vlan not working on interface

[TimMees60387]

I have a problem with my VLAN when it is on the interface I no longer have internet

[Enes Simnica]

hello @TimMees60387 Can u show me some more info? like what kind of topology u have, also some show commands would help...

-Enes

[Enes Simnica]

and man @TimMees60387 while u send the details, here are some common vlan related issues that can cause loss of Internet...:

• VLAN not allowed on trunk (switchport trunk allowed vlan)
• Missing default gateway on the VLAN SVI
• DHCP not reaching the client
• Incorrect VLAN assignment on the access port

and use these commands to check those steps: sh vlan brief, sh int switchport and or sh ip interface brief...

andcheck this:  https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/troubleshooting/guide/b_Cisco_Nexus_9000_Series_NX-OS_Troubleshooting_Guide/b_Cisco_Standalone_Series_NX-OS_Troubleshooting_Guide_chapter_0101.pdf

-Enes

[TimMees60387]

yes the interface GigabitEthernet0/1 receives dhcp from the modem 192.168.0.170 and on other interfaces there are vlans on it but I can't connect when there are vlans on the interface

spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
ip ssh version 2
!
!
!
!
!
!
interface FastEthernet0/1
switchport mode access
!
interface FastEthernet0/2
switchport access vlan 2
switchport mode access
!
interface FastEthernet0/3
switchport access vlan 3
switchport mode access
!
interface FastEthernet0/4
switchport access vlan 4
switchport mode access
!
interface FastEthernet0/5
switchport access vlan 5
switchport mode access
!
interface FastEthernet0/6
!
interface FastEthernet0/7
switchport access vlan 7
switchport mode access
!
interface FastEthernet0/8
switchport access vlan 8
switchport mode access
!
interface GigabitEthernet0/1
!
interface Vlan1
ip address 11.11.11.10 255.255.255.0
!
interface Vlan2
ip address 10.10.20.1 255.255.255.0
!
interface Vlan3
ip address 10.10.30.1 255.255.255.0
!
interface Vlan4
ip address 10.10.40.1 255.255.255.0
!
interface Vlan5
ip address 10.10.50.1 255.255.255.0
!
interface Vlan6
ip address 10.10.60.1 255.255.255.0
!
ip default-gateway 10.10.10.1
ip http server
ip http secure-server
!
!
!
ip access-list extended test
permit ip 10.10.20.0 0.0.0.255 any
permit ip 10.10.50.0 0.0.0.255 any
!
logging esm config
!
!
!
!
!
line con 0
line vty 4
transport input ssh
line vty 5 15
transport input ssh

[Enes Simnica]

@TimMees60387 Thanks for the config. The issue is that ur VLAN interfaces are using IP addresses like 10.10.x.x, but ur switch is not doing any routing or NAT to reach the internet. Ur modem uses the 192.168.0.x network, and the switch doesn’t bridge or route between your VLANs and the modem.

The reason GigabitEthernet0/1 works is because it gets an IP directly from the modem via DHCP, so it’s on the same subnet. But ur other interfaces are in different VLANs and subnets, and they have no way to reach the modem unless there’s a router handling inter-VLAN routing and NAT.

SOOO If ur switch is Layer 2 only, it can’t route traffic from VLANs to the modem. U’ll need either a router or Layer 3 switch to connect the VLANs to the internet. and if u need help doing that just ping me...

-Enes

[TimMees60387]

it is a cisco c3500

[Enes Simnica]

alright then, since it's a c3500. u should now that most c3500 series switches can do layer 3 routing, but only if ip routing is enabled.

so if u trying to get internet from ur vlans, and the switch is a layer 3 capable model, i have the config for u:

ip routing
ex

and im assuming that the modem is on 192.168.0.1:
ip route 0.0.0.0 0.0.0.0 192.168.0.1

each vlan must be up/up:
and also do a show ip route, and send it to me

BUT I HAVE A VERY IMPORTANT QUESTION HERE: sounds like u're expecting the switch to give internet access to the VLANs directly. Just to clarify, the switch can route between VLANs, but it can’t perform NAT, which is required for internet access. For that, ur modem/router must be the NAT device, and the switch just routes internally. Let me know if u want to keep internal VLAN routing only, or need internet on all VLANs, I can help with the both options...!.

i need this last peace of the puzzle....?

[TimMees60387]

10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.10.30.0/24 is directly connected, Vlan3
L 10.10.30.1/32 is directly connected, Vlan3
C 10.10.40.0/24 is directly connected, Vlan4
L 10.10.40.1/32 is directly connected, Vlan4
11.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 11.11.11.0/24 is directly connected, Vlan1
L 11.11.11.10/32 is directly connected, Vlan1

[Enes Simnica]

@TimMees60387 this is my final answer: UR switch has VLAN routes but no path to the internet. Meaning that u need to point traffic to the modem with the ip route 0.0.0.0 0.0.0.0 192.168.0.1 like i said earlier...

MODEM MUST NAT VLAN SUBNETS: And ensure ur modem allows NAT for 10.10.0.0/16 and 11.11.11.0/24, cause without this, VLAN devices wont get internet

and if this still doesnt work, check the modems config meaning nat rules, ....

hope it helps..

Now im jumping on a meeting, but will follow ur post after......

[TimMees60387]

yes the modem is from my isp

[Joseph W. Doherty]

---

@TimMees60387 wrote:

yes the modem is from my isp

---

Do you have any configuration access to it?

If so, you would need to see what it supports for interior networks.

If it's a home consumer kind of device, again, it likely will only support one interior subnet, often determined by that device.

If so, also again, you would need another device to NAT your interior networks to a subnet IPs acceptable to the ISP "modem".

BTW, what specific 3500 model is it, and what IOS is it running.  I vaguely recall, there's major feature differences between some of the 3500 series.  Also, recall, none support NAT.

[TimMees60387]

SW1#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.10.30.0/24 is directly connected, Vlan3
L 10.10.30.1/32 is directly connected, Vlan3
11.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 11.11.11.0/24 is directly connected, Vlan1
L 11.11.11.10/32 is directly connected, Vlan1

[Joseph W. Doherty]

Your OP has a Catalyst 3000 tag, so I'm assuming it's a L3 switch.  If so, and if its routing is enabled, can any of the VLAN hosts, ping hosts on other VLANs?  If they can, that should confirm it's an operational L3 switch, if so . . .

The issue you would have, that L3 switch doesn't appear to have any routing information for networks not directly connected to it, like Internet networks.  That is often easy to correct, but . . .

If your "modem" is giving out 192.168.0.0/24 IPs, very likely it will only support that subnet.  If so, you would need to NAT your other internal subnets to an IP (PAT) or IPs in that subnet.  (If a 3k switch, good chance NAT/PAT not supported).  (A low cost consumer "router" might fulfill that need.)

BTW, VLAN 1 SVI is using a public IP.  Is this intentional?  NB: it would preclude contacting public IPs within 11.11.11.0/24.

[TimMees60387]

The topology is the modem WAN network 81.82.12.22 lan network of 192.168.0.1 this connected to the switches c3560 which is connected to different routers which are connected servers the switches always get internal network a separate vlans