3

I am a little new to this but here is what I am hoping to achieve. I have an Adtran TA908e that I am managing as an ISP router. I am hoping to create a vLan to be able to attach it to my LAN for management purposes. Here is what I have done so far, but the LAN vLan does not work.

!
interface eth 0/1
  description Publicly Routable LAN
  encapsulation 802.1q
  no shutdown
!
interface eth 0/1.1
  description Publicly Routable LAN
  vlan-id 1 native
  ip address  216.5.156.185  255.255.255.248
  no shutdown
interface eth 0/1.100
  vlan-id 100
  ip address  172.31.9.244  255.255.255.0
  no shutdown
!
interface eth 0/2
  description  WAN
  ip address  216.157.108.103  255.255.255.252
  no shutdown
!

eth 0/1.1 is publicly routable and I already have two devices using .186 and .187 functioning. They are attached to an 8 port unmanaged switch attached to eth 0/1. I have another cable from that unmanaged switch to one of the switches on my LAN. That's why I setup the vlan-id 100 on eth 0/1.100 to match the vlan on my LAN. I cannot access the Adtran router through the 172.31.9.244.

This Adtran is there to route the traffic from the public range of IP's that the ISP gave me to there equipment. This is working exactly as it should. What I need is a way to manage the Adtran from my LAN. Any help or recommendations would be greatly appreciated.

Joshua

5

There are a few things wrong.

  1. Your unmanaged switch doesn't understand vlan tagging. You need a managed switch that supports vlan tagging in order to make this work.

  2. You need an ACL or other method of filtering traffic to block access to your management interface. As you have it now, anyone can access it.

  3. You need to insure that your static routing is configured correctly so that your management traffic only goes to to internal network.

6
  • Thank you so much for the clarifications. 1. I thought an unmanaged switch would pass along the vlan tagging. What would you recommend if I do not have access to a managed switch. FYI: The switches on my LAN are all managed. 2. If I can get past step one, I will implement security measures. 3. Would the static route be to the gateway of my LAN? Thanks again in advance for your help!!!
    – Joshua
    Nov 25 '14 at 21:18
  • An unmanaged (vlan unaware) switch will see 802.1q tagged traffic as "oversized" and drop it. (it'll be 4 bytes larger)
    – Ricky
    Nov 25 '14 at 22:53
  • If you can't replace the switch, the best you can do is control who can telnet or ssh to the switch. Most devices let you specify which addresses are allowed to access the management interface. Only allow your internal LAN (or select devices).
    – Ron Trunk
    Nov 26 '14 at 2:58
  • Thank you both for helping me. So I guess to summarize, the Adtran supports 802.1q and my LAN switches support 802.1q but the 8 port dumb switch between the two does not and is stripping the tagging. Without a managed switch between the two my only hope of management is a PC, or term server, attached directly to the the Adtran.
    – Joshua
    Nov 26 '14 at 15:22
  • Am I wrong in saying you just need to grant access to vty and set a username and password? That should work Nov 20 '19 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.