Ok I have quite a few of these SG300 switches installed and I can't for the life of me get devices on VLAN 1 to negotiate.  The port comes up but they don't pass any traffic.  In this example I am setting port 9 and port 8 to vlan 1 (the default vlan) and port 10 is my uplink to a Cisco 3750.   The vlan this switch resides on is 100    If I try and add vlan 1 to GE10's trunk, I get  switch222(config-if)#switchport trunk allowed vlan add 1,23,31,66,91,100 VLAN 1 : VLAN was not created by user   If I try add it to the database: switch222(config-vlan)#vlan 1 VLAN 1: VLAN is occupied for internal usage after reset.   How do I use vlan1 on a port on this ?   Vlan91 is a voice vlan   Here's my full config (sanitized).   config-file-header switch222 v1.4.7.6 / R800_NIK_1_4_194_194 CLI v1.0 set system mode switch    file SSD indicator encrypted @ ssd-control-start ssd config ssd file passphrase control unrestricted no ssd file integrity control ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 ! vlan database vlan 23,31,66,91,100 exit voice vlan id 91 voice vlan state oui-enabled voice vlan oui-table add 0001e3 Siemens_AG_phone________ voice vlan oui-table add 00036b Cisco_phone_____________ voice vlan oui-table add 00096e Avaya___________________ voice vlan oui-table add 000fe2 H3C_Aolynk______________ voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone voice vlan oui-table add 00d01e Pingtel_phone___________ voice vlan oui-table add 00e075 Polycom/Veritel_phone___ voice vlan oui-table add 00e0bb 3Com_phone______________ errdisable recovery cause port-security hostname switch222 line console exec-timeout 30 exit line ssh exec-timeout 0 exit line telnet exec-timeout 30 exit no passwords complexity enable username xxx password encrypted blah blah blah privilege 15 ip ssh server ip ssh password-auth snmp-server server ip http timeout-policy 1800 clock timezone " " -4                                  clock source sntp clock source browser ip domain name versaterm.com ! interface vlan 23  name users ! interface vlan 31  name "Guest Vlan" ! interface vlan 66  name "Demo Vlan" ! interface vlan 91  name Voice ! interface vlan 100  name routing  ip address xx.xx.xx.xx 255.255.255.0  no ip address dhcp ! interface gigabitethernet1                              spanning-tree link-type point-to-point  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 66 ! interface gigabitethernet2  storm-control broadcast enable  storm-control broadcast level 10  storm-control include-multicast  port security max 10  port security mode max-addresses  port security discard trap 60  spanning-tree portfast  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 66  macro description ip_phone_desktop ! interface gigabitethernet3  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 23                       ! interface gigabitethernet4  storm-control broadcast enable  storm-control include-multicast  port security max 10  port security mode max-addresses  spanning-tree portfast  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 23  macro description guest ! interface gigabitethernet5  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 23 ! interface gigabitethernet6  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 23 !                                                      interface gigabitethernet7  spanning-tree portfast  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91  switchport trunk native vlan 23 ! interface gigabitethernet8  spanning-tree portfast  spanning-tree bpduguard enable  switchport trunk allowed vlan add 91 ! interface gigabitethernet9  speed 100  no negotiation  spanning-tree bpduguard enable   switchport trunk allowed vlan add 91 ! interface gigabitethernet10  switchport trunk allowed vlan add 23,31,66,91,100  switchport default-vlan tagged ! exit                                                   macro auto disabled macro auto processing type host enabled macro auto processing type switch disabled macro auto processing type ap disabled macro auto built-in parameters ip_phone_desktop $max_hosts 10 $native_vlan 23 ip default-gateway <3750 Switch IP> ... View more

I have a question about ASA vpn capabilities.  I have an asa 5512x that I am using for Cisco Phone VPN access as well as some remote access via the Ipsec client.   Within the last year we installed wireless and have a separate SSID for BYOD devices.  This wireless network is "inside" the ASA.  The asa's inside interface is on a different vlan/subnet from the BYOD network.  I have an access list on my Wireless controller that prevents BYOD IPs from connecting to our corporate network (and it works quite nicely).  We use ISE to profile the devices and put them into a BYOD network if they are android, IOS etc.   That being said, we are beginning to have certain users ask for their BYOD devices to be connected to our corporate network so they can test apps they've developed on the mobile platforms.  I do not want to re-provision them onto the corporate network.  My idea is to use the existing ASA to provide VPN access to BYOD devices wanting access to our corporate network.  I have tested the devices from the "outside" of the network and they connect no problem.  When I connect from the BYOD network to the inside address, the ASA refuses the connection.  If I connect from the BYOD to the outside of the ASA, I get sketchy results (i.e. some devices work, some don't).     My question is, can I setup another "outside" interface on the ASA and connect that to the BYOD subnet to allow connections from BYOD to the ASA via IPsec?  Is this commonly done?  Are there any gotchas?   Thanks   Mike ... View more

I have setup a Sponsored Guest Wifi on a 2504 with ISE 1.3.  I can create Guests, they can associate, and get re-directed to a Web Auth.  It all works great.   I have a few guest types, one of which is a 5 day guest.  With the 5 day guest with access hours between 8am - 6pm, I'd like to have the end user login to the network every morning.  As it works now, the guest can login once during, and they are good for the entire 5 days.   I have two Auth Profiles setup.  The first one is to do the CWA to get the user to sign on to the network.  The 2nd Profile is to allow guest endpoints access to the network.  I set the Reauthentication timer in the "Access" policy to 6000 seconds, however I am not sure that is working as expected.   Any hints on pushing Guest users back to the portal for authentication periodically? ... View more

We have a number of 6941's connected to 3750 switches.  The user's computer connects to the phone and they are put on a separate VLan.     When a user tries to copy a large file (22gb Vmware Image) via windows networking the copy process fails.  If we disconnect the phone and connect the station directly to the switch, the copy succeeds no problem.   We are suspecting an issue between the phones and the switch.  We plan on trying a few different sources for the data before we call TAC.     Has anyone else seen anything like this before?   Thanks,   Mike ... View more

I am not sure if I am using the right terminology but I am attempting to build a HSRP pair of 2911s.  The inside interfaces with be Gi0/1-2 and will be Port Channeled to a 3750x.  I have setup HSRP on both routers and it's behaving as expected. The Outside interfaces will be on Gi0/0 and will be setup with HSRP with some static nat translations that are tied to the HSRP group. I want to know if the HSRP gets triggered from either the inside or the outside, will both the port channel, and outside interfaces switch, or only the one that goes down?  Can I setup the inside interfaces to track the outside interfaces and vice versa? ... View more