Routing Between VLANs on Cisco 1921

Question

I have setup a new VLAN for VoIP phones that are being installed. I would like to segment their traffic to Subnet 10.20.77.0/24. I added an IP address to the DHCP server of 10.20.77.11 to help serve DHCP traffic for this VLAN. When I connect a laptop to a switchport on this VLAN it does not pick up an IP address and I am also unable to ping the DHCP Server on its address 10.20.77.11. I am thinking I have an ACL or a NAT Problem but I do not understand cisco enough to troubleshooting this on my own.

Router's Running Config

Current configuration : 6198 bytes
!
! Last configuration change at 10:09:23 gmt Wed Nov 1 2017 by admin
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname EASI-FW1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
ethernet lmi ce
clock timezone gmt -8 0
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name contoso.local
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
license udi pid CISCO1921/K9 sn 
!
!
!
redundancy
!
!
!
!
lldp run
!
!
class-map match-any Voice
 match protocol sip
 match protocol rtp audio
class-map match-any QoS-Bulk
 match protocol secure-nntp
 match protocol smtp
 match protocol tftp
 match protocol ftp
class-map match-any QoS-Management
 match protocol snmp
 match protocol dns
 match protocol secure-imap
class-map match-any QoS-Inter-Video
 match protocol rtp video
class-map match-any QoS-Voice-Control
 match access-group name Voice-Control
!
policy-map QOS
 class Voice
  priority percent 25
  set dscp ef
 class QoS-Inter-Video
  bandwidth remaining percent 10
  set dscp af41
 class QoS-Bulk
  bandwidth remaining percent 5
  random-detect dscp-based
  set dscp af11
 class QoS-Management
  bandwidth remaining percent 1
  set dscp cs2
 class QoS-Voice-Control
  priority percent 5
  set dscp ef
 class class-default
  fair-queue
!
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.1
 description LAN
 encapsulation dot1Q 1 native
 ip address 10.20.75.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map LAN
!
interface GigabitEthernet0/0.76
 description SteelNet76
 encapsulation dot1Q 76
 ip address 10.20.76.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map WLAN76
!
interface GigabitEthernet0/0.200
 description Voice
 encapsulation dot1Q 200
 ip address 10.20.77.1 255.255.255.0
 ip access-group Local in
 ip access-group Local out
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 ip policy route-map SIP200
!
interface GigabitEthernet0/1
 description TelusWAN
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
ip forward-protocol nd
!
no ip http server
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source static tcp 10.20.75.11 443 interface GigabitEthernet0/1 443
ip nat inside source static tcp 10.20.75.11 987 interface GigabitEthernet0/1 987
ip nat inside source static tcp 10.20.75.11 1723 interface GigabitEthernet0/1 1723
ip nat inside source route-map LAN interface GigabitEthernet0/1 overload
ip nat inside source route-map SIP200 interface GigabitEthernet0/1 overload
ip nat inside source route-map WLAN76 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 track 1
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
ip access-list extended LAN
 permit ip 10.20.75.0 0.0.0.255 any
 deny   ip any any
ip access-list extended SIP200
 permit ip 10.20.77.0 0.0.0.255 any
 deny   ip any any
ip access-list extended WLAN76
 permit ip 10.20.76.0 0.0.0.255 any
 deny   ip any any
!
!
route-map WLAN76 permit 20
 match ip address WLAN76
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map LAN permit 10
 match ip address LAN
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
route-map SIP200 permit 30
 match ip address SIP200
 set interface GigabitEthernet0/1
 set default interface GigabitEthernet0/1
!
!
access-list 23 permit XXX.XX.XXX.196
access-list 23 permit 10.20.75.0 0.0.0.255
access-list 24 permit 10.20.77.0 0.0.0.255
access-list 120 permit ip 0.0.0.11 255.255.255.0 any
!
control-plane
!
!
!
line con 0
 login local
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class 23 in
 privilege level 15
 login local
 transport input ssh
line vty 5 15
 access-class 23 in
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler allocate 20000 1000
!
end

EASI-FW1#

Should the Route Map specify the sub interface of Gi0/1?

Answer 1

It sounds like your DHCP server is just using a secondary address on the same VLAN as its primary address. That will not work. You can simply add a helper address for the DHCP relay. For example:

interface GigabitEthernet0/0.200
 description Voice
 encapsulation dot1Q 200
 ip address 10.20.77.1 255.255.255.0
 ip helper-address 10.20.75.11
!

That will send any DHCP requests on the 10.20.77.0/24 network to the DHCP server at 10.20.75.11, and it will send any responses from the server back to the originating network. If you have the proper DHCP scope configured on the DHCP server, then everything should work.

Doing this removes the need for the DHCP server to have an address on the 10.20.77.0/24 network, so you can remove the secondary addressing.

If you want the secondary addressing on the DHCP server, then you need to set it up with a trunk interface on both the switch and server.