Inter VLAN Routing - Cisco 887

[jimw25]

Hi all,

Can anyone tell me how to achieve inter-VLAN routing on a Cisco 887 router without having to connect each of the Fa interfaces to a separate switch port?

The manual says to configure VLAN interfaces and assign IP addresses to those interfaces, then assign each of the physical FastEthernet interfaces to a VLAN. My config at the moment looks like this:

interface FastEthernet0

switchport access vlan 10

!

interface FastEthernet1

switchport access vlan 20

!

interface FastEthernet2

switchport access vlan 30

!

interface FastEthernet3

switchport access vlan 40

!

interface Vlan10

ip address 192.168.1.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan20

ip address 192.168.2.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan30

ip address 192.168.3.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan40

ip address 192.168.4.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

The inter-VLAN routing works fine as long as I have each of the four FastEthernet interfaces connected to it's own port on a connecting switch configured with the same VLAN ID.

Problem is I need to add another VLAN, 10.31.0.0/16 and have the router perform routing for this also. I have tried setting on of the FastEthernet interfaces to 'switchport mode trunk' and configured 802.1Q trunk on the HP switch it is connected to (also disconnected the other three FastEthernet interfaces from the switch) and a 'show interface fa 0 trunk' command shows status is trunking for VLANs 10, 20, 30 and 40 but cannot actually ping any devices on the associated subnets.

Device product documentation says the 887 supports 8 VLANs but I don't see how this is possible if you have to tie each VLAN to a physical interface!

Spent all morning trawling Cisco config documentation but had no luck at all!

Any thoughts and comments appreciated

Many thanks

Jim Westhead CCNP

[Antonio Knox]

When you configured the trunk port, did you also configure VTP?  Also, I'm not sure if you had any trunking configuration on the HP switch so that the vlans could populate the switch.  Not saying you didn't do any of this, you just didn't mention it.

[jimw25]

Hi Antonio, thanks for reply.

No I didn't, thought VTP was for centralising VLAN database across switches....?

[Antonio Knox]

Actually, that was a little brain flatulance on my part, VTP is a Cisco protocol anyway, you have an HP switch so it wouldn't do you much good.  The trunk should have been enough.

What was our configuation when you configured the trunk mode?

[jimw25]

lol no worries!

Config was as follows:

interface FastEthernet0

swichport mode trunk

!

interface FastEthernet1

!

interface FastEthernet2

!

interface FastEthernet3

!

interface Vlan10

ip address 192.168.1.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan20

ip address 192.168.2.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan30

ip address 192.168.3.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

!

interface Vlan40

ip address 192.168.4.1 255.255.255.0

ip nat inside

ip virtual-reassembly

zone-member security LAN

802.1Q configured on port 24 on the HP switch and connected to Fa0. All other ports on the router were disconnected leaving just Fa0 connected.

The trunk showed it was up and active and in use for VLANs 10,20,30 and 40. Show IP route showed the relevant subnets in the routing table ie 192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24 and 192.168.4.0/24.

Many thanks

[Antonio Knox]

I know that this is obvious, but was a default gateway configured on the HP switch?

[jimw25]

The HP switch is configured with IP address 192.168.1.26/24 and has default gateway set to 192.168.1.1

There are a number of servers connected to the HP, all with a 192.168.1.x/24 address. I could not ping the switch from the router and the servers could not ping the router on 192.168.1.1 either.

In the current config (with VLANs mapped to physical Fa ports) all addresses are reachable.

Many thanks

[Jon Marshall]

Jim

This could be a compatability issue. Couple of things to do -

1) on the HP switch have you explicity configured each vlan to be tagged because i believe this is what you need to do

2) it could also be a native vlan issue because Cisco doesn't tag the native vlan. So can you on the 887 create another vlan which won't be used ie. vlan 999 and then configure your trunk port on the 887 as -

int fa0/1

switchport mode trunk

switchport trunk native vlan 999

Jon

[Antonio Knox]

I agree with Jon here.  I think his #2 option will be your solution.

[jimw25]

Hi Jon, thanks for reply.

On the HP switch, config is as follows:

vlan 1

   name "DEFAULT_VLAN"

   untagged 23-24

   no ip address

   no untagged 1-22

   exit

vlan 10

   name "SERVERS"

   untagged 1-19

   ip address 192.168.1.26 255.255.255.0

   tagged 23-24

   exit

vlan 20

   name "DRAC"

   untagged 20

   no ip address

   tagged 23-24

   exit

vlan 30

   name "HOSTS"

   untagged 21

   no ip address

   tagged 23-24

   exit

vlan 40

   name "VOICE"

   untagged 22

   no ip address

   tagged 23-24

   exit

It could be that I left port 24 'untagged' in VLAN1 which isn't actually in use. I think I did try the Native VLAN command but set it to 10..... ahhhh to form 802.1Q trunk, Native VLAN at each end has to match..... oh dear, missed this one!

I'm on site tomorrow so will try this then and post back. Thanks to you both for your thoughts.

[c.doelhoffs]

Hi,

From my knowledge, you must configure subinterfaces on the trunk port on the cisco router and configure 802.1q on that port. Vlan number must be the same for both devices (HP and Cisco).

Also, you may also configure a native Vlan in the Cisco (Vlan where the packets are not tagged)

Here is a sample config from a 19xx router

interface GigabitEthernet0/1

ip address 192.168.40.x 255.255.255.0

ip nat inside

interface GigabitEthernet0/1.20

encapsulation dot1Q 20

ip address 192.168.20.x 255.255.255.0

ip nat inside

!

interface GigabitEthernet0/1.21

encapsulation dot1Q 21

ip address 192.168.21.x 255.255.255.0

ip nat inside

Hope this may help you.

Regards,

Christian

[jimw25]

Thanks for your post Christian

I have used this config on many 1841 routers to good effect, unfortunately however, the ports on an 887 router don't support sub-interfaces for this config

Many thanks

Jim

[jimw25]

Hi everyone, thank you all again for posting.

Just to let you know, in the end I binned using the 887 as the inter-VLAN router, opting instead to use one of the L3 HP switches which works a treat! Only one port in use now in VLAN10 and all working nicely!

Thanks again

Jim CCNP