Issue with VLAN using router and layer 2 switch

[burleyman]

Having odd issue and I just can't see what I have wrong.

I have a Cisco 2901 router running c2900-universalk9-mz.SPA.152-4.M4.bin
and have the following configured for the VLAN's I am trying to get working.

interface GigabitEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.1
 encapsulation dot1Q 1 native
 ip address 10.30.8.254 255.255.255.0
 ip helper-address 10.30.6.210
!
interface GigabitEthernet0/1.108
 encapsulation dot1Q 108
 ip address 10.30.108.1 255.255.255.0
 ip helper-address 10.30.6.210
!

2901#show vlans

Virtual LAN ID:  1 (IEEE 802.1Q Encapsulation)

   vLAN Trunk Interface:   GigabitEthernet0/1.1

 This is configured as native Vlan for the following interface(s) :
GigabitEthernet0/1    Native-vlan Tx-type: Untagged

   Protocols Configured:   Address:              Received:        Transmitted:
           IP              10.30.8.254          71748720            84311658
        Other                                           0             1031567

   71923389 packets, 16259187340 bytes input
   85343225 packets, 60065017050 bytes output

Virtual LAN ID:  108 (IEEE 802.1Q Encapsulation)

   vLAN Trunk Interface:   GigabitEthernet0/1.108

   Protocols Configured:   Address:              Received:        Transmitted:
           IP              10.30.108.1                 0              453287
        Other                                           0                1654

   0 packets, 0 bytes input
   454941 packets, 35432470 bytes output

And on my layer 2 switch which is a WS-C2960S-24PS-L with c2960s-universalk9-mz.122-55.SE5
I have the following config

interface GigabitEthernet1/0/5
 switchport access vlan 108
 switchport mode access
 spanning-tree portfast

interface Vlan1
 ip address 10.30.8.253 255.255.255.0

ip default-gateway 10.30.8.254

sw2960#show vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/1, Gi1/0/2, Gi1/0/3, Gi1/0/4, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13
                                                Gi1/0/14, Gi1/0/15, Gi1/0/16, Gi1/0/17, Gi1/0/18, Gi1/0/19, Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi1/0/23, Gi1/0/25
                                                Gi1/0/26, Gi1/0/27, Gi1/0/28
108  Data                             active    Gi1/0/5

I can ping the IP address of 10.30.108.1 and 10.30.8.254 on the router from the switch.
I can ping the IP address of 10.30.8.253 from the router.

Now I connect a PC to the switch in int gi1/0/5 and give it a static IP address in VLAN 108 of 10.30.108.10 /24 and gateway of 10.30.108.1
and I connot ping anything
If I give it an IP address in VLAN 1 of 10.30.8.10 /24 with the gateway of 10.30.8.253 I can ping everything.

Why won't this work for VLAN 108?

Thanks,

Mike

[Jon Marshall]

Mike

How is the port connected to the router configured ?

It should be a trunk and if it is can you post a "sh int trunk" from the switch and indicate which port it is if there are multiple trunks.

Jon

[burleyman]

Sorry forgot that part....yes it is a trunk

interface GigabitEthernet1/0/24
 switchport mode trunk
 spanning-tree portfast

sw2960#show int trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi1/0/24    on               802.1q         trunking      1

Port        Vlans allowed on trunk
Gi1/0/24    1-4094

Port        Vlans allowed and active in management domain
Gi1/0/24    1,108

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    1,108
pp-WS_sw253#

[Jon Marshall]

Thanks for that, I thought all that firewalling had meant you had forgotten your switching :-)

There is nothing obviously wrong with your configurations other than it should be "spanning-tree porfast trunk" but that isn;t going to make it suddenly work.

When you allocate a vlan 108 IP on the PC what do you see in the arp table when you try pinging ?

And ditto from the router ie. if you try to ping the PC what do you see in the router's arp table ?

If you are pinging from the router make sure there is no firewall on the PC.

Is there anything else in the configurations or is this a pretty basic setup at the moment ?

Jon

[burleyman]

Yeah I noticed the spanning-tree config and I did change that, I missed it when changing from an access port to a trunk port.

Firewall on PC off but it worked on VLAN 1so I did not think that would be it.

The ARP table I will check I don't remember off the top of my head. I will test that and post.

Yes that is it for the config, pretty easy which is why I am stumped. Any other ideas?

Mike

[Martin Carr]

What happens when you use the router as the g/w for VLAN 1, i.e. 10.30.8.254?

In practice, this should be the case anyway, as at the moment you are going two hops.

Martin

[burleyman]

I will give that a shot and see what it does.

Mike

[Jon Marshall]

Mike

I did notice you said you were using the 2960 SVI as the gateway but assumed that was a typo because you also said you could ping the vlan 108 subinterface on the router so that would have to mean the 2960 was routing but it only has one SVI.

Jon

[burleyman]

Yeah, this is an existing network that had VLAN 1 with IP address 10.30.8.253 on the 2960 and the PC's were setup to use the VLAN 1 ip address 10.30.8.253 on the 2960 as the gateway and then there is a default gateway that now points to the new router 10.30.8.254. Now they wanted to add another VLAN so I created the sub-interfaces for VLAN 1 and VLAN 108. They wanted to keep the PC's gateway 10.30.8.253 so I left it. What I may try is changing the router VLAN 1 IP address to 10.30.8.253 which was the 2960 switch and set VLAN 1 on the switch to 10.30.8.254 and then change the default gateway on the 2960 switch accordingly.

Maybe there is something weird going on with one vlan having the gateway on the switch and the other on being on the router and somehow conflicting with the default gateway on the switch.

Mike

[Jon Marshall]

Mike

The 2960 does support limited routing with the right feature set but even if you have the right feature set you would need a default route ie. a default gateway is only used by the switch itself like an end PC.

So if the 2960 is not routing and there was originally just one vlan setting the clients default gateway to the SVI on the 2960 actually did nothing.

Was there just one vlan in use and did those clients not need access to anything else eg. internet ?

Because if they did I can't see how this worked without a default route.

Jon