4

In my network using Cisco router/SW C1111-8p, the native VLAN 1 is not connected and doesn't have IP.

  • VLAN10 192.168.10.1/24 with vlan10 DHCP pool
  • VLAN20 192.168.20.1/24 with vlan20 DHCP pool
  • Both are connected to a NAT to access Internet
# Setup ISP internet connection
configure terminal
interface GigabitEthernet 0/0/0
description WAN
ip address 219.a.b.d 255.255.255.252
ip nat outside
no shutdown
exit
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 219.a.b.c
ip dns server
ip name-server 221.110.33.164 221.110.33.132


# Set DHCP pools
configure terminal
service dhcp
ip dhcp pool vlan10Pool
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 221.110.33.164 221.110.33.132
ip dhcp pool vlan20Pool
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 221.110.33.164 221.110.33.132
exit
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.20.1
ip access-list standard NAT
permit 192.168.10.0 0.0.0.255
permit 192.168.20.0 0.0.0.255
exit


#Setup the trunk port between the switch and the WAP
configure terminal
interface GigabitEthernet 0/1/0
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan add 1,10,20
switchport nonegotiate
no shutdown

# Setup the switch ports
configure terminal
interface GigabitEthernet 0/1/2
switchport mode access
switchport access vlan 10
no shutdown
exit
interface GigabitEthernet 0/1/3
switchport mode access
switchport access vlan 20
no shutdown
exit


# Configure VLANs
ip routing
configure terminal
vlan 10
no shutdown
interface vlan 10
ip address 192.168.10.1 255.255.255.0
ip nat inside
no shutdown
exit
vlan 20
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
ip nat inside
no shutdown
exit

When I ping the vlan20 gateway 192.168.20.1 from a host in VLAN10, it doesn't reach.

Router#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

Router#

I would like that a vlan20 server be accessible from vlan10. For testing, let's say the vlan20's gateway. This server will be used for Radius server for eap-tls and also a Squid proxy.

                                                                     +--------------+
                                                 trunk port          |              |
                                       +-----------------------------+  WIFI AP     |
                                       |      VLAN 10 for SSID10     |  SSID10      |
                                       |      VLAN 20 for SSID20     |  SSID20      |
                                       |                             |              |
                                       |0/1/0                        |              |
                             +---------------+                       +--------------+
        +----------+         |               |
        |          |         |               | 0/1/2
        |ISP modem +-------->+0/0/0          +-----------+  VLAN10 192.168.10.0/24
        |          |         |               |
        +----------+         |               |
                             |               | 0/1/3
                             |               +-----------+  VLAN20 192.168.20.0/24
                             +---------------+

show running-config:

Current configuration : 2350 bytes
!
! Last configuration change at 05:11:37 UTC Fri Apr 26 2019
!
version 16.8
service timestamps debug datetime msec
service timestamps log datetime msec
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
ip name-server 221.110.33.164 221.110.33.132
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.20.1
!
ip dhcp pool webuidhcp
!
ip dhcp pool vlan10Pool
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 221.110.33.164 221.110.33.132
!
ip dhcp pool vlan20Pool
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 221.110.33.164 221.110.33.132
!
subscriber templating
!
!
multilink bundle-name authenticated
!

!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
!
!
redundancy
 mode none
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
interface GigabitEthernet0/0/0
 description WAN
 ip address 219.a.b.c 255.255.255.252
 ip nat outside
 negotiation auto
!
interface GigabitEthernet0/0/1
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0/1/0
 switchport mode trunk
 switchport nonegotiate
!
interface GigabitEthernet0/1/1
 shutdown
!
interface GigabitEthernet0/1/2
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/1/3
 switchport access vlan 20
 switchport mode access
!
interface GigabitEthernet0/1/4
 shutdown
!
interface GigabitEthernet0/1/5
 shutdown
!
interface GigabitEthernet0/1/6
 shutdown
!
interface GigabitEthernet0/1/7
 shutdown
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
!
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
!
ip nat inside source list NAT interface GigabitEthernet0/0/0 overload
ip forward-protocol nd
no ip http server
ip http secure-server
ip dns server
ip route 0.0.0.0 0.0.0.0 219.b.c.d
!
!
ip access-list standard NAT
 permit 192.168.10.0 0.0.0.255
 permit 192.168.20.0 0.0.0.255
!
!
!
!
!
control-plane
!
!
line con 0
 transport input none
 stopbits 1
line vty 0 4
 login
!
wsma agent exec
!
wsma agent config
!
wsma agent filesys
!
wsma agent notify
!
!
end

What do I miss?

Edit: As Ron Maupin commented, at least one device must be connected to the Vlan10 to be able to see the routing table. The routing table for Vlan20 isn't existing because nothing is connected to it.

Router#show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.10.0/24 is directly connected, Vlan10
L        192.168.10.1/32 is directly connected, Vlan10
Improve this question
4
  • Please edit your question to include the full router configuration. Show IP route doesn’t list your interfaces which suggests something seriously wrong.
    – Ron Trunk
    Commented Apr 25, 2019 at 10:51
  • Also, please include a simple diagram of your network, so we can see how devices are connected.
    – Ron Trunk
    Commented Apr 25, 2019 at 12:29
  • I updated my question, I hope it's easier to understand now.
    – None
    Commented Apr 26, 2019 at 5:17
  • Please post your full config (passwords and such removed), vital Parts are missing like the interface configurations and routing information.
    – Crami
    Commented Apr 26, 2019 at 6:53

4 Answers 4

Reset to default
6

I don't think you actually created the VLANs. You created the SVIs for the VLANs, but you need to use the global vlan command to create the VLANs (except VLAN 1, which always exists). You can optionally name the VLANs, which is a good thing to do. (I would also strongly suggest that you use the description command on the interfaces and SVIs.)

Something like:

vlan 1
 name Management
 exit
!
vlan 10
 name Users
 exit
!
vlan 20
 name Guests
 exit
!

That will add VLANs 10 and 20 to the VLAN database. Not doing that leads to routing and DHCP problems.

Also, make sure that routing is enabled with the global ip routing command. You should see that close to the top of your configuration.

Improve this answer
5
  • I did it but I forgot ip routing, I added it but still ip show route doesn't show anything.
    – None
    Commented Apr 26, 2019 at 5:17
  • 1
    Well, did you connect anything to any of the switch interfaces so that the interfaces come up? The SVIs will be down until you do, and that means that they will not show up in the routing table. Also, you are going to need to put an address on VLAN 1 so that it can serve as the gateway for the server and WAP VLAN 1 addresses.
    – Ron Maupin ♦
    Commented Apr 26, 2019 at 10:50
  • It was working. There are two conditions: ip routing and at least one device connected to a vlan switch port to be able to ping its gateway. By connecting a device in each Vlan port, I could ping the gateway of each other.
    – None
    Commented May 7, 2019 at 0:58
  • Regarding the VLAN1, do you mean I set up a single IP or I can add a DHCP pool same as the other VLANs?
    – None
    Commented May 7, 2019 at 0:59
  • 1
    You set up a DHCP pool if there will be devices connecting to VLAN 1 that need DHCP. Statically configured devices, like your WAP, do not need DHCP, so they do not need a DHCP pool. Also, I noticed you have excluded the router addresses in the DHCP pools, but that is unnecessary as the router automatically excludes its own address.
    – Ron Maupin ♦
    Commented May 7, 2019 at 1:04
1

You need to configure intervlan route. Othewise you are unable to route between VLANs. You can do it in three ways.

  • Intervlan routing with Sub interfaces in separate router.
  • InterVlan routing with separate routers.
  • Intervlan routing with SVI

Third point is recommended way.

Fore more details click here cisco

Improve this answer
1

please enable "ip routing" as well.

Improve this answer
1 
ip dhcp pool vlan10Pool
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 221.110.33.164 221.110.33.132
ip dhcp pool vlan20Pool
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 221.110.33.164 221.110.33.132
exit
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.20.1
ip access-list standard NAT
permit 192.168.10.0 0.0.0.255
permit 192.168.20.0 0.0.0.255
exit

From above Configuration you share ... No need to config DHCP excluded address with default gateways in this case your can remove this Configuration in DHCP Configuration..

Router(config)# no ip dhcp excluded-address 192.168.10.1

Router(config)# no ip dhcp excluded-address 192.168.20.1

And Configure

Router(config)# ip default -gateway 192.168.10.1

Router(config)#ip default -gateway 192.168.20.1

And if layer3 switch is used create SVIs and enable ip routing .. if router is used create sub interfàce to inter-Vlan routing between Vlan 10 & Vlan 20

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.