Here's what I tried at no avail - DHCP req from192.168.20.0 are served while 192.168.5.0 aren't.   ip dhcp pool a.local  network 192.168.20.0 255.255.255.0  domain-name a.local  default-router 192.168.20.2  dns-server 192.168.20.211  lease 7 ! ip dhcp pool b.local  network 192.168.5.0 255.255.255.0  domain-name b.local  default-router 192.168.5.1  dns-server 8.8.8.8  lease 7   ifconfig: interface GigabitEthernet0/2  description Downlink b  ip address 192.168.5.1 255.255.255.0  ip access-group 198 in  ip nat inside  ip virtual-reassembly in  ip policy route-map ecotel  duplex auto  speed auto end   interface GigabitEthernet0/0  description Downlink a  ip address 192.168.20.2 255.255.255.0  ip nat inside  ip virtual-reassembly in  ip tcp adjust-mss 1452  ip policy route-map ecotel  duplex auto  speed auto  no cdp enable end   ACL 198 Extended IP access list 198     10 permit ip 192.168.5.0 0.0.0.255 172.16.0.0 0.0.255.255 (7 matches)     20 permit ip 192.168.5.0 0.0.0.255 192.168.5.0 0.0.0.255 (22 matches)   #ACL198 will keep 192.168.5.0 isolated from other networks. # The route-map policy is for PBR, directing chatty http traffic over a dedicated WAN link without maxing out our main SDSL. What I observed is that dh debug dhcp det yields nothing; apparently the discover packets don't arrive on gi0/2. Can you think something I'm doing wrong ?     ... View more

Jon   it works now save for the ICMP issue which I am onto now.   >>then you would need to make the connection a trunk link :-)   which in turn would render VLAN3 unreachable again :-(   ... View more

No, there are no ACLs in place. They are already written, but not accesss-grouped on the interface as I wanted to sort this out first.   Speaking about interfaces; let me sketch out the way ahead. I will need to have another DHCP scope for this VLAN. (192.168.20.0 is already in place). To avoid the router to serve from 192.168.5.0 into 192.168.20.0 (what it in fact does) I will need VLAN segregation on the interfaces; I am guessing I need some subifs ?   Dan ... View more

Y i k e s , that did the trick. 192.168.20.0 (VLAN1) -> any other [OK] 172.16.0.0 (VLAN2) -> any other [OK] 192.168.5.0 (VLAN3) -> almost, that is - can ping anything but 192.168.5.1 (gateway ip in the router which won't respond. I am guessing it's an ICMP permit issue.   Damnit.......access mode.   ... View more

Jon,   ACCESS3 Notebook 192.168.5.2 connected to FaE0/47, showing:    3    54ee.752c.6904    DYNAMIC     Fa0/47 CORE0 to check if it's there: Notebook hits the switch and shows the MAC on Gi0/7:    3    54ee.752c.6904    DYNAMIC     Gi0/7   PING Test   Ping Test 1 (Notebook to its Gate 192.168.5.1 ) Ping 192.168.5.2 <-> 192.168.5.1 (gateway) timeout -> FAIL Ping Test 2 (Notebook to Printer in VLAN3, both units @ ACCESS3) Ping 192.168.5.2 <-> 192.168.5.254 (printer) -> SUCCESS     Ping Test 3 Unplugged the Notebook from ACCESS3. (Verfied MAC Table is clear now.) Hooked the Notebook onto ACCESS2, reconfigured FaE0/23 as VLAN3. This port is the only port belonging to VLAN3 on this box. Ping 192.168.5.2 -> 192.168.5.1 FAIL Ping 192.168.5.2 -> 192.168.5.254 SUCCESS I went on to see if there is still something wrong with the trunk config on the various interfaces. Forced ACCESS0,1,2,3 to switchport enc dot1q, did the same on 0 and 1 (2950 would only accept switchport mode trunk) . Same job done on core0, reconfiguring all ports connecting to switches there. Verified each and every port is in ON state and dot1q trunking mode across the entire cascade, verified OK as seen on ACCESS3 here: Port        Mode             Encapsulation  Status        Native vlan Gi0/1       on               802.1q         trunking      1 Port        Vlans allowed on trunk Gi0/1       1-4094   RESULTS: VLAN3 will ping internally inside and across any switch, but won't reach it's gateway. VLAN3 won't ping into all other VLANs.   Now, I checked if there's something wrong with the router whose mac for VLAN3 is 3c08.f6e1.11f2. The mac hits every switch, here on ACCESS3: access3#sho mac address-table | inc 11f2    1    3c08.f6e1.11f2    DYNAMIC     Gi0/1   I'm really out of my wits now. Dan ... View more

Jon,   (output below) As per my understanding, any switch/switch connection carrying vlan info should be configured as trunk as to 1) have VTP propagating via its dedicated propagator interface on the VTP server and 2) to have the switches carry the traffic for the desired VLAN. Is there something wrong in my thinking ? Core: ---------------------- Port        Mode             Encapsulation  Status        Native vlan Gi0/7       desirable        n-802.1q       trunking      1 Gi0/8       desirable        n-802.1q       trunking      1 Gi0/11      desirable        n-802.1q       trunking      1 Gi0/12      desirable        n-802.1q       trunking      1 Port        Vlans allowed on trunk Gi0/7       1-4094 Gi0/8       1-4094 Gi0/11      1-4094 Gi0/12      1-4094 Port        Vlans allowed and active in management domain Gi0/7       1-3 Gi0/8       1-3 Gi0/11      1-3 Gi0/12      1-3 Port        Vlans in spanning tree forwarding state and not pruned Gi0/7       1,3 Gi0/8       1-3 Gi0/11      1-3 Gi0/12      1-3   Access 0 ---------------------- Port        Mode         Encapsulation  Status        Native vlan Gi0/1       on           802.1q         trunking      1 Gi0/2       desirable    802.1q         trunking      1 Port      Vlans allowed on trunk Gi0/1       1-4094 Gi0/2       1-4094 Port        Vlans allowed and active in management domain Gi0/1       1-3 Gi0/2       1-3 Port        Vlans in spanning tree forwarding state and not pruned Gi0/1       1-3 Gi0/2       1-3     Access 1 ---------------------- Port        Mode         Encapsulation  Status        Native vlan Fa0/1       on           802.1q         trunking      1 Fa0/27      on           802.1q         trunking      1 Gi0/2       desirable    802.1q         trunking      1 Port      Vlans allowed on trunk Fa0/1       1-4094 Fa0/27      1-4094 Gi0/2       1-4094 Port        Vlans allowed and active in management domain Fa0/1       1-3 Fa0/27      1-3 Gi0/2       1-3 Port        Vlans in spanning tree forwarding state and not pruned Fa0/1       1-3 Fa0/27      1-3 Gi0/2       1-3 Access 2 ---------------------- Port        Mode             Encapsulation  Status        Native vlan Gi0/1       on               802.1q         trunking      1 Gi0/2       auto             802.1q         trunking      1 Port        Vlans allowed on trunk Gi0/1       1-4094 Gi0/2       1-4094 Port        Vlans allowed and active in management domain Gi0/1       1-3 Gi0/2       1-3 Port        Vlans in spanning tree forwarding state and not pruned Gi0/1       1-3 Gi0/2       1-3 ACCESS3 ---------------------- Port        Mode             Encapsulation  Status        Native vlan Gi0/1       on               802.1q         trunking      1 Port        Vlans allowed on trunk Gi0/1       1-4094 Port        Vlans allowed and active in management domain Gi0/1       1-3 Port        Vlans in spanning tree forwarding state and not pruned Gi0/1       1-3   ... View more

Drawing attached. I should add that 0 and 1 are 2950's, 2 and 3 are 2960's, the core is a 3550. (Couldn't find the right visio stencils.) All switches running the latest available IOS (core Version 12.2(44)SE6; Access 0,1 Version 12.1(22)EA14, access2,3 Version 12.2(50)SE4. All IP Base Image.           ... View more

Whilst drawing, I found something strange. Some of the interfaces involved in VLAN 2 and 3 are GBIC (via Copper) and these are not showing up in the list (show VLAN). Only non-GBIC ports are listed.   Dan   ... View more

Hi Jon,   thanks for this. I will sketch it out and come back on Monday.   Dan ... View more