Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
2014
Views
0
Helpful
9
Replies

SG300 VLAN issue

c.ray.web
Level 1
Level 1

‎06-04-2015 06:23 PM - edited ‎03-08-2019 12:25 AM

I have run into a brick wall with a setup that should be straight forward.  I am a novice VLAN troubleshooter, which doesn't help.

 

First, the physical topology:

Both SG300's are in L2 mode.  The firewall (cyberoam) is setup with sub-intefaces & DHCP relays, the server is performing DHCP duties.  

 

Switch A (core) ties together the access switches, the firewall and the server.  The trunks between the switches and the firewall are all native vlan 1, tagged vlans 11 & 12.  \

On switch B, I put a port into native VLAN 12 as an access port.  I then connect a device to this port and it pulls a IP in VLAN12, its able to connect to the internet/see all network resources.  

On switch C, I put a port into native VLAN 12 as an access port.  I connect a device to this port, but it is unable to retrieve a DHCP address.  I have statically set this device connected to the port that is an access port in vlan 12 with a vlan 12 IP address but this also fails to connect.  Other devices on the switch connect to VLAN1 without issue.  

On switch B, with a device in VLAN12 I can ping a device in VLAN 1 on switch A and switch C.  The same is true for the opposite (I can ping from vlan1 on switch A & B to a device in vlan 12 on switch C). 

The problem is this:  on switch C, no matter what I have tried if I set a port as an access port in VLAN 12 I am unable to get the workstation connected to that port to either pull a DHCP address nor can I set it staticly to be in VLAN 12.  

 

The configs are below:

Running config from switch A

switch83d2de#show run
config-file-header
switch83d2de
v1.3.7.18 / R750_NIK_1_35_647_358
CLI v1.0
set system mode switch

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
vlan database
vlan 11-12
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname 
username cisco password encrypted  privilege 15
ip telnet server
!
interface vlan 1
ip address 10.1.10.13 255.255.255.0
no ip address dhcp
!
interface gigabitethernet1
switchport trunk native vlan 12
!
interface gigabitethernet2
switchport trunk allowed vlan add 11-12
!
interface gigabitethernet3
switchport trunk native vlan 12
!
interface gigabitethernet25
switchport trunk allowed vlan add 11-12
!
interface gigabitethernet49
channel-group 2 mode on
!
interface gigabitethernet50
channel-group 2 mode on
!
interface gigabitethernet51
channel-group 1 mode on
!
interface gigabitethernet52
channel-group 1 mode on
!
interface Port-channel1
description "CS Switch"
switchport trunk allowed vlan add 11-12
!
interface Port-channel2
description "Switch 2"
switchport trunk allowed vlan add 11-12
!
interface Port-channel3
switchport trunk allowed vlan add 11-12
!
interface Port-channel4
switchport trunk allowed vlan add 11-12
!
interface Port-channel5
switchport trunk allowed vlan add 11-12
!
interface Port-channel6
switchport trunk allowed vlan add 11-12
!
interface Port-channel7
switchport trunk allowed vlan add 11-12
!
interface Port-channel8
switchport trunk allowed vlan add 11-12
!
exit
ip default-gateway 10.1.10.27






Running config from Switch C
switch840791#show run
config-file-header
switch840791
v1.3.0.62 / R750_NIK_1_3_647_260
CLI v1.0
set system mode switch

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
!
vlan database
vlan 11-12
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname 
username cisco password encrypted  privilege 15
ip telnet server
!
interface vlan 1
ip address 10.1.10.11 255.255.255.0
no ip address dhcp
!
interface gigabitethernet25
switchport trunk native vlan 12
!
interface gigabitethernet51
channel-group 1 mode on
!
interface gigabitethernet52
channel-group 1 mode on
!
interface Port-channel1
description "Main switch"
switchport trunk allowed vlan add 11-12
!
interface Port-channel2
switchport trunk allowed vlan add 11-12
!
interface Port-channel3
switchport trunk allowed vlan add 11-12
!
interface Port-channel4
switchport trunk allowed vlan add 11-12
!
interface Port-channel5
switchport trunk allowed vlan add 11-12
!
interface Port-channel6
switchport trunk allowed vlan add 11-12
!
interface Port-channel7
switchport trunk allowed vlan add 11-12
!
interface Port-channel8
switchport trunk allowed vlan add 11-12
!
exit
ip default-gateway 10.1.10.27

 

 

Full disclosure.  I was having some strange VLAN issues on an SG200 (Switch B above).  Moving it to the newest firmware resolved this issue without changing the config.  Is it possible this is a firmware issue on the SG300?  The SG300 (A) that is working correctly is on a newer revision of firmware (sorry I forgot to document the versions).  

Labels:
0 Helpful
9 Replies 9

Mark Malone
VIP Alumni
VIP Alumni

‎06-05-2015 03:26 AM

Hi can you try this

If you have changed your native vlan to 12 and not 1 , you should have switchport trunk allowed and then as well have switchport trunk native vlan 12

You need to specify on the trunk what the native is so it knows as the default is usually 1

interface Port-channel1
switchport trunk allowed vlan add xx
switchport trunk native vlan 12

http://sbkb.cisco.com/CiscoSB/GetArticle.aspx?docid=67844b99e2da4a7f88db0c588197487d_Creating_VLANs_on_Cisco_Managed_Switches.xml&pid=2&converted=0

 

0 Helpful

c.ray.web
Level 1
Level 1
In response to Mark Malone

‎06-05-2015 05:12 AM

Mark, thanks for the reply.

On the switches, they are all native VLAN1 (therefore all of the trunks in this network are native VLAN1).  Correct me if I am wrong, but if I change the native vlan on one trunk I would have to change the native vlan on all the trunks?

These SG switches ship with all ports as trunks for some reason, this however does not appear to effect my problem as changing these "trunks" to access ports (since only one device is connected to it) an placing putting them into (native) vlan12 also does not fix this issue.  

 

0 Helpful

Mark Malone
VIP Alumni
VIP Alumni
In response to c.ray.web

‎06-05-2015 05:20 AM

Hi

ok why i was thinking your native vlan was 12 was the extract below ,

Should that not be then switchport access vlan 12 if your native vlan is 1 and these are just access ports , why is the only access port for 12 set as a native trunk ?

interface gigabitethernet25
switchport trunk native vlan 12----------------------This makes it a trunk and specifices vlan 12 as native

interface gigabitethernet25
switchport access vlan 12--------------------------Access port


interface gigabitethernet25
switchport trunk native vlan 12 - See more at: https://supportforums.cisco.com/discussion/12525931/sg300-vlan-issue#sthash.x6Kb4tmr.dpuf
0 Helpful

c.ray.web
Level 1
Level 1
In response to Mark Malone

‎06-05-2015 05:59 AM

I do see what you mean.

Like I said above, I am uncertain why all of the ports ship in trunk mode on the SG series switches.  It might be to make it easier for less-technical people to setup VoIP/workstations on a single port more easily...but who knows.

 

interface gigabitethernet25
switchport access vlan 12

 

I have changed the config to reflect the change above, but the issue persisted.  

0 Helpful

Mark Malone
VIP Alumni
VIP Alumni
In response to c.ray.web

‎06-05-2015 07:28 AM

Do you get the same result with vlan 11 or is it only specific to 12

Have you tried a debug dhcp detail on switch C to see your receiving sending an offer at all ? Just in case as you said strange firmware issues

0 Helpful

c.ray.web
Level 1
Level 1
In response to Mark Malone

‎06-08-2015 05:13 AM

Thanks Mark, I forget there are debug commands!  

 

0 Helpful

c.ray.web
Level 1
Level 1
In response to Mark Malone

‎06-10-2015 07:05 AM

Back with an update:

I attempted to run the debug dhcp command, but I was unable.  It appears as though the only debug command that can be run is debug and that's it (I get a <CR> if i put a "?" after debug).  

 

For this reason I was unable to troubleshoot DHCP on VLAN 11 & 12.  I did however set my IP address statically with a valid configuration in VLAN 12, then set the port to access mode, native VLAN 12 and tried to ping the gateway of that VLAN which was unsuccesful.  

 

I moved from firmware version:

1.3.0.62 to 1.3.5.58, no change

1.3.5.58 to 1.3.7.18, no change

1.3.7.18 to 1.4.1.03, I was unable to get this firmware update to "take".  When I performed the necessary reboot after changing the firmware it reverted back to 1.3.7.18.  I then changed back to 1.3.5.58 for further testing, and that is where it sits now.  

 

The config for switch A (unchanged) is below:

switch83d2de#show run
config-file-header
switch83d2de
v1.3.7.18 / R750_NIK_1_35_647_358
CLI v1.0
set system mode switch

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end 
!
vlan database
vlan 11-12
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname switch83d2de
username cisco password encrypted privilege 15
ip telnet server
!
interface vlan 1
ip address 10.1.10.13 255.255.255.0
no ip address dhcp
!
interface gigabitethernet1
switchport trunk native vlan 12
!
interface gigabitethernet2
switchport trunk allowed vlan add 11-12
!
interface gigabitethernet3
switchport trunk native vlan 12
!
interface gigabitethernet25
switchport trunk allowed vlan add 11-12
!
interface gigabitethernet49
channel-group 2 mode on
!
interface gigabitethernet50
channel-group 2 mode on
!
interface gigabitethernet51
channel-group 1 mode on
!
interface gigabitethernet52
channel-group 1 mode on
!
interface Port-channel1
description "CS Switch"
switchport trunk allowed vlan add 11-12
!
interface Port-channel2
description "Switch 2"
switchport trunk allowed vlan add 11-12
!
interface Port-channel3
switchport trunk allowed vlan add 11-12
!
interface Port-channel4
switchport trunk allowed vlan add 11-12
!
interface Port-channel5
switchport trunk allowed vlan add 11-12
!
interface Port-channel6
switchport trunk allowed vlan add 11-12
!
interface Port-channel7
switchport trunk allowed vlan add 11-12
!
interface Port-channel8
switchport trunk allowed vlan add 11-12
!
exit
ip default-gateway 10.1.10.27

 

 

Config for switch C (updated) is below:

switch840791#show run
config-file-header
switch840791
v1.3.5.58 / R750_NIK_1_35_647_358
CLI v1.0
set system mode switch

file SSD indicator encrypted
@
ssd-control-start
ssd config
ssd file passphrase control unrestricted
no ssd file integrity control
ssd-control-end 
!
vlan database
vlan 11-12
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
hostname switch840791
username cisco password encrypted privilege 15
ip telnet server
!
interface vlan 1
ip address 10.1.10.11 255.255.255.0
!
interface gigabitethernet25
switchport mode access
switchport access vlan 12
!
interface gigabitethernet51
channel-group 1 mode on
!
interface gigabitethernet52
channel-group 1 mode on
!
interface Port-channel1
description "Main switch"
switchport trunk allowed vlan add 11-12
!
interface Port-channel2
switchport trunk allowed vlan add 11-12
!
interface Port-channel3
switchport trunk allowed vlan add 11-12
!
interface Port-channel4
switchport trunk allowed vlan add 11-12
!
interface Port-channel5
switchport trunk allowed vlan add 11-12
!
interface Port-channel6
switchport trunk allowed vlan add 11-12
!
interface Port-channel7
switchport trunk allowed vlan add 11-12
!
interface Port-channel8
switchport trunk allowed vlan add 11-12
!
exit
ip default-gateway 10.1.10.27
 

 

I am not sure what else it could be.  

0 Helpful

Mark Malone
VIP Alumni
VIP Alumni
In response to c.ray.web

‎06-10-2015 08:47 AM

that's bad with the debug you would think they would at least have that running for testing

Have you tried to set it as L3 just in case , see if that helps bear in mind it wipes the config when you do this and reboots , its the only thing i can think of left that could be causing an issue , i dont see why its not working when the sg200 with the same config works fine and there's nothing on sg300(A) that's restricting SG-300(C) from connecting to fw or server

A test to rule out the switch itself create a dhcp pool for vlan 12 on switch C see if the local devices can pick up an address locally that will rule out any software/firmware defect on the device , switch itself could be faulty , the fact switch B and A both get dhcp addresses rules out the FW and the server

 

0 Helpful

c.ray.web
Level 1
Level 1
In response to Mark Malone

‎06-19-2015 10:47 AM

Using your suggested DHCP test pool on the switch I determined the VLANs did indeed work (at least on that switch).  I was able to put ports into vlan 12, connect devices then communicate with those devices. 

I was still unable to communicate with devices outside of this switch in anything other than VLAN 1.  

I fumbled around for a bit until i found a combination of show commands that started to help.  Using sh span brief I was able to see the port channel between the two switch was in discarding state.  Using sh cdp neigh detail I was able to see a port that was setup as an access port however it had at least a dozen MAC addresses associated with it.  I unplugged this port, doing so brought up the port channel between this switch and the other switch.  Bringing the port channel up then allowed the vlans to start "working" on the other switch.  

tl;dr it was a loop, that because the network was flat it did not create an issue before.  However when I added vlans into the mix, this loop presented a problem since it was not a trunk and had no idea what to do with these tagged frames I introduced.  Shutting down the loop allowed STP to stop blocking the port channel, which brought up the trunks.  

0 Helpful
Customers Also Viewed These Support Documents