Cisco 3560E VLAN configurations

asterelias · ‎04-08-2011

Dear All,

I need to configure VLANS on my cisco 3560E, I wish to have more that 3 VLAN which cannot access each other and one VLAN that can access all VLAN, Please assist.

Thank you

Alvaro Garcia · ‎04-08-2011

Are you planning to do the routing between VLANs on the 3560E or with a different devices? If you want to do the InterVLAN routing on the 3560 the you just neeed to configure the Interface VLANs for each segment and then configure Access Lists to restrict traffic.

asterelias · ‎04-08-2011

That's what I want to do. Please provide any sample configurations or a detailed manual.

Thank you.

Alvaro Garcia · ‎04-08-2011

The following guide describes how to enable Intervlan Routing on the switch:

http://www.cisco.com/en/US/partner/tech/tk389/tk815/technologies_configuration_example09186a008015f17a.shtml

And this one describes how to configure access list:

http://www.cisco.com/en/US/partner/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml

It is improtant that you defined first the IP asigment of the VLANs and exactly what traffic you want to restrict or allow....

asterelias · ‎04-08-2011

I do not have access to those links. Can you send as files please.

Thanks

hobbe · ‎04-08-2011

This is one way of doing it.

ok first we setup the physical ports for VLAN

int gig1/0/1

switchport mode access

switchport access vlan10

int gig1/0/2

switchport mode access

switchport access vlan20

int gig1/0/3

switchport mode access

switchport access vlan30

no we set the access-lists so we have them ready for when we add them

the access-list will allow the local lan to speak to 10.10.30.0/24 network.

ip access-list extended vlan10

permit ip 10.10.10.0 0.0.0.255 10.10.30.0 0.0.0.255

deny ip any any

the last line is almost redundant but i like to be able to se how many hits it have had and/or log those hits.

ip access-list extended vlan20

permit ip 10.10.20.0 0.0.0.255 10.10.30.0 0.0.0.255

deny ip any any

int vlan10

no shut

ip address 10.10.10.254 255.255.255.0

ip access-group vlan10 in

.

int vlan 20

no shut

ip address 10.10.20.254 255.255.255.0

ip access-group vlan20 in

.

int vlan30

no shut

ip address 10.10.30.254 255.255.255.0

exit

now we setup the routing

.

ip routing

.

Finished.

vlan 10 and 20 can not talk

vlan 30 can talk to vlan 10 and 20.

I might have forgotten somethings.

.

Good luck

HTH

asterelias · ‎04-09-2011

NB: VLAN4 is supposed to access VLAN3 and VLAN2. VLAN2 and VLAN3 should not access VLAN4.

I have tried the configs but it's not working. The access-list seems not to work. I have pasted my configurations below( my router detailsCisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 12.2(50)SE,
RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Sat 28-Feb-09 02:53 by weiliu
Image text-base: 0x00003000, data-base: 0x02400000

ROM: Bootstrap program is C3560E boot loader
BOOTLDR: C3560E Boot Loader (C3560E-HBOOT-M) Version 12.2(44r)SE3, RELEASE SOFTWARE (fc3))

!

interface GigabitEthernet0/1

no switchport

no ip address

!

interface GigabitEthernet0/2

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/3

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/4

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/5

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/6

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/7

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/8

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/9

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/10

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/11

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/12

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/13

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/14

!

interface GigabitEthernet0/15

!

interface GigabitEthernet0/16

!

interface GigabitEthernet0/17

!

interface GigabitEthernet0/18

!

interface GigabitEthernet0/19

!

interface GigabitEthernet0/20

!

interface GigabitEthernet0/21

!

interface GigabitEthernet0/22

!

interface GigabitEthernet0/23

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/24

switchport access vlan 4

switchport mode access

!

interface GigabitEthernet0/25

!

interface GigabitEthernet0/26

!

interface GigabitEthernet0/27

!

interface GigabitEthernet0/28

!

interface TenGigabitEthernet0/1

!

interface TenGigabitEthernet0/2

!

interface Vlan1

no ip address

!

interface Vlan2

ip address 192.168.16.1 255.255.255.240

ip access-group vlan2 in

!

interface Vlan3

ip address 192.168.32.1 255.255.255.240

ip access-group vlan2 in

!

interface Vlan4

ip address 192.168.48.2 255.255.255.240

!

ip classless

ip http server

ip http secure-server

!

ip access-list extended vlan2

permit ip 192.168.16.0 0.0.0.15 192.168.48.0 0.0.0.15

deny ip any any

ip access-list extended vlan3

permit ip 192.168.32.0 0.0.0.15 192.168.48.0 0.0.0.15

deny ip any any

hobbe · ‎04-09-2011

Hi again

so how far have you come ?

Have you gotten the routing to work ?

Does the acess-lists work ?

if you want vlan 4 to be able to speak to vlan 2 and 3 but they should not be able to "speak back"

asterelias wrote:

NB: VLAN4 is supposed to access VLAN3 and VLAN2. VLAN2 and VLAN3 should not access VLAN4.

what do you mean by that ? and what protocols do you want to use ?

1) do you mean that any tcp session should be able to be initiated from vlan 4 and answers in that session should be able to respond from vlan3and2 back to vlan 4 ?

or

2) do you mean that no traffic whatsoever should be able to traverse from vlan3 and vlan2 to vlan4 ?

if you mean 2) then only oneway connection with udp such as fx syslog will be able to function in such an environment.

if you mean 1) this does not support 2 way communication with fx udp. if you want that then you need to use a firewall or a router that can do nat. the 3560 does not have that capability.

If you mean 1) and only use tcp (will not work with anything else than tcp) then you add a line for the response traffic from the vlans

permit tcp 192.168.16.0 0.0.0.15 192.168.48.0 0.0.0.15 established

to filter it down even more you can add source and destination ports.

good luck

HTH