InterVlan Routing

[kwc20164]

I’m in need of some serious assistance. I have scoured the forums, but can’t quite put together the information I need to resolve my issue. I thought I was a little better than a novice, but I have much more practicing to do

My current setup is as follows:

Verizon Fios: Including TV/Phone/Internet

1. ONT via CAT 5 to Asus AC-66U.

1. Asus is handles Wifi and DHCP (10.1.2.0)

1. Asus LAN port connected to Cisco 4948 Switch
2. 4948 performing Intervlan routing for all hard wired devices

My ultimate Goal:

1. To have multiple VLANs:

1. Wireless
2. servers
3. Printers
4. Peripherals (Smart TV and other network capable devices that don’t belong on main network)
5.  

When all devices were part of VLAN 1, all devices could ping each other (10.1.2.0) and I had internet access. After creating VLANs 3 and 4, I cannot ping across VLANs nor do I have internet access.

While on the switch, I can ping VLAN 3 at 10.1.3.3 as well as VLAN 4 at 10.1.4.3. I have since shutdown VLAN 4. From the switch, I can also ping 10.1.2.1, which is the default gateway of the ASUS router. Next, test on the Cisco switch was successful pings to other devices on the 10.1.2.0 network.

Now I am connected to a PC on the 10.1.3.0 network.

10.1.3.10\24 GW 10.1.3.3             

I can ping the gateway as well as other devices on the 10.1.3.0 network. The problem is, I cannot ping the 10.1.2.0 network from the 10.1.3.0 network.

First I created a default-gateway of 10.1.2.1, but that didn’t work. Next, step was to create a static route (0.0.0.0 0.0.0.0), and still no dice.

I know I am missing something simple and would really appreciate someone shining a light.

Here is my switch configuration:

Port 48 is set as a Trunk. I started to connect a Cisco 1921 Router to create a Router on a Stick, but my layer 3 switch should be able to do the necessary routing.

Current configuration : 3867 bytes

version 12.2

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

service compress-config

hostname CR4948

boot-start-marker

boot-end-marker

enable secret 5 $1$C0hu$mK6bM8sx.w2qCvX8.3jyQ/

username k password 7 1424062B15543F3F

no aaa new-model

vtp domain ********

vtp mode transparent

ip subnet-zero

no ip domain-lookup

ip domain-name ********

ip dhcp excluded-address 10.1.3.0 10.1.3.20

ip dhcp excluded-address 10.1.4.0 10.1.4.20

ip dhcp pool R

   network 10.1.3.0 255.255.255.0

   default-router 10.1.3.3

   dns-server 10.1.2.5

   netbios-name-server 10.1.2.5

   domain-name ********

   lease 7

ip dhcp pool T

   network 10.1.4.0 255.255.255.0

   default-router 10.1.4.3

   dns-server 10.1.2.5

   netbios-name-server 10.1.2.5

   domain-name *******

   lease 7

spanning-tree mode pvst

spanning-tree extend system-id

vlan internal allocation policy ascending

vlan 3-4

interface FastEthernet1

ip vrf forwarding mgmtVrf

no ip address

speed auto

duplex auto

interface GigabitEthernet1/1

interface GigabitEthernet1/2

interface GigabitEthernet1/3

interface GigabitEthernet1/4

interface GigabitEthernet1/5

interface GigabitEthernet1/6

interface GigabitEthernet1/7

interface GigabitEthernet1/8

interface GigabitEthernet1/9

interface GigabitEthernet1/10

interface GigabitEthernet1/11

interface GigabitEthernet1/12

interface GigabitEthernet1/13

interface GigabitEthernet1/14

interface GigabitEthernet1/15

interface GigabitEthernet1/16

interface GigabitEthernet1/17

interface GigabitEthernet1/18

interface GigabitEthernet1/19

interface GigabitEthernet1/20

switchport access vlan 3

interface GigabitEthernet1/21

switchport access vlan 3

interface GigabitEthernet1/22

switchport access vlan 3

interface GigabitEthernet1/23

switchport access vlan 3

interface GigabitEthernet1/24

switchport access vlan 3

interface GigabitEthernet1/25

switchport access vlan 3

interface GigabitEthernet1/26

switchport access vlan 3

interface GigabitEthernet1/27

switchport access vlan 3

interface GigabitEthernet1/28

switchport access vlan 3

interface GigabitEthernet1/29

switchport access vlan 3

interface GigabitEthernet1/30

switchport access vlan 3

interface GigabitEthernet1/31

switchport access vlan 3

interface GigabitEthernet1/32

switchport access vlan 3

interface GigabitEthernet1/33

switchport access vlan 3

interface GigabitEthernet1/34

switchport access vlan 3

interface GigabitEthernet1/35

switchport access vlan 3

interface GigabitEthernet1/36

switchport access vlan 3

interface GigabitEthernet1/37

switchport access vlan 3

interface GigabitEthernet1/38

switchport access vlan 3

interface GigabitEthernet1/39

switchport access vlan 3

interface GigabitEthernet1/40

switchport access vlan 4

interface GigabitEthernet1/41

switchport access vlan 4

interface GigabitEthernet1/42

switchport access vlan 4

interface GigabitEthernet1/43

switchport access vlan 4

interface GigabitEthernet1/44

switchport access vlan 4

interface GigabitEthernet1/45

switchport access vlan 4

interface GigabitEthernet1/46

switchport access vlan 4

interface GigabitEthernet1/47

switchport access vlan 4

interface GigabitEthernet1/48

switchport trunk encapsulation dot1q

interface Vlan1

ip address 10.1.2.3 255.255.255.0

interface Vlan3

ip address 10.1.3.3 255.255.255.0

interface Vlan4

ip address 10.1.4.3 255.255.255.0

ip http server

no ip http secure-server

[Philip D'Ath]

Try "ip routing" on the switch.  Some of the switches don't have routing enabled by default.

[kwc20164]

Thanks Philip for you response. I did notice when I copied my config, that it wasn't enabled, but I have since enabled it with the same results

[chrihussey]

Sorry, but are you saying you cannot even ping the 10.1.2.3 address from a device on the 10.1.3.0 network?

Aside from that I do notice something that you may have already figured out or know the answer but I'll ask anyway:

Does the AC-66U have (or can be configured with) routes to the 10.1.3.0/24 and 10.1.4.0/24 networks back to your L3 switch? I assume that without knowing where the networks are it will by default route them to the Internet.

[kwc20164]

Thanks for the reply. No, I can ping the 10.1.3.0 network if I am on the same subnet. I cannot ping the 10.1.2.0 network from the 3 network, but I can ping from the switch. While on the switch, I can ping both the .2 and .3 networks and when enabled, the .4 network.

The AC-66 does support IP routing and I have configured routes for both the .3 and .4 networks.

At least I can tell, by the responses, that my troubleshooting is in the right place. I have done many of the things others have suggested. There was another reply about setting up subinterfaces on the AC-66. I have a feeling that might be my next step, but it will require me to update the router with DD-WRT or Tomato. I currently have ASUSwrt Merlin which doesn't support subinterfaces

[asisit international]

It looks like you've defined vlan 3-4 per a line in your config, do you also need to specify vlan 1 on that line? I've had a problem before on a 6500 series before where I've defined a layer-3 VLAN with an IP address, but did not define the layer-2 component of it. I could not get communication going until I added in the new vlan to its layer-2 configuration.

It also may be worth the time to move everything off of the default VLAN 1 and onto another VLAN - especially if the asus router is capable of working with VLANs. I've personally found VLAN 1 problems much easier to troubleshoot and fix when I move it to another VLAN that isn't the default.

edit: idea 1 wasn't on a 6500 series judging by my current config - damn the foggy memory banks. Make sure VLAN 1 is active on the appropriate ports with a 'show vlan' command. Furthermore, check out the differences between ip default-gateway, ip default-network, and ip route commands here and make sure you are applying the correct form to your 4948.

[kwc20164]

thanks

[paul driver]

Hello

The simple Solution if applicable would be to apply sub interfaces on the asus lan interface and let that do the routing and Nat

Disable routing on the switch and  trunk on the connection with the asus lan interface 

Create the L2 vlans on the and assign access ports to their relative vlans

Switch

cont 

no ip routing

ip default-gateway 10.1.2.1

vlan 3--4

exit

no int vlan 3 

no int vlan 4

int ran x/x -x

switchport host

switchport access vlan x

res

paul

[kwc20164]

Hey Paul, I've considered going this route, but tried to get it working as is before updating my router. I currently use ASUSwrt on the router, but it does not support Sub-interfaces. If I cannot find a viable solution with ASUSwrt, then I will have to upgrade to DDWRT or Tomato in order to create the sub-interfaces. Thanks a lot for your suggestion and the link, they are both helpful

[paul driver]

Hello

I had a feeling you would comeback and say that!

Okay another solution would to put your wan rtr in Bridge mode - However doing this would mean you need another rtr to perform the nating but it would allow you to use the switch for the intervlan routing

res

paul

[kwc20164]

This may be an option, I do have a 1921 I can use to test it out. Thanks again for the suggestion

[paul driver]

Hello

sounds good let us know how you get on!

res

Paul

[chan.sarkar]

On existing cisco 4948 switch configured below VLANs and with mentioned DHCP IP Pool. Wish to add few more VLAN with /19 Pool, will there be any technical challenge.

Also confirm is this device able to manage this services or will there be any user end service impact ?

VLAN	IP Pool
test	/19
lab	/20