BKGarry Posted September 17, 2015 Posted September 17, 2015 Hello all, I am being extremely slow here and need to use the edugeek wisdom. I have inherited a Cisco vlaned network from the pervious BSF service without any documentation. I am having issues with there not being enough IP addresses in the range for the BYOD VLAN. I have got a new range for 1000 IPs for our WAN provider and have setup the DHCP scope but this is where I get stuck. I need to change the VLAN config and ACL for it but I really cannot figure out how to do it from the Cisco website so I need some step by step instructions to allow the IP range to communicate on the ACL (as I managed to see it isn't valid at the moment) and then I need to modify the VLAN to have this new range instead of the old range. If someone you basically do me a dummy's guide to what to enter on the consoles from login that would be excellent. As I really don't want to break something as there are at least 15 different VLANs and I don't wanna bring down everything Thank you all in advance and sending eduhobnobs to all. BKGarry
rrrrr Posted September 17, 2015 Posted September 17, 2015 Can you post your running config highlighting vlan mentioned?
BKGarry Posted September 17, 2015 Author Posted September 17, 2015 I will try in the morning. Is that basically "show VLAN" and whatever I did for for the ACLs like before?
rrrrr Posted September 17, 2015 Posted September 17, 2015 Do show running-config. This will display the whole config including all vlans and acls. Make sure you hash out any passwords that may be stored in clear txt before sharing
FN-GM Posted September 17, 2015 Posted September 17, 2015 Hi, A show running-config would be good. Also show ip access-lists output might be handy. We will be able to see the hit counters on the rules, that will show if they are in use. We should be able to sort you out where you would simply copy and paste some text into your switch. Thanks
BKGarry Posted September 17, 2015 Author Posted September 17, 2015 Thank you all. I will run this first thing and post it. I will get putty to log it all in a text file and then paste it in. Thank you again for your help. I must admit between this and powershell I have some training to do to catch up. 6 1/2 years writing timetables instead of being involved has made it difficult. It is nice to have everything together. Speak to you in the morning.
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 (edited) cisco.txtHiya all, I have had to upload it as a txt file as it was too long to post. The new range is 10.73.52.1 to 55.255 Edited September 18, 2015 by BKGarry
rrrrr Posted September 18, 2015 Posted September 18, 2015 Do you know what the old range is? So I can identify what needs to be modified
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 10.73.209.1 to 10.73.209.255 It should be labelled as BSF guest or something like that
FN-GM Posted September 18, 2015 Posted September 18, 2015 (edited) Hi, If you do the following it should work for the ACL. The change for the vlan is on next post. Please make a backup before doing this! enter the command Conf T paste the following in: NO access-list 100 permit udp any any eq bootpc NO access-list 100 permit udp any any eq bootps NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 172.31.81.46 eq domain NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 172.31.49.46 eq domain NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 10.5.17.21 eq domain NO access-list 100 permit udp 10.73.209.0 0.0.0.255 host 10.5.9.21 eq domain NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq www NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq www NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq 443 NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq 443 NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.20.0 0.0.0.255 eq 8080 NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.5.12.0 0.0.0.255 eq 8080 NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.213.0 0.0.0.127 log NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.212.128 0.0.0.7 eq www NO access-list 100 permit tcp 10.73.209.0 0.0.0.255 10.73.212.128 0.0.0.7 eq 443 NO access-list 100 deny ip 10.73.209.0 0.0.0.255 10.0.0.0 0.255.255.255 NO access-list 100 deny ip 10.73.209.0 0.0.0.255 192.168.0.0 0.0.255.255 NO access-list 100 deny ip 10.73.209.0 0.0.0.255 172.16.0.0 0.0.15.25 access-list 100 permit udp any any eq bootpc access-list 100 permit udp any any eq bootps access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.81.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.49.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.17.21 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.9.21 eq domain access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.213.0 0.0.0.127 log access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq 443 access-list 100 deny ip 10.73.52.0 0.0.3.255 10.0.0.0 0.255.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 192.168.0.0 0.0.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 172.16.0.0 0.0.15.255 All we are doing here is changing the wildcard mask from 0.0.0.225 to 0.0.3.255. Edited September 18, 2015 by FN-GM
FN-GM Posted September 18, 2015 Posted September 18, 2015 (edited) To change VLAN IP enter the following commands Conf T Int VLAN 40 no ip address 10.73.209.1 255.255.255.0 ip address 10.73.52.1 255.255.252.0 You will need to update the DHCP with the new ip range and subnet. Edited September 18, 2015 by FN-GM
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 luckily that part of my DHCP server already had a 252.0 on the new scope :-) (assuming that is going for my new scope of 52.1 to 55.255) I did get this at the end of the VLAN range commands 10.73.208.0 overlaps with Vlan600
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 Errrrr, No longer getting DHCP though on VLAN40 :-/
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 My network hates me, I think it is the meru controller being a pain now
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 (edited) :-( I have reversed all changes and got it back to working, Looks like there are some settings for this on the Meru controller. Highly annoying Wonder if it is worth making a new VLAN and then pumping it through there later on Edited September 18, 2015 by BKGarry
FN-GM Posted September 18, 2015 Posted September 18, 2015 (edited) On your ACL, when you made the changed did you still have these lines in? access-list 100 permit udp any any eq bootpc access-list 100 permit udp any any eq bootps To track if it is meru, put the setting above back on and plug in a laptop to a port assigned to VLAN 40 and see if it gets an IP. Edited September 18, 2015 by FN-GM typo
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 OK, I will leave it until school has finished and try again then.
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 Dear all, I just tried a port assigned to that VLAN and put the settings in and I can confirm this did exactly the same thing. No DHCP contact at all :-(
FN-GM Posted September 18, 2015 Posted September 18, 2015 Just to confirm, do you have this in the ACL? access-list 100 permit udp any any eq bootpc access-list 100 permit udp any any eq bootps
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 I have had a look and cannot find it, sorry, I thought it was there.
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 actually I type in show IP access 100 and it shows nothing at all
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 OK that is not in and I am getting IP addresses :-) - - - Updated - - - just no internet now - - - Updated - - - in fact I cant ping the gateway
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 (edited) So here is my latest running config, cisco.txt I am probably missing something here, as I cant ping the default gateway, but I can get an IP address I also cannot ping over VLANs (probably expected) So now it must be a question of routing the traffic somewhere Edited September 18, 2015 by BKGarry
BKGarry Posted September 18, 2015 Author Posted September 18, 2015 Silly question, do I need to add something to my outbound ACL?
FN-GM Posted September 18, 2015 Posted September 18, 2015 Ping won't work as there is no rule to allow ICMP. The ordering of your ACL might be stuffing this up. It matters the order of the rules. Remove all of the existing rules in list 100 only and replace it with this. access-list 100 permit udp any any eq bootpc access-list 100 permit udp any any eq bootps access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.81.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 172.31.49.46 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.17.21 eq domain access-list 100 permit udp 10.73.52.0 0.0.3.255 host 10.5.9.21 eq domain access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 443 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.20.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.5.12.0 0.0.3.255 eq 8080 access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.213.0 0.0.0.127 log access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq www access-list 100 permit tcp 10.73.52.0 0.0.3.255 10.73.212.128 0.0.0.7 eq 443 access-list 100 deny ip 10.73.52.0 0.0.3.255 10.0.0.0 0.255.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 192.168.0.0 0.0.255.255 access-list 100 deny ip 10.73.52.0 0.0.3.255 172.16.0.0 0.0.15.255
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now