have cisco 4321 router and ge0/0/0 isp ip and ge0/0/1 192.168.1.1 and it assigns dhcp to the switch 

If this router directly connect to Interent from this router you able to reach internet.

i assume below is your setup : (please confirm)

ISP----Router 4331----Switch ---VLAN 1 working, not other VLAN working ? is this correct.

Post the complete config of 4331 and Switch new config

If the Router acting as Layer 3 Gateway and NAT, then you may need trunk config on Router also on Switch ( once we have config, we can may advise what is to be done to fix the issue )

[Richard Burts]

Thanks for the additional information. There are several aspects of the situation which we should address:

1) for each vlan other than vlan 1 there is output like this

Vlan2 is up, line protocol is down
Internet address is 192.168.2.1/24

If the line protocol is down then the IP subnet does not get into the IP routing table. And that would be at least one reason why devices in the other vlans are having problem. One way to investigate this issue would be to post the output of show interface status on the switch. It might also be helpful to see the output of show vlan on the switch.

2) ip routing is enabled on the switch. so the switch should provide inter vlan routing. And the switch has a default route which sends traffic for remote destinations to the switch. So the router might receive an IP packet with a source address in vlan 2. Does the router know anything about vlan 2 or about 192.168.2.0? The router needs to know about the other subnets that are on the switch. You have 2 ways you could accomplish this. You could run a dynamic routing protocol between the router and the switch. Or you could just configure a static route for each of those subnets with the switch address 192.168.1.101 as the next hop. 

3) If devices on the switch in 192.168.1.0 do have Internet access then that is an indicator that the router is doing address translation for that subnet. If other subnets do not have Internet access it is likely that the router is not doing address translation for them. I am guessing that the router configuration for address translation uses an access list which permits 192.168.1.0. You just need to add lines to that acl that permit 192.168.2.0, 192.168.3.0, 192.168.4.0, 192.168.5.0, and 192.168.6.0.

[job]

first thank you for your time @balaji.bandi and @Richard Burts  you both mansion the router knows about other vlans  ? no i don't think so check out my router config

i don't know why on the router ge0/0/1 shows down but the router gives dhcp ip to the switch on vlan 1 (192.168.1.0) and internet works but not other vlans. like you both said the router dont know the other vlans.

Dada-Router#show ip int

GigabitEthernet0/0/0 is up, line protocol is up
Internet address is 196.189.197.214/20
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing Common access list is not set
Outgoing access list is not set
Inbound Common access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain outside
BGP Policy Mapping is disabled
Input features: Virtual Fragment Reassembly, NAT Outside, MCI Check
Output features: Post-routing NAT Outside
IPv4 WCCP Redirect outbound is disabled
IPv4 WCCP Redirect inbound is disabled
IPv4 WCCP Redirect exclude is disabled
GigabitEthernet0/0/1 is down, line protocol is down
Internet address is 192.168.1.1/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing Common access list is not set
Outgoing access list is not set
Inbound Common access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF switching turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
BGP Policy Mapping is disabled
Input features: Virtual Fragment Reassembly, MCI Check
Output features: NAT Inside
IPv4 WCCP Redirect outbound is disabled
IPv4 WCCP Redirect inbound is disabled
IPv4 WCCP Redirect exclude is disabled
GigabitEthernet0 is administratively down, line protocol is down
Internet protocol processing disabled

Dada-Router#show ip int brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 196.189.197.214 YES NVRAM up up
GigabitEthernet0/0/1 192.168.1.1 YES NVRAM down down
GigabitEthernet0 unassigned YES NVRAM administratively down down

Dada-Router#show run
Building configuration...

Current configuration : 3889 bytes
!
! Last configuration change at 23:56:46 UTC Tue Jun 14 2016
!
version 16.9
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Dada-Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 $1$ISQs$V43NdupsMhDwTAJdBPn/A0
!
no aaa new-model
!
ip dhcp excluded-address 192.168.1.1 192.168.1.50
!
ip dhcp pool lan-pool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 213.55.96.166
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint TP-self-signed-3466342005
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3466342005
revocation-check none
rsakeypair TP-self-signed-3466342005
!
!
crypto pki certificate chain TP-self-signed-3466342005
certificate self-signed 01
30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33343636 33343230 3035301E 170D3136 30353237 30323039
30395A17 0D333030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34363633
34323030 35308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
0A028201 0100C9AE 2F43B954 FA76E27E 7FB082E6 CA4D1110 4159A515 6B168C71
C55CCCEE 32EBC759 DC88C6DF 2CD3E29F 4944A4F5 45F15326 EC307AA6 0B8651B1
19009FC0 0F248ECE ACECCD6B 3743CEAA D501DDF3 0F1CB250 0134C4A9 7CE67774
3449E898 E80C98F2 A0864DF4 7319F0E9 8E7C5A6F C23D3DC8 EFC0DC9B FF476091
7FE89F9D CF0CF192 1FCD91BD 29030DAB B7AC99B6 B5FA87F8 EA33E403 2992BC33
108EED19 3BB447F9 1D18F4F4 9BCB4CB4 2FE44F86 E01034B4 1450EF27 412CBC24
52CD67AD 1170EBF8 9A5B3E32 6791051D 1BF8BF51 753C863F CF8DDFB2 4C7ADB43
894D70D2 A2883061 E4EC8470 444496E9 C4A7607D 75498AEA E97EBEE9 B4AF6580
661497BD 1A150203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
301F0603 551D2304 18301680 14D2F4AE 4905DBD4 896E8EF1 A17CA741 E0969C3A
12301D06 03551D0E 04160414 D2F4AE49 05DBD489 6E8EF1A1 7CA741E0 969C3A12
300D0609 2A864886 F70D0101 05050003 82010100 C9459BE6 6FFE8F45 05F114F1
16395D4F 6C81CF67 9975704D 97981921 7F6A596C 7D5B1B7A 9D9E8532 E7340794
4887D262 5BADE9DA C8D48730 01989598 EBEBA185 72322049 2ABEB33C 665D0A81
98C3149E A61E1B56 0EB35F71 DCE794FE 374840F4 F87A8DB5 59237E22 5ECC4265
A55F8137 F17A6DBB 7E9AA751 22C4DD50 692F6E89 A6B52F9B D961CAAE BCADFBFA
FF071D85 C317F27A 351B19EA 2F1AC1BD 9C826100 DD7B86F7 CAD964CB 7FBFFEAE
37A85F69 52663B3D 52ADC39F 8DD295F3 FE662EC9 77209850 D3E3CC97 78AC455E
D4B7A6DA 602A2979 4B3192A4 842A8BE8 0909AEDA 97B670CB E50A3193 E045069D
1242FA58 EF72EFF8 F26E8632 6DA43C0B 990BE2D5
quit
!
license udi pid ISR4321/K9 sn FDO19150W3V
no license smart enable
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
!
!
redundancy
mode none
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip address 196.189.197.214 255.255.240.0
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
negotiation auto
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 196.189.192.1
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password dada2020
login
!
!
!
!
!
!
end

[Richard Burts]

Thanks for the additional information, especially the config of the router.

You say " you both mansion the router knows about other vlans  ? no i don't think so check out my router config" I did not say that the router does know about other vlans, I asked IF the does does know about other vlans and said that the router needs to know about other vlans (and subnets). The posted config makes it very clear that the router does not know about the other vlans/subnets. So you need to add static routes that look something like this

ip route 192.168.2.0 255.255.255.0 192.168.1.101

and do it for all of the other subnets.

The posted router config does show that the router is doing address translation for the 192.168.1.0 subnet using this acl

access-list 1 permit 192.168.1.0 0.0.0.255

you need to add similar lines to the acl for the other subnets.

What is going on with routing is pretty clear and how to fix it should be simple.

What is going on with address translation is pretty clear and how to fix it should be simple.

There is something else going on that is not clear:

- router interface to switch show as down. What is going on here?

- switch vlan interfaces (other than vlan 1) are down. What is going on here? Perhaps posting the output of show interface status from the switch might help shed light on this.

[job]

ip route 192.168.2.0 255.255.255.0 192.168.1.101

i can do this but the switch use dhsp(192.168.1.101 not static ip if the switch restart it can be change)

but i can try this 

ip route 192.168.2.0 255.255.255.0 vlan 1() or i can just give the switch static ip like(192.168.1.2)

what do you think?

[balaji.bandi]

Make a Fixed IP to make it easy i suggested switch should use 192.168.1.2 ( remove this IP from DHCP reservation) or use exiting 192.168.1.101 as fixed IP.

There 2 Methods to fix this issue.

Easy one i can think this way :

On Router :

access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 1 permit 192.168.4.0 0.0.0.255

ip route 192.168.2.0 255.255.255.0 192.168.1.101
ip route 192.168.3.0 255.255.255.0 192.168.1.101
ip route 192.168.4.0 255.255.255.0 192.168.1.101

On Switch

what ever port connected to Router Example :

interface Vlan1
no IP address 192.168.1.101 255.255.255.0

interface FastEthernet0/1
shutdown
no switchport
IP address 192.168.1.101 255.255.255.0
no shutdown

If you do not like thios method let me know so i can write Other One

[Richard Burts]

There are several things to address. Here are my comments:

1) The fact that the switch uses DHCP to get its address was not obvious before and is significant. It does make using static routes more of a challenge. I can think of a couple of options:

- instead of static routes run a dynamic routing protocol between the switch and tplink. This would allow the switch to continue to use DHCP and every time the switch reboots it will form a new neighbor relationship using whatever IP address it currently has. This allows tplink to always have valid routes to those subnets used on the switch.

- probably the easier alternative and certainly the more simple is to change the switch from using DHCP and use a static IP for its vlan 1 interface.

- the alternative to use "ip route 192.168.2.0 255.255.255.0 vlan 1" is problematic. I am not sure if tplink supports this kind of syntax. And if it does then does tplink know about vlan 1? 

I am not expert in tplink and am responding from the perspective of how Cisco gear would handle this. Even if the syntax is supported by tplink, and even if tplink does know about vlan 1 this kind of implementation would not be recommended on Cisco gear. If you do this it forces the device with the static route to arp for every destination address. This makes the device work harder, expend more cpu cycles, have a larger arp table which consumes more memory and more processing cycles to maintain the arp table. So I would suggest that either a static IP or a dynamic routing protocol would be better than this type of static route.

2) Interfaces were down because cables were not plugged in. We can only troubleshoot issues based on the data presented to us. If you want good advice from us then give us good data to work with. Get your environment as fully activated as possible and then gather data for us to evaluate.

3) I appreciate the suggestion from @balaji.bandi to use static IP address for the switch. But I think the approach he suggests to change Fa0/1 from switchport to routed port is problematic. If I understand the original post correctly there are devices connected to switch ports in vlan 1 that currently has successful access to Internet resources. If you remove the IP address from interface vlan 1 and assign it to routed interface Fa0/1 then the devices in vlan 1 will no longer work.  For one thing if the connection from the switch to tplink (Fa0/1) is no longer in vlan 1 then DHCP requests from clients in vlan 1 will no longer reach tplink. And another issue is that the gateway address is no longer part of vlan 1.

[balaji.bandi]

3) I appreciate the suggestion from @balaji.bandi to use static IP address for the switch. But I think the approach he suggests to change Fa0/1 from switchport to routed port is problematic. If I understand the original post correctly there are devices connected to switch ports in vlan 1 that currently has successful access to Internet resources. If you remove the IP address from interface vlan 1 and assign it to routed interface Fa0/1 then the devices in vlan 1 will no longer work.  For one thing if the connection from the switch to tplink (Fa0/1) is no longer in vlan 1 then DHCP requests from clients in vlan 1 will no longer reach tplink. And another issue is that the gateway address is no longer part of vlan 1.

Agreed and a good catch, I was supposed to mention here about the VLAN 1 which was missed here, i was supposed to mentioned there VLAN 1 can be another IP address Range added to it, so all can access the interenet.

Addition to other config

On Router :

access-list 1 permit 192.168.10.0 0.0.0.255

ip route 192.168.10.0 255.255.255.0 192.168.1.101

On Switch

whatever port connected to Router Example :

interface Vlan1
IP address 192.168.10.1 255.255.255.0

Add DHCP Pool should good i guess.

[job]

i did what you said on the switch and router hare is the config 

but still only on vlan 1 internet works not other vlans

i think the vlans not connected with the router 

i dont understand why???? 

Add DHCP Pool should good i guess.

on the router side i already configured dhcp pool on vlan 1 so it duplicates ip address so i didnt add dhcp pool on the switch side on vlan 1 

router config

Dada-Router#show run
Building configuration...

Current configuration : 4386 bytes
!
! Last configuration change at 01:50:06 UTC Sat Jun 18 2016
!
version 16.9
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Dada-Router
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 $1$ISQs$V43NdupsMhDwTAJdBPn/A0
!
no aaa new-model
!
ip dhcp excluded-address 192.168.1.1 192.168.1.50
!
ip dhcp pool lan-pool
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 213.55.96.166
!
!
!
login on-success log
!
!
!
!
!
!
!
subscriber templating
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint TP-self-signed-3466342005
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3466342005
revocation-check none
rsakeypair TP-self-signed-3466342005
!
!
crypto pki certificate chain TP-self-signed-3466342005
certificate self-signed 01
30820330 30820218 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33343636 33343230 3035301E 170D3136 30353237 30323039
30395A17 0D333030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34363633
34323030 35308201 22300D06 092A8648 86F70D01 01010500 0382010F 00308201
0A028201 0100C9AE 2F43B954 FA76E27E 7FB082E6 CA4D1110 4159A515 6B168C71
C55CCCEE 32EBC759 DC88C6DF 2CD3E29F 4944A4F5 45F15326 EC307AA6 0B8651B1
19009FC0 0F248ECE ACECCD6B 3743CEAA D501DDF3 0F1CB250 0134C4A9 7CE67774
3449E898 E80C98F2 A0864DF4 7319F0E9 8E7C5A6F C23D3DC8 EFC0DC9B FF476091
7FE89F9D CF0CF192 1FCD91BD 29030DAB B7AC99B6 B5FA87F8 EA33E403 2992BC33
108EED19 3BB447F9 1D18F4F4 9BCB4CB4 2FE44F86 E01034B4 1450EF27 412CBC24
52CD67AD 1170EBF8 9A5B3E32 6791051D 1BF8BF51 753C863F CF8DDFB2 4C7ADB43
894D70D2 A2883061 E4EC8470 444496E9 C4A7607D 75498AEA E97EBEE9 B4AF6580
661497BD 1A150203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF
301F0603 551D2304 18301680 14D2F4AE 4905DBD4 896E8EF1 A17CA741 E0969C3A
12301D06 03551D0E 04160414 D2F4AE49 05DBD489 6E8EF1A1 7CA741E0 969C3A12
300D0609 2A864886 F70D0101 05050003 82010100 C9459BE6 6FFE8F45 05F114F1
16395D4F 6C81CF67 9975704D 97981921 7F6A596C 7D5B1B7A 9D9E8532 E7340794
4887D262 5BADE9DA C8D48730 01989598 EBEBA185 72322049 2ABEB33C 665D0A81
98C3149E A61E1B56 0EB35F71 DCE794FE 374840F4 F87A8DB5 59237E22 5ECC4265
A55F8137 F17A6DBB 7E9AA751 22C4DD50 692F6E89 A6B52F9B D961CAAE BCADFBFA
FF071D85 C317F27A 351B19EA 2F1AC1BD 9C826100 DD7B86F7 CAD964CB 7FBFFEAE
37A85F69 52663B3D 52ADC39F 8DD295F3 FE662EC9 77209850 D3E3CC97 78AC455E
D4B7A6DA 602A2979 4B3192A4 842A8BE8 0909AEDA 97B670CB E50A3193 E045069D
1242FA58 EF72EFF8 F26E8632 6DA43C0B 990BE2D5
quit
!
license udi pid ISR4321/K9 sn FDO19150W3V
no license smart enable
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
!
!
redundancy
mode none
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0/0
ip address 196.189.197.214 255.255.240.0
ip nat outside
negotiation auto
!
interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside

!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
ip nat inside source list 1 interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 196.189.192.1
ip route 192.168.1.0 255.255.255.0 192.168.1.2
ip route 192.168.2.0 255.255.255.0 192.168.1.2
ip route 192.168.3.0 255.255.255.0 192.168.1.2
ip route 192.168.4.0 255.255.255.0 192.168.1.2
ip route 192.168.5.0 255.255.255.0 192.168.1.2
ip route 192.168.6.0 255.255.255.0 192.168.1.2
!
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 1 permit 192.168.3.0 0.0.0.255
access-list 1 permit 192.168.4.0 0.0.0.255
access-list 1 permit 192.168.5.0 0.0.0.255
access-list 1 permit 192.168.6.0 0.0.0.255
!
!
!
!
control-plane
!
!
line con 0
transport input none
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password dada2020
login
!
!

switch config 
Switch#show run
Building configuration...

Current configuration : 4219 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
system mtu routing 1500
ip routing
!
ip dhcp pool vlan2
network 192.168.2.0 255.255.255.0
default-router 192.168.2.1
!
ip dhcp pool vlan3
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
!
ip dhcp pool vlan4
network 192.168.4.0 255.255.255.0
default-router 192.168.4.1
!
ip dhcp pool vlan5
network 192.168.5.0 255.255.255.0
default-router 192.168.5.1
!
ip dhcp pool vlan6
network 192.168.6.0 255.255.255.0
default-router 192.168.6.1
!
ip dhcp pool vlan1
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
!
!
!
!
crypto pki trustpoint TP-self-signed-1453794048
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1453794048
revocation-check none
rsakeypair TP-self-signed-1453794048
!
!
crypto pki certificate chain TP-self-signed-1453794048
certificate self-signed 01
3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31343533 37393430 3438301E 170D3933 30333031 30303032
30315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34353337
39343034 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100CB35 B8A65710 1B2AD283 77931DBC 76C1BC1E 25059AFC DA9D2CDD C317EB77
4AD4D9C8 E2FA44F3 7F015C2D F7626C86 CCBBD3EF 2CAF3BEC 089CF7EE 6E9E4FAC
727AD419 85189BC5 525C13AB 73D6C8D6 57506F44 2FB2F391 EEEB1475 8EE97C99
9B4DB79E F25EAE05 A358CA45 563B4115 28CEEB9E DF059F3D 3EBA7969 7A100E09
60D50203 010001A3 67306530 0F060355 1D130101 FF040530 030101FF 30120603
551D1104 0B300982 07537769 7463682E 301F0603 551D2304 18301680 145CC483
6125D8B4 A6CC1C89 B2877F3E F2F51812 34301D06 03551D0E 04160414 5CC48361
25D8B4A6 CC1C89B2 877F3EF2 F5181234 300D0609 2A864886 F70D0101 04050003
818100C2 5E2FA06C B2701E7C F16434AE 1310F355 AC33DFF9 76F1C913 5785DF7F
5A5EAA6E 0C4A8C36 8B3BE429 5190436D 43B7CA34 0F05B081 52A6DBC6 790E38FD
CD55AC20 ED6C186D B623AD2A 7210CF6C C11D85AA 666F75B9 703378AB DFD591D0
3F1058B7 EFABBAD0 9C94EB35 886AB687 AF78C6E6 9D072A43 48EA6D38 8ABD0D94 71F885
quit
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/4
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/5
switchport access vlan 4
switchport mode access
!
interface FastEthernet0/6
switchport access vlan 4
switchport mode access
!
interface FastEthernet0/7
switchport access vlan 4
switchport mode access
!
interface FastEthernet0/8
switchport access vlan 5
switchport mode access
!
interface FastEthernet0/9
switchport access vlan 5
switchport mode access
!
interface FastEthernet0/10
switchport access vlan 6
switchport mode access
!
interface FastEthernet0/11
switchport access vlan 6
switchport mode access
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
ip address 192.168.1.2 255.255.255.0
!
interface Vlan2
ip address 192.168.2.1 255.255.255.0
!
interface Vlan3
ip address 192.168.3.1 255.255.255.0
!
interface Vlan4
ip address 192.168.4.1 255.255.255.0
!
interface Vlan5
ip address 192.168.5.1 255.255.255.0
!
interface Vlan6
ip address 192.168.6.1 255.255.255.0
!
ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.1.1
vstack
!
line con 0
line vty 0 4
login
line vty 5 15
login
!
end