I'm setting up a network with the following configuration:

  • 48 port gigabit L2 switch (Cisco Catalyst 2948G)
  • Linux or OpenBSD router on a stick (1 gigabit NIC)
  • Cable modem
  • My network is small, I only need one vlan (as far as I know),

I just need to know how to configure the switchport that the modem is attached to. (I'm plugging it into the 48 port L2 switch) Do I do a separate VLAN for the modem? Or do I just put everything on one vlan?

Thanks for the help!

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 8, 2017 at 15:58

4 Answers 4


Yes, you'd use two VLANs:

  • EXTERNAL : cablemodem
  • INTERNAL : LAN (10.0.0./24)

The TRUNK port to the Linux router will carry both VLANs (tagging one or both.) The linux router would then have a physical interface (eth0) and one or two vlan interfaces (eth0.X and eth0.Y -- depending on the numbers you choose for your vlans) I suggest two tagged VLANs to avoid any confusion between eth0 (untagged) and eth0.#. From there, networking is the same as having multiple physical interfaces.

(NOTE: if you use wireshark/tcdump, there are many buggy nic drivers that continue to eat vlan tags in promisc mode. As a result, capturing eth0 may not include any dot1q tags making the traffic look like it's all on the same network. Also, some management adapters will remove tags, even if the system management board isn't there. Broadcom is well known for this.)


To answer your question directly, the port your modem is plugged into would be an access port. So a simple configuration might be:

interface gigabit 0/1
switchport mode access
switchport access vlan 1

Note that these are the default values. I'm showing them for clarity.

The port for your BSD router should be a trunk port, because presumably you will be routing between networks, but your question doesn't make that clear. If you provide a little more info, we can provide more help.

  • The 2948G ran CatOS, not IOS. It was basically a non-modular version of the Cat4000. Commented Jan 28, 2014 at 22:05
  • Ok, the values are still the default. It's been a few years since I configured CatOS, so I don't want to quote syntax from memory ;-)
    – Ron Trunk
    Commented Jan 28, 2014 at 22:34
  • I sadly still work with it daily. Commented Jan 28, 2014 at 22:41

Since your Cable modem's internal and your Linux/OpenBSD Router's External interface will need to communicate (e.g. your router will need to obtain a DHCP address from the provider via the modem), both of these interfaces should be connected to a different VLAN.

In summary, since you only need to use one VLAN, all users AND the Router's internal interface can be on VLAN 1, while the router's External interface and the Cable Modem's Internal interface can be on VLAN 2.

  • Remember, a VLAN is really a simulation of a different LAN, almost as if you had a completely separate switch.
    – LIK
    Commented Jan 27, 2014 at 19:51

You will need two VLANs, an external one between your modem and router, and an internal one between your router and network. It's been years since I used a 2948G, but I believe it enumerates the GBIC ports as though they were in slot 1 of a Cat4000 chassis (e.g. 1/1, 1/2, ...), and the 48 copper ports as though they're in slot 2 (e.g. 2/1, 2/2, ...).

If we assume VLAN 1 for your internal network and VLAN 2 for the modem, your switch configuration would look like this (ignore lines starting with #):

# create VLAN 2 and give it a name
set vlan 2 name Cable_Modem

# set descriptive names for the ports to use
set port name 2/1 Cable Modem
set port name 2/2 Router on a stick

# assign the cable modem to VLAN 2, untagged
set vlan 2 2/1

# make the router port a trunk port;
# by default, VLAN 1 is untagged, and all other VLANs are tagged
set trunk 2/2 on dot1q

On your router, you will need to configure the lone interface to do 802.1q VLAN trunking. I don't know how this is done on OpenBSD, but on Linux, you could do it on the CLI like this (as root, or with sudo):

# load the 802.1q kernel module
modprobe 8021q

# enable trunking and add VLAN 2 to eth0
vconfig add eth0 2

You'll end up with two interfaces to configure:

  1. eth0 - the parent interface for untagged frames; this will handle VLAN 1 from your internal network
  2. eth0.2 - the subinterface for frames tagged for VLAN 2, which will talk to the cable modem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.