1

I'm trying to connect a door intercom to fastethernet 0/1 and then 8 users connect to fe 0/2-fe 0/9 and give each user access to the first port (0/1) without letting them access each other. I have implemented the code in Packet Tracer, and it works fine there. But unfortunately, on my Cisco 3560 24PS-S it doesn't work. Can you help me address and fix the issue? Thanks.

Switch#show running-config 
Building configuration...

Current configuration : 2589 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
system mtu routing 1500
ip routing
!
!
!
!         
!         
!         
!         
!         
spanning-tree mode pvst
spanning-tree extend system-id
!         
vlan internal allocation policy ascending
!         
!         
!         
!         
interface FastEthernet0/1
 no switchport
 ip address 192.168.10.2 255.255.255.252
!         
interface FastEthernet0/2
 switchport access vlan 10
 switchport mode access
!         
interface FastEthernet0/3
 switchport access vlan 20
 switchport mode access
!         
interface FastEthernet0/4
 switchport access vlan 30
 switchport mode access
!         
interface FastEthernet0/5
 switchport access vlan 40
 switchport mode access
!         
interface FastEthernet0/6
 switchport access vlan 50
 switchport mode access
!         
interface FastEthernet0/7
 switchport access vlan 60
 switchport mode access
!         
interface FastEthernet0/8
 switchport access vlan 70
 switchport mode access
!         
interface FastEthernet0/9
 switchport access vlan 80
 switchport mode access
!             
interface Vlan1
 no ip address
 shutdown 
!         
interface Vlan10
 ip address 192.168.10.6 255.255.255.252
 ip access-group 101 in
!         
interface Vlan20
 ip address 192.168.10.10 255.255.255.252
 ip access-group 101 in
!         
interface Vlan30
 ip address 192.168.10.14 255.255.255.252
 ip access-group 101 in
!         
interface Vlan40
 ip address 192.168.10.18 255.255.255.252
 ip access-group 101 in
!         
interface Vlan50
 ip address 192.168.10.22 255.255.255.252
 ip access-group 101 in
!         
interface Vlan60
 ip address 192.168.10.26 255.255.255.252
 ip access-group 101 in
!         
interface Vlan70
 ip address 192.168.10.30 255.255.255.252
 ip access-group 101 in
!         
interface Vlan80
 ip address 192.168.10.34 255.255.255.252
 ip access-group 101 in
!                 
ip classless
ip http server
no ip http secure-server
!         
!         
access-list 101 permit ip any host 192.168.10.3
!         
!         
!         
line con 0
line vty 0 4
 login    
line vty 5 15
 login    
!         
end       

Switch#

The output of show-version:

Switch#show version 
Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(55)SE9, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Mon 03-Mar-14 22:36 by prod_rel_team
Image text-base: 0x01000000, data-base: 0x02F00000

ROM: Bootstrap program is C3560 boot loader
BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(44)SE5, RELEASE SOFTWARE (fc1)

Switch uptime is 2 hours, 24 minutes
System returned to ROM by power-on
System image file is "flash:c3560-ipservicesk9-mz.122-55.SE9/c3560-ipservicesk9-mz.122-55.SE9.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C3560-24PS (PowerPC405) processor (revision M0) with 131072K bytes of memory.
Processor board ID CAT0929Z00J
Last reset from power-on
10 Virtual Ethernet interfaces
24 FastEthernet interfaces
2 Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : 00:14:F2:B4:32:00
Motherboard assembly number     : 73-9673-06
Power supply part number        : 341-0029-03
Motherboard serial number       : CAT09290NPC
Power supply serial number      : LIT092300JT
Model revision number           : M0
Motherboard revision number     : A0
Model number                    : WS-C3560-24PS-S
System serial number            : CAT0929Z00J
Top Assembly Part Number        : 800-25861-03
Top Assembly Revision Number    : A0
Version ID                      : V05
CLEI Code Number                : COM1X00ARB
Hardware Board Revision Number  : 0x01


Switch Ports Model              SW Version            SW Image                 
------ ----- -----              ----------            ----------               
*    1 26    WS-C3560-24PS      12.2(55)SE9           C3560-IPSERVICESK9-M     


Configuration register is 0xF

Switch#
  • Could you post the output of show version? – user36472 Oct 19 '18 at 19:06
  • The address you have on Fa0/1 is part of the prefix 192.168.10.0/30. You have 192.168.10.2 assigned to the port. The other host on that interface would be 192.168.10.1. You've permitted traffic to the broadcast address on that network (192.168.10.3). – rnxrx Oct 19 '18 at 19:08
  • @Cown The output of show-version is added to the question. – Amin Darvand Oct 19 '18 at 19:12
  • @rnxrx The reason that I have permitted traffic for 10.3 is that the end device will have this static IP and it's all the other users need to ping. Again, I have put this exact config in the simulator, and it works there. I don't know why it doesn't here. – Amin Darvand Oct 19 '18 at 19:15
  • 1
    You cannot configure a host to have the broadcast address of the subnet. If you're using 192.168.10.0/30 then your hosts can be 192.168.10.1 and 192.168.10.2. The .0 and .3 addresses correspond to the subnet and broadcast respectively. – rnxrx Oct 19 '18 at 19:17
3

The address you have on Fa0/1 (192.168.10.2/30) is part of the prefix 192.168.10.0/30. The other usable host address on that interface would be 192.168.10.1. You've permitted traffic to the broadcast address on that network (192.168.10.3). Make sure the host (your intercom) is on 192.168.10.1 and adjust ACL 101 accordingly.

As an aside, take a look at the PVLAN feature as it might make this design easier. You'd be able to put all of the ports into the same VLAN (and thus all in the same subnet), set the user ports to isolated and the intercom to promiscuous and you'd achieve the same goal.

  • I'll give it a try and let you know. Thanks. – Amin Darvand Oct 19 '18 at 19:23
  • Thanks dear friend. It works now after shifting the IP's. – Amin Darvand Oct 20 '18 at 16:05
  • 1
    Glad it worked. Like I said, though, take a look at PVLAN's as a potentially better/simpler way to solve this problem. – rnxrx Oct 21 '18 at 1:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.