Hello,
Working with a 3750 and pvlans. I cannot route to any pvlan other than the promiscuous port. As far as I can tell I have Laver 3 routing enabled….but then again it’s not working!?!
Basically I’m separating out servers from workstations through pvlans and want to use ACLs security. With the current setup I have all ip, tcp and icmp traffic allowed to any any but still not working. Cannot ping or RDP to any system outside of their pvlan.
Please help…loosing too many brain cells…save the brain cells…..!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service sequence-numbers
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
clock timezone UTC -8
switch 1 provision ws-c3750g-24ts-1u
system mtu routing 1500
vtp mode transparent
authentication mac-move permit
ip subnet-zero
ip routing
ip domain-name xxxxxxxxxxxxxxxxx
ip name-server xxx.xxx.xxx.xxx
!
!
spanning-tree mode pvst
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 100
private-vlan primary
private-vlan association 101-103
!
vlan 101
name LAN
private-vlan community
!
vlan 102
name Secure
private-vlan community
!
vlan 103
name Servers
private-vlan community
!
!
!
interface GigabitEthernet1/0/1
switchport private-vlan host-association 100 103
switchport mode private-vlan host
!
interface GigabitEthernet1/0/2
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport private-vlan mapping 100 101-103
switchport mode private-vlan promiscuous
srr-queue bandwidth share 10 10 60 20
queue-set 2
priority-queue out
mls qos trust dscp
auto qos voip trust
macro description cisco-router
spanning-tree portfast trunk
spanning-tree bpduguard enable
!
interface GigabitEthernet1/0/6
description Adm - NIC 1
switchport private-vlan host-association 100 101
switchport mode private-vlan host
interface GigabitEthernet1/0/24
description SV01 - NIC 2
switchport private-vlan host-association 100 102
switchport mode private-vlan host
!
interface Vlan1
no ip address
!
interface Vlan3
no ip address
!
interface Vlan100
ip address xxx.xxx.xxx.xxx 255.255.255.0
ip access-group 100 in
ip access-group 100 out
private-vlan mapping 101-103
!
interface Vlan101
no ip address
shutdown
!
ip default-gateway xxx.xxx.xxx.xxx
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
access-list 100 permit ip any any
access-list 100 permit tcp any any
access-list 100 permit icmp any any
!
