How to setup VLANs for new security cameras on existing Catalyst 3560s and 3845 Router

[erikahess]

Forgive me as I am not an expert.  I have 3 Catalyst 3560s (a MB, GB, and X) and a 3845 router.   I have 6 new security cameras (IP) that will be added to the network next week.  I do not have any separate VLANs setup right now and know I should get another VLAN setup for the cameras.  I know the Catalyst 3560s are layer 3 devices, but I also have a router.  What is the best way to setup the routing?  On the router or the switches?  I don't have the router connected directly to each switch right now nor do I have the switch ports avaiblale on the router to directly connect each switch to it.  I have a 3560x in building b, a 3560G and the 3560MB building a.  Building b and building a are connected by fiber through a HP Procurve swtich at building b and the 3560G in building a.  The HP Procurve is connected to the 3560X in building b with fiber.   

The 6 cameras will be connected to the 3560 MB switch.

I have another security camera connected to the 3560X switch in building b.

The NVR server is on the 3560X switch in building b.

How do I setup the VLAN to add my security cameras? 

[Reza Sharifi]

no, you don't need to.  The default gateway for all your subnets is the router.  So the router routes vetween the subnets for you.  You just have to make sure you have the correct default gateway configured on your end devices.

[erikahess]

on the HP, do i just need to create the trunk to the GB switch, similar to the way I created the VLAN on the interface of the GB switch that was the trunk to the MB switch?  

[Reza Sharifi]

yes, you need to trunk the HP since you have multiple vlans configured

[erikahess]

I am trying to configure the trunk on the GB switch to the HP switch.  I already setup the HP switch with the trunk, but now when I am adding the trunk to the GB switch port I get the following error.

An interface whose trunk encapsulation is "Auto" can not be co

nfigured to "trunk" mode.

[erikahess]

I fixed it.

switchport trunk encapsulation dot1q

switchport mode trunk

[Ven Taylor]

Good job!

[erikahess]

I ran into issues when I setup the trunk.  I have confirmed with HP's Procurve 2600 series manual that the 2626 does support 802.1q but something somewhere failed. 

Cisco 3560GB:

interface GigabitEthernet0/49

switchport trunk encapsulation dot1q

switchport mode trunk

spanning-tree link-type point-to-point

HP Procurve 2626:

Port 25 (port for fiber to Cisco 3560GB)

TRK1 - Trunk

Then I lost connectivity on my Cisco 3560X that was connected on HP Procurve 2626 port 26 to 3560X ge1/1.  So I added this on the 3560X.

Cisco 3560X:

interface GigabitEthernet1/1

switchport trunk encapsulation dot1q

switchport mode trunk

spanning-tree link-type point-to-point

Added this to the HP Procurve 2626

Port 26 (port for fiber to Cisco 3560X)

TRK2 - Trunk

I was with my laptop at the HP Procurve 2626,.  I couldn't ping the 3560X or any hosts connected to it.  I removed the trunks from the HP Procurve 2626 and the trunks setup on 3560X (gigabitethernet1/1) and trunks setup on the 3560GB (Gigabitethernet0/49). 

Was my mistake not adding the HP port 26 to the same trunk (TRK1) as HP port 25? 

Venting...I can't wait to get my new Cisco 3560X in place to replace the HP Procurve 2626, but that won't happen for a few months yet.  I don't like administering the procurve, it doesn't accept my Cisco commands!  (of course )

[terrencepayet]

Hi,

I think there's an issue with old HP procurve switch with cisco. let me see if understand. you're having problem configuring vlan between HP and cisco?

From previous dicussion, i see that you've configured a vlan for camera (vlan20) in which youve configured (trunking) on cisco switch and tagging on the HP switch. So basically you have 2 vlan (vlan 1 and vlan 20)

You'll need to untagged vlan 1  and tagged vlan 20 on each port on the HP Procurve switch where your two cisco switch resides.

The untagged is very important, otherwise intervlan communications wont work.

HTH.

Regards,

terence

[erikahess]

Terence,

I do have the VLAN 20 setup on the HP Procurve, but I have no ports that need to be on VLAN 20 on it, other than the trunk ports (25 & 26 fiber need to know).  On my Cisco switches the trunk ports know each of the VLANs.  Yes, on the HP procurve I have only two VLANs 1 & 20.  HP procurve port 26 connects to the Cisco 3560X that will have two ports that will be on VLAN 20.  I was experiencing the problems yesterday after I configured the Trunk on the HP.  Did I clarify anything?

[terrencepayet]

Ok now i understand. you have to cisco switches connected to the HP Procurve switch. one on port 25 and one on port 26.

and you've already configured trunking on the two cisco switch. What you'll need to do is the following on HP procurve, cause i think the problem is on the HP switch.

1. First tagged(since HP uses tagged and untagged) port 25 and 26 with vlan 20
2. untagged vlan 1 on port 25 and 26.

I encounterd a similar problem a couple of years back when we were using 3com switch together with cisco.

HTH.

Regards,

Terence

[erikahess]

If I tag port 25 & 26 to VLAN 20, will I be able to access the fiber from the other ports 1-24?  The fiber on 25 & 26 are the backbones of my network connecting one building to another.  I have everything other than the security cameras on VLAN1 on the entire network.  From what I know, ports can only belong to one VLAN.  Except on my Cisco 3560s, the ports I configure as trunks show in the Network Assistance and config as members of multiple VLANs.

HP:

I don't need ports 1-24 on VLAN 20 they all need to be on VLAN 1. 

Ports 25 & 26 are the fiber connecting one building to another.  The fiber needs to be accessible to both VLAN 1 and VLAN 20.  My servers are back at the other end of the fiber on port 25 on VLAN1. 

HP port 25 has fiber connected to it and the other end of the fiber in another building, is where the Cisco switches are. 

[terrencepayet]

No, you won't be able to access vlan 20 on port 1-24 because you've configured them on vlan 1 right? and port 25 and 26 is the backbone ports.

So you will need to tagged vlan 20 on port 25 and 26 only and untagged vlan 1 on port 1-26. Do not tagged the native vlan 1 on port 25 and 26 otherwise it won't work.

Regards,

Terence

[erikahess]

I do not need to access VLAN 20 on ports 1-24.  I do need to access VLAN1 on ports 1-24 & 25 & 26.

Do I really 't even need VLAN 20 on the HP switch?  I need to setup VLAN 20 on my Cisco 3560x switch that is connected via the Fiber on HP port 26 because I will have two ports on the Cisco 2560X that will be assigned to VLAN20.  I have the VLAN 20 setup on the Cisco 3560GB swtich that is connected on the other end of the fiber on HP port 25. 

I greatly appreciate your help! 

[terrencepayet]

Am a bit confused.

VLAN 20 is for the cameras right?

And you have 6 camera connected on the cisco 3560MB right?

And 1 connected on cisco 3560X right?

• Lets say you're using port 1-6 on the 3560MB switch for the 6 cameras, and you've already configured them as vlan 20 access port.
• Lets say port 7 on 3560MB is the trunk port to switch 3550GB on port 2 (trunk).
• Lets say port 1 on 3550GB is the trunk port to the HP Procurve Switch on port 25
• And finally port 26 on the HP Procurve Switch is the trunk port to 3560x
• And port 2 for the Pelco Spectra Ip camera as vlan 20 access port.

Am i right so far?

Regards,

Terence

[erikahess]

Yes you are correct.

Add this. 

• port 3 on the 3560x is the NVR server that will need to be on VLAN 20.