1

Got a catalyst 2690 on a small office net consisiting of 2 vlans, 10 and 20, 10 for the lan and corporate wifi and 20 fot guests wifi.

All lan ports are config on access mode vlan 10

The access point ports are trunk mode allowing pass 10 and 20 vlans and with vlan 10 native

The port connected to the firewall which connects to the internet is trunk mode allowing vlans 20 and 10

I made some tests and after connecting to a port with vlan 30 access mode im able to reach the internet or my firewall...

Is there anything im missing on my config? Why am i able to reach the internet connected on port 21 which put vlan 30 on my traffic

Got 2 vlan interfaces listening on the fortinet with the dhcp servers.

Vlan 20 seems to be working as it assigns ips on that range.

Here is my config file

https://pastebin.com/CabUydrJ

SW-2960-MAD#show running-config
Building configuration...

Current configuration : 6994 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname SW-2960-MAD
!
boot-start-marker
boot-end-marker
!
enable secret 5 
enable password 
!
username cisco privilege 15 password 0 
!
!
aaa new-model
!
!
!
!
!
aaa session-id common
switch 1 provision ws-c2960s-48lps-l
!
!
!
!
crypto pki trustpoint TP-self-signed-2487309184
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2487309184
 revocation-check none
 rsakeypair TP-self-signed-2487309184
!
!
crypto pki certificate chain TP-self-signed-2487309184
 certificate self-signed 01
  30820244 308201AD A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 32343837 33303931 3834301E 170D3933 30333031 30303033
  31355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 34383733
  30393138 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100BBAC 288F7E25 55FA2B7C 0221F097 3AED3F15 4BA07846 973243B1 79DDCBF7
  9D4181A4 8843D98A 89EB360A FF60CBF2 EBAF7AD5 B7CC6E50 46EBC53D 41641545
  465576AF B7078659 99ED7E2D 4E15CC9F 761D6007 E02B93D3 48E7B658 1F336E07
  B1EC8038 0A1E8B48 5E842A7B 094A44BE 276E4B20 D0BCD303 A4D64ED7 5AD1CE63
  41790203 010001A3 6C306A30 0F060355 1D130101 FF040530 030101FF 30170603
  551D1104 10300E82 0C53572D 32393630 2D4D4144 2E301F06 03551D23 04183016
  80142D70 963CC149 B3A9F166 B27B63AB B1EEE235 1410301D 0603551D 0E041604
  142D7096 3CC149B3 A9F166B2 7B63ABB1 EEE23514 10300D06 092A8648 86F70D01
  01040500 03818100 4A53119A DDFC16EB D7524E1D 30958B0D 522639B4 DF155F88
  6A7E474F A5E993B0 14923A65 BB22231B AF0385A6 155537F2 0B3B94D1 DB808DDE
  41DCA707 EF9CE982 0222D583 DBB6E59A 253E46DF 84594A4C 8F8FB0CA 422FB794
  43A1AAD6 C2438736 B2526312 BF18F3FA 95A269B9 EFEAD09F 53D51E8F 786D80F3
  E4FE2BEE FC47FE33
  quit
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0
 no ip address
!
interface GigabitEthernet1/0/1
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/2
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/3
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/4
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/5
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/6
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/7
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/8
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/9
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/10
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/11
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/12
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/13
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/14
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/15
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/16
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/17
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/18
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/19
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/20
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/21
 switchport access vlan 30
 switchport mode access
!
interface GigabitEthernet1/0/22
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/23
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/24
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/25
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/26
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/27
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/28
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/29
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/30
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/31
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/32
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/33
 switchport trunk native vlan 10
 switchport mode trunk
!
interface GigabitEthernet1/0/34
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/35
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/36
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/37
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/38
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/39
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/40
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/41
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/42
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/43
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/44
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/45
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,20
 switchport mode trunk
 shutdown
!
interface GigabitEthernet1/0/46
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet1/0/47
 description Aruba entrada
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,20
 switchport mode trunk
!
interface GigabitEthernet1/0/48
 switchport trunk allowed vlan 10,20
 switchport mode trunk
!
interface GigabitEthernet1/0/49
!
interface GigabitEthernet1/0/50
!
interface GigabitEthernet1/0/51
!
interface GigabitEthernet1/0/52
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 192.168.10.5 255.255.255.0
!
ip http server
ip http secure-server
ip sla enable reaction-alerts
!
line con 0
 exec-timeout 0 0
line vty 0 4
 password 
line vty 5 15
 password 
!
!
monitor session 1 source interface Gi1/0/47
monitor session 1 destination interface Gi1/0/21 ingress untagged vlan 10
end

Thanks

Improve this question
2
  • Please edit your question to include the configuration.
    – Ron Maupin ♦
    Feb 25, 2022 at 14:54
  • Where (on which device) is the Gateway for the VLAN 30?
    – JFL
    Feb 25, 2022 at 15:29

1 Answer 1

Reset to default
3

switchport mode trunk by default permits all VLANs existing on the switch.

In combination with

interface GigabitEthernet1/0/21
 switchport access vlan 30
 switchport mode access

that port is connected with VLAN 30 through interface GigabitEthernet1/0/33. If you don't want that you have to limit VLAN connectivity on each trunk port like on GigabitEthernet1/0/45: switchport trunk allowed vlan 10,20.

Improve this answer
2
  • Thanks for you response :) I had a small desk switch connected to that port 33, as i understand, the switch sent the traffic looking for vlan 30 throught that interface and tags it as vlan10?, then the other small desk switch send the traffic back to the big switch tagged as vlan10 so its able to reach the firewall on port 45?
    – Alex
    Mar 3, 2022 at 16:25
  • @Alex Don't forget to accept the answer if it fits your question. ;-)
    – Zac67 ♦
    Mar 3, 2022 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.