Hi all,   I am somewhat of a Cisco switching beginner, but have inherited a network that contains a switch stack of 4 x Catalyst 3560.   Due to the sale of a portion of the company (and the end users still being in our building), I have had to create a separate VLAN to virtually isolate their network.  I have done this by creating a new VLAN (80, 172.16.80.0/24) and putting in an ACL so that they can't route out to any servers they shouldn't.  This VLAN gets DHCP from the switches, but DNS from a server on our existing network.   All is good that end.  However, we also have an RDS farm set up on our own network (VLAN 1, 172.16.100.0/24) and some of these users will work from home, via a Remote Desktop Broker on this VLAN.  I've been trying to figure out how to let the Remote Desktop servers see through to the File Store server that is on VLAN 80, but can't seem to get there.  If anyone has any advice, it would be most appreciated!   I have added what I think are all the relevant lines from my switch config below.  Please let me know if any more information is needed:   ip dhcp pool EXAMPLE network 172.16.80.0 255.255.255.0 default-router 172.16.80.254 dns-server 172.16.100.1 ! interface Port-channel101 switchport trunk allowed vlan 1,3,4,10,40,50,101,200 switchport mode trunk ! interface Port-channel102 switchport trunk allowed vlan 1,3,4,10,40,50,101,200 switchport mode trunk ! interface GigabitEthernet0/0 vrf forwarding Mgmt-vrf no ip address negotiation auto ! interface GigabitEthernet1/0/7 description EXAMPLE-File-Store-Server switchport access vlan 80 switchport mode access spanning-tree portfast ! interface GigabitEthernet2/0/14 description WP396 EXAMPLE PHONE/PC switchport access vlan 80 switchport mode access switchport voice vlan 10 spanning-tree portfast service-policy input 10Mbps service-policy output 10Mbps ! interface GigabitEthernet4/0/44 description VM HOSTING REMOTE DESKTOP BROKER switchport mode access spanning-tree portfast ! interface Vlan1 description Core-Network ip address 172.16.100.254 255.255.255.0 ! interface Vlan80 description EXAMPLE Network ip address 172.16.80.254 255.255.255.0 ip access-group EXAMPLE in ! ip access-list extended EXAMPLE permit udp any host 172.16.100.1 eq domain permit tcp any host 172.16.100.130 eq 3389 (RD Broker IP) permit tcp any host 172.16.100.130 eq 443 permit tcp any host 172.16.80.24 eq 139 (Printer) permit tcp any host 172.16.80.24 eq 445 permit udp any host 172.16.80.24 eq netbios-ns permit udp any host 172.16.80.24 eq netbios-dgm permit tcp any host 172.16.80.24 eq www permit tcp any host 172.16.100.4 (3rd Party App Server) permit udp any host 172.16.100.4 permit tcp any host 172.16.100.24 permit udp any host 172.16.100.24 permit icmp any 0.0.0.0 255.255.255.0 echo deny ip any 172.16.0.0 0.0.255.255 permit ip any any ... View more

Hi everyone,   I wonder if you can help me?   We have several users running the MiCollab Softphone software on their mobile devices and have recently amended our Wi-Fi configuration to include an isolated guest wireless network.  This network has no access to internal IP addresses apart from UDP port 53 to our DC for DNS and TCP ports 443 and 3389 to our RDS broker.  This is done using an IP Access Control List.   The Staff wireless network has access to all servers across the network.   The problem is that Softphone users on the Guest network cannot connect to the server.  I have tried allowing all TCP and UDP traffic to both the internal and external IP of the Mitel server and the firewall on the Guest network, but it is not working.   I’m thinking that the traffic is going out to the external IP of our Mitel server, but is not coming back for some reason.  Maybe because it resolves to an internal IP it does not have access to?   Just so you are aware, we are running our network on a Cisco 3560 switch stack and Cisco WAP121 wireless access points.  There is no real config in the WAPs for the network as all routing is handled by the switches.  Inter VLAN routing is enabled and working fine.   Our config is currently as follows for the relevant areas:   ip dhcp pool GuestWifi network 192.168.70.0 255.255.255.0 default-router 192.168.70.254 dns-server 192.168.100.1 interface Vlan60 description Internal Wifi ip address 192.168.60.254 255.255.255.0 ip helper-address 192.168.100.1 ! interface Vlan70 description Wireless Guest Network ip address 192.168.70.254 255.255.255.0 ip access-group blockguest in ip access-list extended blockguest permit tcp any host 192.168.100.130 eq 3389 (RDS Broker) permit tcp any host 192.168.100.130 eq 443 (RDS Broker) permit udp any host 192.168.100.1 eq domain (DNS Server) permit tcp any host 192.168.1.2 (Internal Mitel Server IP1) permit tcp any host 192.168.1.13 (Internal Mitel Server IP2) permit tcp any host 222.111.122.770 (External Mitel Server IP) permit tcp any host 222.111.122.666 (External Firewall IP) deny ip any 192.168.0.0 0.0.255.255 permit ip any any   Any help you could give in guiding me in the right direction would be very gratefully appreciated!   Many thanks, Steve ... View more