Cisco 3750X And VLANS

[dcgtechnologies]

Hi All,

I am not a stranger to Cisco Switches, but a newbie to VLANs and have had some confusion with them. I am trying to implement a 9800 wireless lan controller. but I am putting it on hold until I get all my Vlans Setup correctly.

I have a total of five vlans. See below

vlan 100 - Internal network with RADUIS server and domain and main network with Default Gateway out to the internet

vlan 200 - Wifi SSD For separate devices to connect to vlan 100 and go out to the internet that are not on the domain

vlan 300 - Wifi SSD for devices for my smart home automation and nest protect etc.

vlan 400 - For an SSID for my garage for internet access

vlan 900 - management of all network and server devices

Here are a couple sample ports that are assigned out to physical devices from a port on the switch and I am running two 3750X switches and all other ports are on native vlan 100. See below:

Vlan100 - Internal Network - About 50% of the ports are assigned to this vlan as this is the native Vlan for Internal network

interface GigabitEthernet1/0/12
switchport access vlan 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

Vlan200 and VLAN300 Share This Port - Three Wifi SSID's

iinterface GigabitEthernet1/0/48
switchport access vlan 100
switchport trunk allowed vlan 100-300,900
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

VLAN400 - 1 Wifi SSID

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

Vlan900 - Management network

interface GigabitEthernet1/0/2
switchport access vlan 900
switchport trunk encapsulaton dot1q
switchport trunk native vlan 900
switchport mode trunk

I run a Zyxel Firewall and right now my Default Gateway is an untagged interface on the zyxel firewall. I would like it to be put under VLAN100. This device does all my routing within my network. Right now it is not working correctly, because when I introduce the VLAN100 profile with ip address 192.168.100.1 my whole network drops and loses access to everything and I have to rollback to the untagged interface for the firewall. I am keeping the same ip address of 192.168.100.1 as I do not want to Re-IP all my devices.

Here is the port that is configured to connect to firewall. See below:

interface GigabitEthernet1/0/1
switchport access vlan 100
switchport trunk allowed vlan 100-400,100
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

I am working with my vendor and they do not understand Cisco switches, but I have a small understanding but trying to understand if my vlan configuration is correct based on the sample set of ports I have provided. I want all VLANS to have access to VLAN100 for internet and also pull resources from the servers etc. I will be using the 9800 WLC on vlan100 and vlan900. I can hit everything if I leave the untagged interface on the Zyxel with no vlan on it, but as soon as I move to the VLAN100 profile nothing works at all. Does anyone have any tips or things I should check? Thank you. 

[Mark Elsen]

  - @dcgtechnologies          Did you also create the vlans on the switch ?

  M.

[dcgtechnologies]

Hi Mark, 

All vlans are on the switch as follows. See below:

1 default active Gi1/1/2, Gi1/1/3, Gi1/1/4
100 Internal_Network active Gi1/0/11, Gi1/0/14, Gi1/0/15
Gi1/0/16, Gi1/0/19, Gi1/0/20
Gi1/0/21, Gi1/0/22, Gi1/0/25
Gi1/0/26, Gi1/0/27, Gi1/0/28
Gi1/0/29, Gi1/0/30, Gi1/0/38
Gi1/0/42, Gi1/0/43, Gi1/0/45
Gi1/0/46
200 Wifi1_Network active
300 Wifi2_Network active
400 Wifi3_Network active
900 Mgmt_Network active Gi1/0/6

They are all on switches and labeled. I am just trying to see if my base configuration is setup correctly before I even move on with the 9800 WLC.

When I run the command show vlan br a port below for example 

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

should show here. See below

400 Wifi3_Network active

but it does not that is why I am confused. Should it show there when that command is ran? 

Thank you Mark.

[Mark Elsen]

  - @dcgtechnologies   On the switch this looks all good. As far as the connection with the Zyxel firewall is concerned,
                                    you will have to make sure that the firewall understands vlans and vlan tagging AND
                                    that the port on the firewall are configured in the correct vlan and allow traffic from it.
                                    For the 9800 I understood you where using vpsphere  ; you must also
                                    then make sure that those vlans become known in vsphere and can be made available
                                    on the (virtual) interfaces of the 9800 virtual controller.

  M.
                                    

[dcgtechnologies]

Hi Mark.....Thank you for all your replies. I am working with the vendor on this for my firewall and I think I have narrowed the issue down to my Dell VRTX which runs a R1-2401 switch inside the VRTX so I am working with Dell to get the VRTX configured correctly as I am using two of the four blades for vsphere. Right now I am halting all progress on the 9800 WLC until I get all my Vlans configure correctly to support the WLC. 

On the second part I was curious. When I run the command show vlan br a port below for example 

interface GigabitEthernet1/0/47
switchport access vlan 100
switchport trunk allowed vlan 400
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

should show here. See below

400 Wifi3_Network active

and also with 

900 Mgmt_Network active

interface GigabitEthernet1/0/2
switchport access vlan 100
switchport trunk allowed vlan 100,900
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk

I have six of these ports and they do not show up when I run show vlan br and are not located on that table at all. Any idea why? Thank you Mark!

[Rich R]

@dcgtechnologies You have those ports configured as Trunk ports - which is why they don't show.  Only access port VLANs will show there.

Note that there is special configuration required on VMware to support 9800-CL (I presume that is what you are planning to deploy?).  Refer to https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#C9800CLconsiderations and the 9800-CL installation and setup guides.

If your firewall only needs to access VLAN 100 then why do you want to use VLAN tagging on the port?  Why not just make it an access port in VLAN 100? (don't make it more complicated than it needs to be). 

[dcgtechnologies]

@Rich R Hello Rich,

Thank you for the explanation about the first point and yes I did follow that guide you mentioned as well as four others out there so I have a good grasp on the setup, but I need my network and VLAN's fixed before I proceed, because the Dell VRTX r1-2401 switch is not configured correctly, which I am working through now. 

If your firewall only needs to access VLAN 100 then why do you want to use VLAN tagging on the port?  Why not just make it an access port in VLAN 100? (don't make it more complicated than it needs to be).

What would this configuration look like? I do want it to have access to VLAN100 and I think I have over complicated my VLAN setup now that I understand the concepts after reading a lot over the past couple of days. Thank you.

[Rich R]

> What would this configuration look like?
interface GigabitEthernet1/0/1
 switchport access vlan 100
 switchport mode access

[Mark Elsen]

  - @dcgtechnologies       This one isn't correct :
                                        interface GigabitEthernet1/0/47
                                              switchport access vlan 100
                                             switchport trunk allowed vlan 400
                                       switchport trunk encapsulation dot1q
                                       switchport trunk native vlan 400
                                       switchport mode trunk

     You set the port in vlan 100, but only allow vlan 400 on the trunk, so in that case the line protocol on
     vlan 100 would remain down, because there is no active physical connection possible,

 M.

[Rich R]

@Mark Elsen switchport access vlan 100 is ignored by the switch because switchport mode trunk

[Mark Elsen]

  -  @Rich R       Then I would still remove 'switchport access vlan 100 '    from the port's configuration because of
                          consistency.

 M.

[Rich R]

> Then I would still remove 'switchport access vlan 100 '    from the port's configuration because of consistency.
100% yes - but actually - since the trunk port only has one VLAN (400) and it's the native VLAN (untagged) there is no point in even making this a trunk port - it should be an access mode port in VLAN 400...

[Mark Elsen]

  - @Rich R   Completely correct; what I would also like to point out for @dcgtechnologies  is  that when
                    an SVI (Vlan) is created and not attached to an active connected Gi-interface then the
                    Vlan will be up , but the line protocol will remain down (as you already observed).

  M.

[dcgtechnologies]

@Mark Elsen @Rich R The config for that port would look like this. See below:

Interface GigabitEthernet1/0/47
switchport mode allowed vlan 100
switchport trunk encapsulation dot1q
switchport trunk native vlan 400
switchport mode trunk

This is how I read it and basically there is no need to make it an access port because it is on the trunk, because of "switchport mode trunk" command. I want its native VLAN to be 400 and it needs access to resources on VLAN100. Is this accurate? Thank you.

[Rich R]

No!  It is either trunk or access mode - it can't be both.
"allowed" is not a valid mode for switchport. 
"switchport trunk allowed vlan" must list all the VLANs allowed on the port.

interface GigabitEthernet1/0/47
 switchport trunk allowed vlan 100,400
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 400
 switchport mode trunk