How to Inter-connect vlans on cisco router with etherswitch installed (NM-16ESW)?

[ghyacin]

Hey,

I'm pretty new to Cisco commercial equipment's but I'll get straight to the point.

I have a Cisco 2650 with a NM-16ESW module installed, I have vlan 10, 30, 80, 99, and 150 setup.  I have a DHCP server handling IP addresses for all the vlans according to the ports they are set to.  This is done by assigning IP addresses to each vlan along with a IP helper-address to the DHCP server.

Vlan 10 are the servers, vlan 30 are the pc's, etc... I cannot communicate between the vlans and everything I have read has a separate router and switch setup which doesn't work for me.

I have heard about bridge-group but found very little on the subject, can anyone please share their experience and expertise on the matter.

Thanks

[Sam Smiley]

It would help a lot if you would post the configuration of your router. That being said each VLAN you create on the router has to have a Switch Virtual Interface (SVI) with an IP address in the subnet of the given VLAN. In the example you gave you would have to create 5 SVIs to go along with your VLANs. Once this is done the routing within the switch will take care of itself. Here is a discussion of inter vlan routing with examples the same principles will apply to the NM-16ESW:

https://supportforums.cisco.com/discussion/13174011/intervlan-routing-layer-3-switch-does-it-require-ip-addresses-or-will-trunks

Cheers,

Sam

[ghyacin]

below are the current specs on the router/switch, I believe the assigned ip addresses to the vlan is the "each VLAN you create on the router has to have a Switch Virtual Interface (SVI) with an IP address in the subnet of the given VLAN" solution you were talking about or no?

sh run:

interface Vlan1
 no ip address
!
interface Vlan10
 ip address 10.10.10.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan30
 ip address 10.10.30.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan80
 ip address 10.10.80.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan99
 ip address 10.10.99.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan150
 ip address 10.10.150.254 255.255.255.0
 ip helper-address 10.10.10.10

sh ip route:

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 1 subnets
C       10.10.10.0 is directly connected, Vlan10

[Sam Smiley]

This is not the entire config; not sure why you are pointing the helper address to one of your VLANs. The idea behind VLANs is that each segment has a unique subnet. This you have in the SVIs; without the DHCP config and the port configuration there isn't much I can tell you.

[ghyacin]

The helper address is pointing to the DHCP server on the server vlan 10, which is working great; each device from each vlan receives an IP address from the server, but the devices within each vlan cannot communicate with the other vlans. 

I hope this helps paint a better picture of my current setup

The config for DHCP is on a windows server and is as follows:

Scope - servers

IP range: 10.10.10.1 - 254/ 255.255.255.0

Default gateway/router: 10.10.10.254

Scope - pc's

IP range: 10.10.30.1 - 254/ 255.255.255.0

Default gateway/router: 10.10.30.254

etc...

sh run:

Current configuration : 2102 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname rtr-sw-01
!
boot-start-marker
boot-end-marker
!
enable secret 5 **OMITTED**
!
no aaa new-model
!
resource policy
!
no network-clock-participate slot 1
no network-clock-participate wic 0
ip cef
!
interface FastEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet1/0
 switchport access vlan 30
 switchport voice vlan 150
!
interface FastEthernet1/1
 switchport access vlan 30
 switchport voice vlan 150
!
interface FastEthernet1/2
 switchport access vlan 99
 switchport voice vlan 150
!
interface FastEthernet1/3
!
interface FastEthernet1/4
!
interface FastEthernet1/5
 switchport access vlan 10
!
interface FastEthernet1/6
 switchport access vlan 10
!
interface FastEthernet1/7
 switchport access vlan 10
!
interface FastEthernet1/8
 switchport access vlan 30
 switchport voice vlan 150
!
interface FastEthernet1/9
 switchport access vlan 30
 switchport voice vlan 150
!
interface FastEthernet1/10
 switchport access vlan 30
 switchport voice vlan 150
!
interface FastEthernet1/11
 switchport access vlan 99
 switchport voice vlan 150
!
interface FastEthernet1/12
!
interface FastEthernet1/13
 switchport access vlan 10
!
interface FastEthernet1/14
 switchport access vlan 10
!
interface FastEthernet1/15
 switchport access vlan 10
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 10.10.10.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan30
 ip address 10.10.30.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan80
 ip address 10.10.80.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan99
 ip address 10.10.99.254 255.255.255.0
 ip helper-address 10.10.10.10
!
interface Vlan150
 ip address 10.10.150.254 255.255.255.0
 ip helper-address 10.10.10.10
!
ip http server
no ip http secure-server
!
control-plane
!
line con 0
line aux 0
line vty 0 4
 password **OMITTED**
 login
!
end

[Sam Smiley]

I don't see anything out of the ordinary; I even went back to an old config of a 2620 I had with a NM-16ESW. The only thing different on mine is that I'm using the router for DHCP rather than an external server. All things being equal this should work.

It appears you are running 12.4 IOS, what specific version is it? Also this should be a 2650XM device rather than a 2650. This should not matter, I don't think the 2650 will run 12.4.

If memory server the 2600 series came with routing disabled; try issuing:

ip routing

After issuing the routing command see if the routes show up in sh ip route. In newer routers routing is enabled by default.

Cheers,

Sam

[ghyacin]

I've done the IP routing and it doesn't give me a successful or error message, it just bring up another command line to type in, when I do sh run to see if the ip routing is there it is not.

I feel I may have to setup the routing  table my self, but what all should I be routing? and I assume I would be doing this via the static route option?

[Sam Smiley]

There will be no indication in the running config that the command; the only indication will be in the routing table. There is no need to add any static routes other than the default gateway route, the router will build the routing table as SVIs are added. I've attached a running config from a router I had with the NM-16ESW, this router also has a serial interface and a WIC-1ADSL card in it.

Edit: I dug out an old 2600XM device to try this, it would not route without the ip routing command, however I had to reset the interfaces (router) before it would take effect.

Cheers,

Sam

[Richard Burts]

Could you post the output of show version from the router/switch.

If ip routing is enabled then it should route between these vlans as connected interfaces. I see no need for a static route unless you want to route to something that is not connected locally.

HTH

Rick

[ghyacin]

I have issued the ip routing command and reloaded the router as offered above, but routing is still the same. Below is the sh ver:

Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(7), RELEASE SOFTWARE (fc6)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Tue 28-Feb-06 23:32 by alnguyen

ROM: System Bootstrap, Version 12.2(10r)1, RELEASE SOFTWARE (fc1)

rtr-sw-01 uptime is 5 minutes
System returned to ROM by power-on
System image file is "flash:c2600-adventerprisek9-mz.124-7.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 2650 (MPC860P) processor (revision 0.0) with 125591K/5481K bytes of memory.
Processor board ID JAD06390IKQ
M860 processor: part number 5, mask 2
17 FastEthernet interfaces
32K bytes of NVRAM.
32768K bytes of processor board System flash (Read/Write)

Configuration register is 0x2102

[Richard Burts]

Thanks for the additional information. This device should certainly support ip routing and I would expect that it would be enabled by default. If it is enabled by default then it would normally not show up in the output of show run. Perhaps it might shed some light on the issue if you post the output of the command show ip protocol.

I am curious that the output of show ip route shows the subnet for vlan 10 but not for the other vlans. Would you post the output of show ip interface brief?

HTH

Rick

[ghyacin]

sh ip protocol:

blank space then shows the command line to type

sh ip int brief:

Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES NVRAM  up                    down
FastEthernet1/0            unassigned      YES unset  up                    down
FastEthernet1/1            unassigned      YES unset  up                    down
FastEthernet1/2            unassigned      YES unset  up                    down
FastEthernet1/3            unassigned      YES unset  up                    down
FastEthernet1/4            unassigned      YES unset  up                    down
FastEthernet1/5            unassigned      YES unset  up                    up
FastEthernet1/6            unassigned      YES unset  up                    up
FastEthernet1/7            unassigned      YES unset  up                    up
FastEthernet1/8            unassigned      YES unset  up                    down
FastEthernet1/9            unassigned      YES unset  up                    down
FastEthernet1/10           unassigned      YES unset  up                    down
FastEthernet1/11           unassigned      YES unset  up                    down
FastEthernet1/12           unassigned      YES unset  up                    down
FastEthernet1/13           unassigned      YES unset  up                    up
FastEthernet1/14           unassigned      YES unset  up                    up
FastEthernet1/15           unassigned      YES unset  up                    up
Vlan1                      unassigned      YES NVRAM  up                    down
Vlan10                     10.10.10.254    YES NVRAM  up                    up
Vlan30                     10.10.30.254    YES NVRAM  up                    down
Vlan80                     10.10.80.254    YES NVRAM  up                    down
Vlan99                     10.10.99.254    YES NVRAM  up                    down
Vlan150                    10.10.150.254   YES NVRAM  up                    down

The protocols on the vlans are only down because no devices are active on them, I just started the pc on vlan 30 the the protocol changed to up.

But still can't ping or communicate with other vlans, can only ping the DHCP server, and the IP's of the vlans.

[Richard Burts · Accepted solution]

The output of show ip interface brief was very helpful. It shows that there are 6 physical interfaces that are up and they are all in vlan 10. You have some interfaces assigned in vlans 30 and 99 but none of them are up. And you do not have interfaces assigned to vlan 80. If there are no interfaces in the vlan that are up then the vlan interface will not be up. And if the vlan interface is not up then that subnet will not appear in the routing table.

You say that you did start a PC connected in vlan 30 and that it did come up. Did you check on the status of interface vlan 30 at that point. I believe that it would have been up if it had an interface in the vlan that was up. And if the vlan interface was up then I would expect that the subnet would have appeared in the routing table. Can you check on that?

HTH

Rick

[ghyacin]

I click correct answer by accident!

I did check the status and the IP routing after I turned on the PC, status was up and the routing showed up but I am still not about to ping or access devices from the other active vlan.

I can only ping the IP address of the DHCP server and the IP address of the vlans them selves.

[Sam Smiley]

I think at this point I would blow away the config and start from scratch. It sounds like you have made a lot of changes to this config. Some may have been needed while others may not have been needed. Your config isn't that complicated where it would be too hard to get it back.

wri era will take the router back to the factory defaults > reload the router. When it comes back up issue the ip routing command then enter your config. I've done this on numerous router within a lab. Sometimes it is best to start from scratch.

Cheers,

Sam