I am curious, is the Internal/Private VLAN that the PLC is on the same as the Outside/Public Vlan that you are translating the traffic for?
Does it also work if you do NOT "Permit All" ?
With "Permit all" turned on, it allows all multicast/broadcast traffic to pass to the outside network and that is what we do not want, but then I have to have a Translation for every IP address going out and every device coming in. So when we want to collect data with OPC servers, I have to add them to the "outside to inside" translations and give them an Internal/Private IP address or I can not communicate with the Machine devices.
Hi folks, I pulled my hair out over this configuration this week and finally got it working with this simple configuration. This is running on an IE-2000-8TC-G-N with the enhancedlanbase license level
Real "Inside" IP Addresses: 192.168.10.20/16
Default Gateway of 192.168.10.4 specified on the PLC device. NAT traffic back and forth between 10.247.28.65 (Outside/public) to 192.168.10.20 (inside/private).
interface GigabitEthernet1/1 switchport trunk allowed vlan 1,149,151 switchport mode trunk srr-queue bandwidth share 1 30 35 5 priority-queue out mls qos trust cos macro description cisco-switch auto qos trust l2nat Instance1 151 spanning-tree link-type point-to-point ip dhcp snooping trust
interface FastEthernet1/1 description Andon PLC - 192.168.10.20 (NAT'd to 10.247.28.65) switchport access vlan 151 switchport mode access srr-queue bandwidth share 1 19 40 40 priority-queue out macro description cisco-ethernetip storm-control broadcast level 3.00 1.00 spanning-tree portfast edge
l2nat instance Instance1 instance-id 1 permit all fixup all outside from host 10.247.28.94 to 192.168.10.4 gateway outside from host 10.247.28.65 to 192.168.10.20 inside from host 192.168.10.20 to 10.247.28.65 l2nat Instance1 151
Hope this helps fellow people who have struggled to make this work.
... View more
I question this workaround method, and I hope that someone can explain it better.
If Profinet is enabled by default and you use the "no profinet" command in the global configuration doesn't this disable profinet globally?
If that is true and profinet is required the only real workaround is to downgrade the switch to an earlier release.
Workaround: Issuing the following commands after the upgrade: 0. enable 1. conf t // enter config globally 2. no profinet // disable profinet since it is enabled by default 3. ip default-gateway x.x.x.x // re-config the system with 4. end //exit config mode 4. write mem // Save configuration to startup config 5. Reload // reboot the system
TAGS: Cisco IE, Industrial, profinet, no ip default-gateway, Cisco Bugs
... View more