1

We have a Cisco 3750X (L3) as a core switch and 10 Cisco SG-300 (L2), each Switch is in a separate VLAN (include core switch) now I want to define VLAN forwarding rule on my core switch, so all clients can see servers, how can I do it?

**3750X license:**
{Index 1 Feature: ipservices
        Period left: 8  weeks 4  days
        License Type: Evaluation
        License State: Active, Not in Use, EULA not accepted
        License Priority: None
        License Count: Non-Counted

Index 2 Feature: ipbase
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted

Index 3 Feature: lanbase
        Period left: 0  minute  0  second}

**running config:**
{version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ****
!
boot-start-marker
boot-end-marker
!
enable secret 5 ****************
enable password ****************
!
username ******* password ********
no aaa new-model
switch 1 provision ws-c3750x-24
system mtu routing 1500
!
!
ip domain-name *******
!
!
crypto pki trustpoint TP-self-signed-********2
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-******2
 revocation-check none
 rsakeypair TP-self-signed-*******2
!
!
crypto pki certificate chain TP-self-signed-********2
 certificate self-signed 01
  ***************************************************
*****************************************************
*****************************************************
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
!
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0
 no ip address
 shutdown
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
 ip address 192.168.0.31 255.255.255.0
!
interface Vlan10
 ip address 10.0.1.1 255.255.255.224
!
interface Vlan20
 ip address 10.0.2.1 255.255.255.224
!
interface Vlan30
 ip address 10.0.3.1 255.255.255.224
!
interface Vlan40
 ip address 10.0.4.1 255.255.255.224
!
interface Vlan50
 ip address 10.0.5.1 255.255.255.224
!
interface Vlan60
 ip address 10.0.6.1 255.255.255.224
!
interface Vlan70
 ip address 10.0.7.1 255.255.255.240
!
interface Vlan80
 ip address 10.0.8.1 255.255.255.248
!
interface Vlan90
 ip address 10.0.9.1 255.255.255.224
!
interface Vlan100
 ip address 10.0.10.1 255.255.255.224
!
interface Vlan110
 ip address 10.0.11.1 255.255.255.224
!
interface Vlan200
 ip address 10.0.20.1 255.255.255.224
!
ip default-gateway 10.0.20.20
ip http server
ip http secure-server
!
!
!
snmp-server community public RO
!
!
line con *
line vty * *
 password ********
 login local
 transport input ssh
line vty * *
 password ********
 login local
 transport input ssh
!
end}
Improve this question
9
  • You should add your current configuration to your question, use {} around the text to format it as code.
    – user36472
    Commented Dec 5, 2018 at 7:10
  • all of the devices are in factory setting, I just define 10 different VLANs (each edge switch) on core switch, just want to get some example that how should I wrote these rules
    – Mahyar
    Commented Dec 5, 2018 at 7:32
  • Does your 3750X has the proper IP services license to route?
    – user36472
    Commented Dec 5, 2018 at 7:34
  • I dont know, how should I check that?
    – Mahyar
    Commented Dec 5, 2018 at 8:15
  • Licensing: IPBASE would most certainly be enough, it supports OSPF up to <somenumber> (last time i checked it was 200) of prefixes and also EIGRP stub routing. For plain inter vlan routing and <somenumber> (last time it was like 16) of static routes, even LANBASE can be used, and is supported even on the lowly 2960X.
    – Marc 'netztier' Luethi
    Commented Dec 5, 2018 at 10:36

2 Answers 2

Reset to default
3

You must enable routing with the ip routing global command.

It is only a layer-3 switch if routing is enabled. You are actually using it as a layer-2 switch.

Improve this answer
4
  • What do you mean I'm using as L2 switch?
    – Mahyar
    Commented Dec 5, 2018 at 12:26
  • 1
    A layer-3 switch is a layer-2 switch, but it has a routing module enabled in it, and you would assign layer-3 (IP) addressing to some interfaces (physical or virtual). You have not enabled routing, so it only switches at layer-2, not between layer-2 LANs, which is layer-3 routing.
    – Ron Maupin ♦
    Commented Dec 5, 2018 at 12:34
  • @Mahyar: all of these "small" Catalyst switches are L2 switches, at first: some VLANs, some ports being assigned to VLANs, maybe some VLAN trunks. Then you add "internal router ports" (a.k.a. SVI, "Switch Virtual Interface"), which connect each VLAN to the internal "routing engine", by virtue of interface vlan XX and ip address .... Now the switch has an IP address in each VLAN that has such an SVI. Eventually, to enable forwarding from one VLAN through its SVI, through to another SVI into that other VLAN, you need the command ip routing - and it becomes a L3 switch.
    – Marc 'netztier' Luethi
    Commented Dec 5, 2018 at 12:36
  • @Mahyar: not all VLANs need to be SVI enabled; you can mix "layer-2 only VLANs" (ones that do not have an SVI with IP address) with "layer-3 enabled VLANs" (the ones that do have an SVI with IP address). Depending on the given network scenario, there might be good reasons to have some "isolated" layer-2 only VLANs
    – Marc 'netztier' Luethi
    Commented Dec 5, 2018 at 12:41
0

As per provided configuration it's clear that switch virtual interfàce (SVI) are configured in Cisco 3750 switch and further connect all Layer2 switches coreswitch allowing trunk ports between coreswitch and access switch allowing all Vlans

Now different Vlan communication traffic reaches to coreswitch . By enabling inter-Vlan routing ,routing is enabled between different Vlans . According to our requirements Vlans traffic can be restricted or allowed among VLANs by access-list configuration .

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.