Cisco SG300 vlans

[ADMaster]

OK I have a new switch to extend our network to another site. I just told the supplier I needed a managed switch out there and I preferred cisco. That was probably a mistake but hopefully you folks can help me make it work.

 

I'm trying to get it configured here in the office before I take it to the other site and I'm not getting my head around its configs. It doesn't appear to be running ios but accepts most ios commands I've tried.

 

On my other switches I'd run this

int vl 10
set ip address
no shutdown


uplink interface 
switchport mode trunk
switchport trunk native vlan 10

access ports
switchport mode access
switchport access vlan 20

 

when I run

sh run int gi10 (uplink interface) it shows my native vlan command but not the trunk mode command.

However when I go into the web interface it says it is trunk.

All of my ports in the web interface say excluded.

There are four options, excluded, tagged, untagged, and forbidden.

Do I need to tag or untag these. The commands listed above is what I've always used.

 

The other end of the link is configured like all of my other uplinks

 

From within the management vlan 10 I can ping other switches. my core switch can ping the new one and the new one can ping the core.

 

it just isn't communicating with other vlans. I'm probably missing something simple.

The majority of my network is 2960S so that is what I'm used to configuring.

Thank you,

[ADMaster]

bump anyone?

[Davit2005]

switchport mode trunk

switchport trunk allowed vlans

 

I think should work. Personally as a security I wouldn't put management on native vlan though.

[RobD]

I work with SG300s every now and again.

 

First thing I like to do is enable layer 3 routing if its needed (it will wipe the config once enabled):

set system mode router

 

Then disabled auto macros, as they're mental:

macro auto disabled 

 

then relays:

ip dhcp relay address 192.168.3.3
ip dhcp relay enable

 

As for vlans, I do something like this:

 

interface vlan 10
name Management 
ip address 192.168.1.1 255.255.255.0
ip dhcp relay enable 
!
interface vlan 102
name Client-Data 
ip address 172.16.16.1 255.255.255.0
ip dhcp relay enable 
!
interface vlan 103
name Client-Voice 
ip address 172.17.17.1 255.255.255.0
ip dhcp relay enable 

 

then the config for the ports:

interface gigabitethernet6
description Normal_Computer
switchport trunk allowed vlan add 103 
switchport trunk native vlan 102  
!

interface gigabitethernet27
description Uplink
 switchport trunk allowed vlan add 10,102,103

[ADMaster]

Ok I have disabled the macros and set the allowed vlans but then I got vlan mismatch.

 

This is an edge switch should I keep it on L2 or L3?

Is the dhpc relay needed?

Why are all the client ports set to trunk?

Why is native vlan for management bad / security issue?

 

On my other switches I do not have any allow vlan statement all vlans are allowed

My device ports are set to access

the only ip on my edge switches is the management vlan IP

the ip-helper command is set on the vlan interface on the core switch / router.

 

I'll try all of your configs tomorrow in full but just wondering about some of them.

 

Thanks,

[Davit2005]

Ok I have disabled the macros and set the allowed vlans but then I got vlan mismatch.

 

This is an edge switch should I keep it on L2 or L3?

Is the dhpc relay needed?

Why are all the client ports set to trunk?

Why is native vlan for management bad / security issue?

 

On my other switches I do not have any allow vlan statement all vlans are allowed

My device ports are set to access

the only ip on my edge switches is the management vlan IP

the ip-helper command is set on the vlan interface on the core switch / router.

 

I'll try all of your configs tomorrow in full but just wondering about some of them.

 

Thanks,

 

Edge should not really need L3 in 99% of cases, there is an argument to push layer 3 out to nearer the edge i.e. distribution depending on size of network i.e Large Campus. You should only need DHCP relay at Layer 3 where routing is occuring.

 

I believe Cisco has ports as auto trunk by default.

 

You'd be better off having a dead end network as Native and then tagg (HP) or trunk (Cisco/3com) management traffic. Set all ports as access unless they are uplink ports (or WiFi AP's depending on your WiFi solution).

[RobD]

Think AMDavit2005 answered most of these but here#s my two pennies worth anyway:

This is an edge switch should I keep it on L2 or L3?

Depends if you want to route between vlans? If so you can keep it layer two and just set the gateway to a L3 device (or another L2 that routes to a L3) or enable L3 on the switch.

Is the dhpc relay needed?

Only if you enable L3, I use these switches on the end of a VPN tunnel and relay to a DHCP on another site.

Why are all the client ports set to trunk?

I couldn't get the phones working on a computer port i.e. I couldn't set the the port as active then add a phone vlan without it being a trunk. if you don't have this problem then leave them as access ports.

Why is native vlan for management bad / security issue?

(guessing here) if you plug into the switch and the ports are all set to native you could access the management of the switch??

On my other switches I do not have any allow vlan statement all vlans are allowed

Do you run: switchport trunk allowed vlan all

My device ports are set to access

You can set these to access if you like

the only ip on my edge switches is the management vlan IP

You don't need to set a IP on the vlans.

the ip-helper command is set on the vlan interface on the core switch / router.

Thats fine, leave it as layer two.

 

 

If all the ports on this switch need to be the same you could just set the port on the uplink switch to access on what ever vlan you need and just plug this in so it acts as a pure layer two switch.

Edited September 6, 2017 by RobD
Italics

[ADMaster]

I'm making progress.

I reverted it back to layer 2

I added the allowed vlans but got native vlan mismatch again

I retyped the command for the native vlan that removed the mgt vlan from allowed, this fixed the mismatch.

at some point perhaps the switching back to L2 my port configs were wrong.

I retyped those to get correct vlans.

 

Now I have a PC and a phone connected getting the correct IP / Vlan and work.

 

However I cannot access the MGT interface from my PC and server vlans. The next step is to get this on snmp monitoring and config backups.

 

EDIT: yep obvious rookie mistake.

Just combing though the config of a working switch and I didn't set the default gateway.

Thanks for all your help.

Edited September 6, 2017 by ADMaster

[Davit2005]

You need default gateway mostly on HP's if not doing layer 3 so bit of confusion expected.

 

I had a SG300 at home a few years back but couldn't really get on with it TBH, had an issue prior a firmware update which meant kept losing the routing and needing a reboot every couple of days.

 

Currently run some HPE 1920's at home but not too happy with these either, they run comware and the cli is restrictive without using the special command and password .

[IanT]

I've worked on the SG300 model switches, they are terrible switches - hate them.