We need to know a bit more about your environment before we can offer really good advice. You describe a switch with a vlan and an IP address on that vlan. Then you describe a wifi router using an address in a different subnet. You do not tell us whether that wifi router is in the same vlan or is in a different vlan.   HTH   Rick ... View more

Dirk   There may be more than one issue in this discussion. One issue is about "ghost" subinterfaces which have been deleted from the config but still show up in the output of show ip interface brief (and which can present challenges if you attempt to change certain aspects of their configuration). My experience has been that the only way to get these ghost sub interfaces to really go away has been to save the config and reboot.   But it appears that your original issue was probably not really about ghost subintefaces. You report that a subinterface is configured, that ping through that subinterface fails, and that configuring a new subinterface with the same vlan tagging does work. We need to do some additional investigation about this issue. The next time that it happens please provide the output to these commands: show ip interface brief show interface <interface_id> show arp   HTH   Rick ... View more

@paul driver makes an assumption that the provider has given you a /24 subnet to use. If that is the case then it makes sense to want to use 1 IP in that subnet on the router and to use another IP in that subnet for your PC (so no need for any address translation). We do not know much about this ISP and what it has assigned and I do not necessarily share that assumption. I believe that another reasonable assumption is that 10.1.57.0 is a subnet used by the provider for customer connections. You are assigned an IP in that subnet and that other customers are assigned other IPs in that subnet. If this is the case and you assign another IP in the subnet to your PC then you may be duplicating an address used by someone else connecting to this ISP. If you do not assign the IP to the router then you could assign that IP to your PC (it works with no need for address translation - if you had more than one device then there would be a need for your devices to be in a separate e subnet and for the router to perform address translation).   Both of these are reasonable assumptions. Perhaps the original poster can check with the ISP and let us know which one is used by the ISP.   HTH   Rick ... View more

@paul driver makes an interesting suggestion that I had not thought of. And thinking about it I am not sure that you necessarily need IRB. I think it would be sufficient to just do these steps: - no ip routing  -  bridge 1 protocol ieee - on each Fa interface  no shut    bridge-group 1 This would enable bridging on the router and allow your PC to communicate with the ISP directly.   HTH   Rick ... View more

I think that @paul driver raises an interesting point about the possibility of ghost interfaces. Would you post the output of show ip interface brief?   HTH   Rick ... View more

If I am understanding correctly the issue with the access list is that as configured the access list is checking for an incorrectly configured IP address (looking for a source address that is not in 172.28.29). But the problem is not about the configured address but is about the mask. I do not know of a way to use an access list and detect anything about the configured mask.   In reading the discussion I wondered if the issue might be that the PC configured with a /16 would simply arp for destinations, and if it received an arp response then it simply forwards the packets with the appropriate host mac address (which avoids the IP forwarding logic of the interface). If this really is the issue then perhaps the solution would be to disable proxy arp on the interface. This would allow arp to locally connected devices but not to devices in other subnets.   But as I think about the original post I am not at all clear about what the problem really is. We have this statement " Our problem is that we can ping all the vlans even if we set a wrong subnet mask ". Does that imply that there are some destinations that should not be reachable from 172.28.29? If so please identify what these destinations are. Once we know what destinations should not be reachable it should be possible to write an access list that will deny access to those destinations and permit access to others. Please provide clarification about what the problem really is.   HTH   Rick ... View more

This is a very open ended question. There are many RFCs, some of them tightly focused on specific aspects of networking and some very general in their focus. It would be very difficult to assemble a list of all RFCs that these platforms support and I am not aware that Cisco has published such a list. If you could be a bit more specific about what you are looking for we might be able to suggest some solutions.   HTH   Rick ... View more

My first comment would be that if you have only a single PC and the 1841 then you do not really need the 1841. You could just connect your computer to the provider and configure the PC with the information that the provider gave you.   But you asked a question about how to configure the router and I will answer that. Here are the minimum things you need to do to set up the 1841 and allow your computer to connect to it and to access the Internet. 1) configure an interface (probably Fa0/0) with the IP address and mask given by the provider. (remember to no shut the interface after you configure it) 2) choose an IP subnet for your inside connection. (perhaps use 10.10.10.0) 3) configure an interface (probably Fa0/1) with an IP address and mask from the subnet you chose. (remember to no shut the interface after you configure it) 4) configure your PC with an IP address and mask in that subnet. Configure the PC default gateway as the IP assigned to the router interface. Configure DNS on the PC using the addresses supplied by the provider. An option could be to configure the router with a DHCP pool and have the PC use DHCP to learn its address - but that adds complexity to the config and I suggest that you keep it simple. 5) connect the PC to the router interface. If you are connecting the PC directly to the router interface you might need an Ethernet cross over cable rather than an standard straight through Ethernet cable. 6) configure a static default route using the next hop supplied by the provider. 7) configure address translation so that traffic from the PC to the Internet will be translated using the router outside interface IP. If you do these things correctly then your PC should have access to the Internet.   HTH   Rick ... View more

I find your description of what you have done and the problems you encounter to be confusing. Perhaps posting some information from the config might help us to understand the issue. Or perhaps a diagram showing how things are connected might be helpful.   The one thing that is clear is about Guest vlan not having access to Internet. There are several things that might cause this. First I suggest that you check and see if there is address translation for those addresses as they attempt to access the Internet. If address translation is ok then I suggest that you check and see if the first main router has a route for the subnet of the Guest vlan.   HTH   Rick ... View more

What you are doing does create the problem. It is not a limitation of the RV160W. When you use 10.1.0.0/16 it does not conflict with your local subnet. But when you try to say that the entire 10.0.0.0/8 is remote it is not possible to have 10.55.107/24 as the local subnet. As I suggested before you can resolve this by making the local subnet in a different network than 10.0.0.0.   HTH   Rick ... View more

Knowing that it does work when you configure the remote subnet as /16 confirms what I said in my previous response. Are you satisfied that you have a solution that works? Or is there some reason why you want the remote subnet to be /8?   If you really want the remote subnet to be /8 then you will need to change the subnet of the Lan on your router, perhaps using a 172.16 subnet.   HTH   Rick ... View more