VLAN and or trunking between 2 3750's through baystack switches

[TheFons01]

Problem: I need 3 vlans on a remote 3750, that is connected via several nortel baystack switches (al of them NOT owned by us and thus "alien")

My first 3750 is called Xslcser1. Port 48 is configured als trunk port with dot1Q.(port 47 is also Trunk with dot1q and connected to our Main 6506 trunkport)

The second switch is called Xhocser1, with port 48 configured also as trunk with dot1Q. If both switches are connected directly to each other ALL Vlans on both switches and to the Main 6506 work fine.

The other nerwork admin has created a set of vlan2 ports on his baystacks on both sides of his network for me to use(he himselve only uses vlan1). He as created a tagged vlan on all interconnecting ports of his network (same as Cisco trunking??). He can connect to both internal and external switches using his tagged trunks on vlan1.

When we connect our Cisco trunk ports to both the vlan2 ports on the Baystacks there is NO connectivity between those trunk ports(FA1/0/48). The ports both say link up en protocol=up.

But there is no working vlan intercommunication.

I'm thinking of 2 solutions:

1) the other netadmin should create a "tagged vlan"instead of the vlan 2 port?

2) I should create 3 vlan ports on both my 3750's (in the requires vlans) and connect them to The external vlan ports (the other netadmin must create a total of 3 vlan ports on his baystacs)?

Any advice ?

[Anand Narayana]

hi Fon,

infact you faced the same probz what i was facing it 2 years b4, your probz was almost similar to mine, let me explain how to rectify this issue, b4 that lemme also ask you few question along with that lemme also giv answers.

what all vlans are created on ur switches?

lets say that you have created vlan 2,3 & 4.

now assume that a pc which is on vlan 4 is connected on baystack switch on port 1 also we will assume that trunk port is port 24 which is connected to your cisco switch , now the pc in baystack needs to get access vlan 2 & 3, in this case what you need to do is, on the baystack switch just create a vlan 4 & enable port 1 & port 24 as a member of vlan 4, it works 100% with no doubts. with this your problems will get rectified. since nortel baystack switches doesn't have the vtp domain concept, we need to create each vlans manually on the baystack.

on nortel switch,

go to "vlan configuration" menu, in that make port 1 & 24 as a member of vlan 4, then got to "vlan port configuration" menu, in that go to "port 1" ensure it is on vlan 4 & also go t o "port 24" ensure it is on native vlan 1 & "tagging" is set to "tag all"

it works perfectly with no doubts. if not please lemme know.

hope this helps.

rate this post cleared.

[TheFons01]

Thx for reply,

situation is bit more complex:

looks like this:

Main switch (several trunk ports, one to Myswitch, all Vlans allowed

|

Trunk

|

Myswitch1 (Cisco 3750,port fa1/0/48=trunk)

|

Trunk

|

Vlan2

|

Baystack ( IS OWNED by 3rd party )

|

Tagged Vlan2

|

Baystack ( IS OWNED by 3rd party )

|

Tagged Vlan2

|

Baystack( IS OWNED by 3rd party )

|

Vlan2

|

Trunk

|

Myswitch2 (Cisco 3750,port fa1/0/48=trunk)

Vlans configured on Myswitches :

1, 12, 101, 102, 103,

So the baystacks are managed by 3rd party

Trunk between Main switch and Myswitch1 works

If Myswitch2 is directly coupled to Myswitch1 with both fa1/0/48 ports, trunking works fine.

Now we have to connect Myswitch2 over the 3rdparty network

What do they need to setup/change to get me over their network with my trunk

(or what do I need to change)

Does this help?

[Anand Narayana]

Hi Fon,

either you need to create vlan 2 on your switch bcoz you have tagged vlan 2 or ask them to create the vlans which you hav created on you switch & tag all the vlans. it will work.

[TheFons01]

Thx, I'll get in contact with 3rd party and request them to create the vlans I need on remote site

But how can I prevent them from accessing my network if the Baystack's don't use vtp domains (Mac filtering?? )If they make a port member of one of my vlans they automaticly hav access to all resources on my vlan! (ok I know it's a trade off for using their network .. but still..)

Thx, I''l let u know how things progress

grtz Fons

[Anand Narayana]

what you can do is juz put an ACL on ur cisco switch, since ur network is allowed to access by a 3rd party, the best way is create a seperate vlan for ur 3rd party, then put an ACL on ur cisco switch by allowing that particular vlan only to a certain host on ur network(which is required for him to access), rest make it denied.

[TheFons01]

Update: The Tagged Vlans will be made by 3rd party somewhere today, as per your suggestion, I'll test it this afternoon and let you know!

The ACL's were already in place, the 3rd party Vlan also, but I can't prevent the 3rd party creating additionel Vlan untagged ports on MY Vlans on HIS baystacks, enabeling him to look into and accessing the other VLANS.

Ergo, I was looking for something like metro Vlans that could be created on the Baystacks, but I have not found anything on the Nortel websites.

Any Idea if it is at all possible to use VPN over HIS Vlan, or something else that would prevent the 3rd party from accessing our Vlans, and at the same time having VTP working between my remote sites?

Any other suggestions? VTP tunneling? (without the need to add another Cisco router, using our 3750's only?? )

Thx

Fons

[Anand Narayana]

Hi Fon,

you can simply allow only the 3rd partly vlan in the trunking on ur cisco 3750, so that even though what ever vlans he can put & try to access you network will be not be allowed.

eg."switchport trunk allowed vlan 3"

which means only vlan 3 will be allowed via this uplink which is connected to nortel switch, so that if ur 3rd party users is making 1 port as vlan 2 in his nortel switch, he cannot access ur network since it will never allow vlan 2 traffic, only vlan 3 traffics are allowed.

hope this helps.

[TheFons01]

No, no, Remember that 3rd party has to make the same vlans that I want to use on my remote switch, in order to heve my vlan trunk to work? Say that those Vlans are 102 and 103.

3rd party now makes vlans 102 and 103, makes both the ports on witch I connect tagged vlans, so that I can connect my remote vlan102 ports to my own network. Now, becaus 3rd party has those 2 vlans tagged, his networ knows those vlans also.

All he has to do in his network is create a port with access to vlan 102 and he can work on my vlan!

He is allowed to access my vlan103, the ACL there only alows traffic to a specific ftp server on my network and deny for the rest.

But I cannot stop him from using my vlan 102 !

so, again, is there a way to create a "tunnel" through 3rd party's network for my Vlans ? Then I could ask for 1 port where he can access my vlan103 (closed down with acl) and two ports for my tunnel to go to my remote site, where 3rd party is not allowed to look into the tunnel, only allows the traffick to travel through his network.

I read about metro vlans, I read about dot1q vlan-tunnels, but those are to create a tunnel throug MY network, I want to make a tunnel through 3d party network

thx Fons

[TheFons01]

Howdy Folks,

Several weeks later, had serious problems with the above actions.

Now we have resolved this situation:

Our own network ends on a Cisco 3740. Connected to port fa1/0/48 (Vlan33) we have the Baystack switch from 3rd party.

This Vlan33 has an interface with an IP address from 3rd party network. All nescesary hosts on that lan have their def. gateway pointing to THAT IP address. Our MER cisco 6506 does the routing AND accesslist filtering. The 6506 is connected via Trunk with the 3750 unit. This setup works ok, On that 3650 we have all Vlans we need, en vlan33 kan access our network in a secure way.

Now for the other side of our "tunnel"

There we placed another 3750, and this unit has its own VTP domain and also its own Vlans.

The 3rd party LAN is also connected to fa1/0/48 with (LOCAL)VLAN33 and our own server and PC's on that location have their own Vlan( again LOCAL) 102

Routing and accesslists on this Cisco takes care of connectivity and security, the def. GW is the unit on the other side's IP address (the VLan interface) and vice versa (the 6506 knows how to route to the remote vlan via Vlan33)

Thx for the help.

Grtz Fons