techie211 Posted July 18, 2012 Posted July 18, 2012 hey ppl, our existing wired network is running on a 10.0.x.x/16 network. I created two vlans. vlan10 for teachers and vlan20 for students. The teacher vlan is on a 172.16.8.x/22 and the student is on a 172.16.20.x/22. I created both scopes on my DHCP with router scope options setting pointing to 172.16.8.1 for teachers and 172.16.20.1 for students. In the user's account profile setting they have home folders setup. When they logon wired they get their mapping. When they logon wirless their mapping does not show up??? I can ping any source when I'm logged on wireless. I tried on several laptops. Not sure if it's a server, switch or controller issue. If you've experienced this before I'd love to hear from you. Thx -J
glennda Posted July 18, 2012 Posted July 18, 2012 Sounds like you are blocking traffic between the two vlans accept ICMP. What switches do you have?
techie211 Posted July 19, 2012 Author Posted July 19, 2012 they are Cisco 2960's going back to the core 3560
glennda Posted July 19, 2012 Posted July 19, 2012 ok - so although you can ping through across the vlans - can you access the shares etc? it sounds like you are blocking the traffic between the two - are you able to post up the acl lists? i'm no expert with Cisco being an HP man but i know there are a few Cisco people around here!
sultan966 Posted July 19, 2012 Posted July 19, 2012 If you post a network diagram including the switches, location of server and access point and the configuration of the switches then I can try to help. The ip address of the server, ip address of dhcp server, ip address of access point, etc. then I will have a look.
techie211 Posted July 19, 2012 Author Posted July 19, 2012 yes, I can access the shares. Posting the configs of the 3560 and the 2960: 3560: Current configuration : 5754 bytes ! version 12.2 no service pad service timestamps debug datetime service timestamps log datetime service password-encryption service unsupported-transceiver ! hostname BS_MDF_3560_SW01 ! boot-start-marker boot-end-marker ! ????????????????????????????? ????????????????????????????? ! ! ! no aaa new-model system mtu routing 1500 ip routing ! ! no ip domain-lookup ! ! crypto pki trustpoint TP-self-signed-2605393664 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2605393664 revocation-check none rsakeypair TP-self-signed-2605393664 ! ! crypto pki certificate chain TP-self-signed-2605393664 certificate self-signed 01 30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 32363035 33393336 3634301E 170D3933 30333031 30303031 32365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 36303533 39333636 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100E97B 70972D0D 4CB7C6D0 B38783FB 3754B2B0 F5CFCEE7 2D1CC371 CAEC65BF 497E42C4 8A391239 83B6A026 48CF4843 CD1E2060 A1F656A5 5A8591DB A9F48ACC 4B74FCC1 B45CD341 22AB1C93 82DC8F0B 62945C83 ECCF496D 7B4C5F96 DA2E1E2B 4DA07201 DE151A0D 2960667F 861D362F 691C0BC1 D90559A2 41A86135 2DAA0128 2DEF0203 010001A3 71306F30 0F060355 1D130101 FF040530 030101FF 301C0603 551D1104 15301382 1142535F 4D44465F 33353630 5F535730 312E301F 0603551D 23041830 168014B7 741D3AFF 946B9E3B B2DA6424 6F551F1A 6D524230 1D060355 1D0E0416 0414B774 1D3AFF94 6B9E3BB2 DA64246F 551F1A6D 5242300D 06092A86 4886F70D 01010405 00038181 00733357 AC1D7DE7 8F27BA30 428A8B48 2D0DA3BA 8109B4A2 161EAF19 E34E1E4F 16495F37 4EA2167A E61551D6 10D150C2 98A65362 7E0D6B4F FFA2FE32 B4644D01 8B067B59 8639C07D B6E3835E 31AA3050 F67566BF 154B6705 0D5DF227 4F4BA449 A6D6C5FB BE7010A2 D37C4B7F 7E6190E9 0ED7A94E 4DC4F180 8895FEB7 4505D60A 34 quit spanning-tree mode pvst spanning-tree extend system-id ! ! ! no errdisable detect cause gbic-invalid errdisable recovery cause gbic-invalid ! vlan internal allocation policy ascending ! ! ! interface FastEthernet0 no ip address no ip route-cache cef no ip route-cache no ip mroute-cache ! interface GigabitEthernet0/1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/2 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/3 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/4 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/5 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/6 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/7 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/8 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/9 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/10 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/11 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/12 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/13 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/14 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/15 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/16 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/17 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/18 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/19 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/20 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/21 switchport mode access spanning-tree portfast ! interface GigabitEthernet0/22 switchport mode access ! interface GigabitEthernet0/23 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet0/24 switchport mode access spanning-tree portfast ! interface GigabitEthernet1/1 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet1/2 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet1/3 switchport trunk encapsulation dot1q switchport mode trunk ! interface GigabitEthernet1/4 switchport access vlan 222 switchport trunk encapsulation dot1q switchport mode access switchport nonegotiate speed nonegotiate ! interface TenGigabitEthernet1/1 ! interface TenGigabitEthernet1/2 ! interface Vlan1 ip address 10.0.1.254 255.255.0.0 ! interface Vlan10 description Teacher Wireless Network ip address 172.16.8.1 255.255.252.0 ip helper-address 10.0.1.5 ! interface Vlan20 description Student Wireless Network ip address 172.16.20.1 255.255.252.0 ip helper-address 10.0.1.5 ! interface Vlan30 description Guest Wireless Network no ip address ! interface Vlan50 ip address 192.168.0.1 255.255.255.0 ! interface Vlan222 ip address 172.29.1.1 255.255.255.252 ! ! router eigrp 10 network 10.0.0.0 network 172.16.0.0 network 172.29.0.0 network 192.168.0.0 eigrp stub connected summary ! ip classless ip route 0.0.0.0 0.0.0.0 10.0.1.1 ip http server ip http secure-server ! ????????????????????????????? ????????????????????????????? ????????????????????????????? ! end 2960 PoE: Current configuration : 5659 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname BS_MDF_2960_POE01 ! boot-start-marker boot-end-marker ! ??????????????????????????????? ??????????????????????????????? ! ! ! no aaa new-model switch 1 provision ws-c2960s-48fps-l ! ! ! ! crypto pki trustpoint TP-self-signed-403102336 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-403102336 revocation-check none rsakeypair TP-self-signed-403102336 ! ! crypto pki certificate chain TP-self-signed-403102336 certificate self-signed 01 30820248 308201B1 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274 69666963 6174652D 34303331 30323333 36301E17 0D393330 33303130 30303330 385A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F 532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3430 33313032 33333630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100 BED6EAD3 11902A2B 4345F74F 1F7775D1 A9CB76D0 8B4F4B74 6F0FD9ED F02E1708 E32B37E8 1B5080E0 F755443B 395FC1A0 EBCE1989 74B5B817 55A1CF50 6021D52B 145B26D7 BA8DE368 7B25AF5B E46AE5D2 48A12B43 4D36CBFD FBCB1B75 667259A1 A4B89A24 60DC437E 918EC0ED 720A92F8 E597DDF0 C8BED750 0777F593 9ED62F9B 02030100 01A37230 70300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 11041630 14821242 535F4D44 465F3239 36305F50 4F453031 2E301F06 03551D23 04183016 8014B6D2 AB804F18 E13D6832 D5FE1235 DAF09B97 891D301D 0603551D 0E041604 14B6D2AB 804F18E1 3D6832D5 FE1235DA F09B9789 1D300D06 092A8648 86F70D01 01040500 03818100 307B2390 826C75A3 783A8205 8896B6A4 BE4D9AA6 1B320FEF A9C47ED4 283974C2 65E8E783 7C89D1B6 D6BDCA29 1DC74569 BACB71E3 241FB2A8 D550EF00 04828FB1 8A6B4FF8 8B383D71 BC043162 57B01DB0 BA7CA7C4 5159A4D3 5E025E7D 7D7CA9E0 D830D0FC 0BC2EEF5 FB9416B1 FA93466B 37EDEA28 E111C8EC 80655001 5053D86E quit spanning-tree mode pvst spanning-tree extend system-id ! ! ! ! vlan internal allocation policy ascending ! ! ! interface FastEthernet0 no ip address shutdown ! interface GigabitEthernet1/0/1 switchport access vlan 20 switchport mode access ! interface GigabitEthernet1/0/2 switchport access vlan 10 switchport mode access ! interface GigabitEthernet1/0/3 switchport mode access ! interface GigabitEthernet1/0/4 switchport mode access ! interface GigabitEthernet1/0/5 switchport mode access ! interface GigabitEthernet1/0/6 switchport mode access ! interface GigabitEthernet1/0/7 switchport mode access ! interface GigabitEthernet1/0/8 switchport mode access ! interface GigabitEthernet1/0/9 switchport mode access ! interface GigabitEthernet1/0/10 switchport mode access ! interface GigabitEthernet1/0/11 switchport mode access ! interface GigabitEthernet1/0/12 switchport mode access ! interface GigabitEthernet1/0/13 switchport mode access ! interface GigabitEthernet1/0/14 switchport mode access ! interface GigabitEthernet1/0/15 switchport access vlan 20 switchport mode access ! interface GigabitEthernet1/0/16 switchport mode access ! interface GigabitEthernet1/0/17 switchport mode access ! interface GigabitEthernet1/0/18 switchport mode access ! interface GigabitEthernet1/0/19 switchport mode access ! interface GigabitEthernet1/0/20 switchport mode access ! interface GigabitEthernet1/0/21 switchport mode access ! interface GigabitEthernet1/0/22 switchport mode access ! interface GigabitEthernet1/0/23 switchport mode access ! interface GigabitEthernet1/0/24 switchport mode access ! interface GigabitEthernet1/0/25 switchport mode access ! interface GigabitEthernet1/0/26 switchport mode access ! interface GigabitEthernet1/0/27 switchport mode access ! interface GigabitEthernet1/0/28 switchport mode access ! interface GigabitEthernet1/0/29 switchport mode access ! interface GigabitEthernet1/0/30 switchport mode access ! interface GigabitEthernet1/0/31 switchport mode access ! interface GigabitEthernet1/0/32 switchport mode access ! interface GigabitEthernet1/0/33 switchport mode access ! interface GigabitEthernet1/0/34 switchport mode access ! interface GigabitEthernet1/0/35 switchport mode access ! interface GigabitEthernet1/0/36 switchport mode access ! interface GigabitEthernet1/0/37 switchport mode access ! interface GigabitEthernet1/0/38 switchport mode access ! interface GigabitEthernet1/0/39 switchport mode access ! interface GigabitEthernet1/0/40 switchport mode access ! interface GigabitEthernet1/0/41 switchport mode access ! interface GigabitEthernet1/0/42 switchport mode access ! interface GigabitEthernet1/0/43 switchport mode access ! interface GigabitEthernet1/0/44 switchport mode access ! interface GigabitEthernet1/0/45 switchport mode access ! interface GigabitEthernet1/0/46 switchport mode access ! interface GigabitEthernet1/0/47 switchport mode access ! interface GigabitEthernet1/0/48 switchport mode access ! interface GigabitEthernet1/0/49 switchport mode trunk ! interface GigabitEthernet1/0/50 switchport mode trunk ! interface GigabitEthernet1/0/51 switchport mode trunk ! interface GigabitEthernet1/0/52 switchport mode trunk ! interface Vlan1 ip address dhcp ! interface Vlan10 ip address 172.16.10.2 255.255.252.0 ! interface Vlan20 ip address 172.16.20.2 255.255.252.0 ! interface Vlan50 ip address 192.168.0.7 255.255.255.0 ! ip default-gateway 192.168.0.1 ip http server ip http secure-server ! ????????????????????????????? ????????????????????????????? ????????????????????????????? ????????????????????????????? ! end
techie211 Posted July 19, 2012 Author Posted July 19, 2012 To me it seems like I'm authenticating with the wireless until after I've logged on there for not pulling down any policy.??? there seems to be something with the wireless. maybe a controller issue? It's a Meru 3200 and the AP's are the 320i's running on L2 preffered.
techie211 Posted July 19, 2012 Author Posted July 19, 2012 UPDATE: if I use a logon script it works. Certain shares get mapped. It seems that if the user's 'Home folder' setting in the Profile tab is setup to connect it doesn't work.???
glennda Posted July 19, 2012 Posted July 19, 2012 Are they all on seperate servers or are they all on the same? Sounds like something has the wrong default gateway.
sultan966 Posted July 19, 2012 Posted July 19, 2012 Do you have just one 3560 and one 2960 ? Please post a connection diagram. Which ports are connected between the switches for trunking, which port the server is in , which port the access point is in.
sultan966 Posted July 19, 2012 Posted July 19, 2012 Your 3560 switch: is it sharing routing table with any upstream switch or router ?
sultan966 Posted July 19, 2012 Posted July 19, 2012 I need the folowing information: 1. Trunk connection ports between switch 3560 and 2960 2. Which port the server is connected to - on whaich switch ? 3. Which port the access point is connected to - on which switch ?
sultan966 Posted July 19, 2012 Posted July 19, 2012 If possible please post the following output from both switches: 1. Show ip route 2. Show cdp neighbor
sultan966 Posted July 19, 2012 Posted July 19, 2012 On 2960 switch: You have given command :switchport mode access but you have not given command switchport access vlan 10 or vlan 20. Your vlan 10 and vlan 20 are teacher and student network. I expected the 2960 switch to be access layer switch. On 2960 I expected the command: switchport access vlan 10 or 20 on many ports. From the configuration I can see that 2960 switch is not doing much. I do not know how you have arranged the vlans. A connection diagram will make things clear.
techie211 Posted July 19, 2012 Author Posted July 19, 2012 2960:sh cdp nei Device ID Local Intrfce Holdtme Capability Platform Port ID BS_MDF_3560_SW01 Gig 1/0/49 135 R S I WS-C3560X Gig 0/23 3560:sh cdp nei Device ID Local Intrfce Holdtme Capability Platform Port ID BS_MDF_2960_SW01 Gig 0/1 134 S I WS-C2960S Gig 1/0/49 BS_MDF_2960_SW02 Gig 0/2 157 S I WS-C2960S Gig 1/0/49 BS_MDF_2960_SW03 Gig 0/5 166 S I WS-C2960S Gig 1/0/49 BS_MDF_2960_SW04 Gig 0/3 177 S I WS-C2960S Gig 1/0/49 BS_IDF03_2960_SW01 Gig 1/2 157 S I WS-C2960S Gig 1/0/49 HILL_MDF_3560_SW01 Gig 1/4 163 R S I WS-C3560X Gig 1/4 BS_IDF1_2960_SW01 Gig 1/1 130 S I WS-C2960S Gig 1/0/49 BS_IDF2_2960_SW01 Gig 1/3 162 S I WS-C2960S Gig 1/0/49 BS_MDF_2960_SW_05 Gig 0/4 177 S I WS-C2960S Gig 1/0/49 BS_MDF_2960_POE01 Gig 0/23 166 S I WS-C2960S Gig 1/0/49 sh ip route: Gateway of last resort is 10.0.1.1 to network 0.0.0.0 172.16.0.0/22 is subnetted, 2 subnets C 172.16.20.0 is directly connected, Vlan20 C 172.16.8.0 is directly connected, Vlan10 172.29.0.0/30 is subnetted, 1 subnets C 172.29.1.0 is directly connected, Vlan222 10.0.0.0/16 is subnetted, 2 subnets D 10.2.0.0 [90/3072] via 172.29.1.2, 6d19h, Vlan222 C 10.0.0.0 is directly connected, Vlan1 C 192.168.0.0/24 is directly connected, Vlan50 D 192.168.2.0/24 [90/3072] via 172.29.1.2, 6d19h, Vlan222 S* 0.0.0.0/0 [1/0] via 10.0.1.1
techie211 Posted July 19, 2012 Author Posted July 19, 2012 NOTE: sh ip route command does not work on the 2960 ???
sultan966 Posted July 19, 2012 Posted July 19, 2012 From CDP output I can see that there are many more switches in the network. If need help you will have to give a network diagram. It will be quick to solve problem with a diagram. Also, configuration output from all switches will be required. You can PM me.
sultan966 Posted July 19, 2012 Posted July 19, 2012 If you do not have network diagram you will have to post the output from all switches : 1. Show ip route. 2. Show cdp neighbor 3. Configuration of all switches 4. Ports where the server is connected 5. Port where access point is connected I will be able to draw a diagram based on that. After a clear picture I will be able to tell the configuration problems.
sultan966 Posted July 19, 2012 Posted July 19, 2012 (edited) 2960 is layer 2 switch. Show ip route may not work on that. If its is a layer 2 switch then the command interface vlan 10 and then ip address does not have any effect. On all layer 2 switches you just need the following command: 1. Swithport mode access 2. Switchport access vlan 10 or 20 And then on any port connect the access point. Inter VLAN routing will happen through layer 3 switch (3560). It is absolutely not neccessary to give command like: 1. Interface VLAN 10, ip address 172.16.10.2 255.255.252.0 2. Interface Vlan 20, ip address 172.16.20.2 255.255.252.0 3. Interface VLAN 50, ip address 192.168.0.7 255.255.255.0 The above three commands is only neccessary on Layer 3 switch. Your configuration on layer 2 switch (2960) does not have any effect. Edited July 19, 2012 by sultan966
sultan966 Posted July 20, 2012 Posted July 20, 2012 1. Check the ip address of the ethernet card and wireless card. From the ip address you will be able to tell which VLAN they are joining. Check this for both student and teacher laptop. The wireless card should get ip address from their respective VLAN. A teacher laptop wireless card should get ip address from 172.16.8.0/22 network and a student laptop wireless card should get ip address from 172.16.20.0/22 network. Based on the ip address you will be able to tell if student is joining VALN 20 and teacher is joining VLAN 10. Check this information by moving the laptops around the school. What method have you utilised to make sure the student joins vlan 20 and teacher joins vlan 10 ? 2. On all switch check vlan database by using command : show vlan. All the switches should have identical vlan information. If not create vlans: 10, 20, 222 on all switches. For consistent VLAN database on all switches you can use VTP or you can create this manually.
twin--turbo Posted July 20, 2012 Posted July 20, 2012 I notice vlan1 ( is this still the default vlan ) is getting DHCP? unlikly to be a cause, I also agree with sultan that you don't need ip's on the L2 switch vlans you also seem to have eigrp on the 3560? is there a reason for that? Rob
Duke5A Posted July 20, 2012 Posted July 20, 2012 Have you added the new subnets you created to Active Directory Sites and Services? This will cause issues similar to what you're experiencing.
adhutton Posted July 20, 2012 Posted July 20, 2012 Don't you need to set the ip helper-address on the VLANs? A
twin--turbo Posted July 20, 2012 Posted July 20, 2012 Don't you need to set the ip helper-address on the VLANs? A It is set. Rob
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now