Cisco Router/Switch Configuration Trouble

[shinnemanc]

Hi guys,

I am new to Cisco. I took a few Cisco Classes, but for the most part, they went over my head. I am more of a Server guy.

Anyways, I have a Cisco Router and two Cisco Switches. I am needing help configuring them correctly. I have tried to configure Inter-Vlan Routing, Router-On-A-Stick, and a few other things to help split my network up and boost performance. Both of my switches are Layer 2/3 capable, however, I have no clue how to use Layer 3 or if that will help boost performance of my Network.

Now, I cannot figure out HOW to attach a darn photo to this, but I can at least copy and paste the document that describes my network (or how I want it to be). I just need help programming the devices because I have been fighting this for a month and a half and whenever I get one thing working, another thing fails, I get that working and something else fails. I do not know what is going on. I just cannot get this to work properly.

So, I would greatly appreciate any and all help with the Configuration of the Router and Switches so I can get this scheme set up and secured.

Thanks guys and gals!


Here is the Network Design/Details as copied from the document:

NETWORK DESIGN

Cisco 2911 Gigabit Router
Cisco WS-3750E Gigabit Layer 2/3 Switch (S1)
Cisco ws-c3560 8-port Layer 2/3 Switch (S2)
Cisco WAP371 Access Point

IP Range 10.0.0.1-10.0.0.4 are reserved for Router and Switches/WAP (Network Hardware)
IP Range 10.0.0.5-10.0.0.20 are reserved for Static Device Assignment
IP Range 10.0.0.100-10.0.0.135 are DHCP Address available to all devices that are DHCP

Cable Modem: DHCP IP Assigned by Comcast
Router (R1): IP 10.0.0.1 on G0/1 Port
G0/0 set to DHCP from Cable Modem
Switch (S1): IP 10.0.0.2 Port 23 to R1 G0/1
Switch (S2): IP 10.0.0.3 Port 21 to S2 G0/1
WAP (WAP1): IP 10.0.0.4 S1 Port 22 to WAP G0/0


VLAN1 (Admin)
Aramis Server: Static IP 10.0.0.5 (S1 port 1)
Elisia Server: Static IP 10.0.0.6 (S1 Port 2)
Arwin-Laptop: Static IP 10.0.0.10 (S1 Port 12)
S1 Ports 20-24 are all Network Devices such as switches, router connection, WAP Connection, Etc.
Sapphira-Laptop: DHCP IP (Wireless VLAN1 connection to WIFI SSID Admin)

VLAN2 (Entertainment)
S1 Ports 13-15 are Entertainment DHCP Devices
S2 Ports 1-3 to S1 Port 21 are Entertainment DHCP VLAN2
WIFI SSID: Aramis-Ent is VLAN2 Entertainment Devices that do not allow Ethernet Connections

VLAN 3 (Apple Media Network)
S1 Port 16 to AppleTV is VLAN3 DHCP
S2 Port 4 to AppleTV is VLAN3 DHCP

VLAN4 (Printers)
S1 Ports 4-8 to Printers is VLAN4 DHCP

VLAN5 (General Use)
No Hardwire Ports are assigned to VLAN5. Only WIFI Traffic is Assigned to VLAN5

VLAN6 (Guest)
No Hardwire Ports are assigned to VLAN6. Only WIFI Traffic is Assigned to VLAN6

Switchports NOT in use:
S1 Ports 3, 9-11, 17-19
S2 Ports 5-8
VLAN DESCRIPTIONS

VLAN1 (Admin): This VLAN is reserved for the two servers and my two laptops. No other device should be assigned to this VLAN, however, any computer on VLAN 3, VLAN4 and VLAN5 can communicate with the Servers and laptops. Only 4 devices assigned to this VLAN.

VLAN2 (Entertainment):This VLAN is for Entertainment Devices such as TVs, HD Devices, Streaming Devices, BluRay Players, etc. No Computers or phones should access this VLAN and this VLAN does NOT have access to internal network resources such as servers or printers. Only internet access is allowed.

VLAN3 (Apple Media Network)- This is reserved for AppleTVs and any other Apple device requiring the Apple Network. This VLAN should have access to other VLANs on the network (Excuding VLAN2 and VLAN6) so that iphones and computers can stream to AppleTVs and AppleTV can access the Apple Network and iTunes Server on VLAN1.

VLAN4 (Printers)-This is a DHCP VLAN for the 4 Printers. The printers are Hardwired and any device on the network, whether wireless or hardwired, should be able to communicate to this VLAN and print to the Printers when needed. This excludes VLAN2 as Entertainment Devices do NOT need access to printers. This also excludes VLAN6 as no guests will be allowed to Print on the Network.

VLAN5 (WIFI-General Access)-This VLAN is for all other network traffic. VLAN5 should be able to access network resources such as printers and servers. All Wifi SSID’s and Devices are DHCP.

VLAN6 (Guest)-Internet Access ONLY. No Access to Network Resources or any device on the network. Cannot see other devices connected to WiFi. Completely restricted to Internet Only. LOCKED DOWN. All Devices are DHCP

WIFI SSIDs AND VLAN ASSIGNMENT

“Aramis-Admin”: 2.4GHz Radio assigned to VLAN1 (Network Resources)
“Aramis-Ent”: 2.4GHz Radio assigned to VLAN2 (Internet ONLY-No Resources)
“Aramis-Ent5G”: 5GHz Radio assigned to VLAN2 (Internet ONLY-No Resoures)
“Aramis-Ent5G”: 5GHz Radio assigned to VLAN2 (Internet ONLY-No Resources)
“Aramis-AC”: 5Ghz Radio Assigned to VLAN5 (Network Resources)
“Aramis-N”: 2.4GHz Radio Assigned to VLAN5 (Network Resources)
“Aramis-Guest”: 2.4GHz Radio Assigned to VLAN6 (Internet ONLY-No Resources)

 

[bill001g]

That is another way to configure it. I missed it. I tend to not put IP on ports when I have vlan interfaces but that is just the way I do it mostly because there were certain switches that did not allow you to do both.

 

[shinnemanc]

That’s what cisco’s Website said to do. Otherwise, Port 23 would have to be trunked and Router-on-a-Stick configured on the Router G0/1 Port with trunking enabled on the router as well. So, instead of doing all that crap, I just did the fast easy way that Cisco recommended on their site. Lol.

Biggest problems I have now:

A. Apple Media Network (VLAN 23) cannot see the Apple Media Server or iTunes on the server on VLAN 21. This is CRUCIAL for the Apple Network to work properly.

B. I need ACLs blocking VLANs 22 and 26 from accessing other VLANs and having internet only, BUT, still allowing VLANs 20, 21, And 25 to access VLAN 22 and 26 (for Server and client management).

That is another way to configure it. I missed it. I tend to not put IP on ports when I have vlan interfaces but that is just the way I do it mostly because there were certain switches that did not allow you to do both.

 

[bill001g]

I can see nothing that would block it. If each device can ping their gateways the switch should route between them. You could be able to ping between the end devices. Some applications need to be on the same subnet because they use a broadcast protocol to locate device. Most those you can key in the ip address and it will work. I know nothing about apple devices sorry.

I do not have a switch in front of me so I may tell lies here. I think you can apply a inbound access list vlan 22 and vlan 26 that says

permit tcp x.x.x.x y.y.y.y established
deny any 10.x.x.x/8
permit ip any any

 

[shinnemanc]

What would the X’s and Y’s be on the ACL? I’ve never done an ACL.

I can see nothing that would block it. If each device can ping their gateways the switch should route between them. You could be able to ping between the end devices. Some applications need to be on the same subnet because they use a broadcast protocol to locate device. Most those you can key in the ip address and it will work. I know nothing about apple devices sorry.

I do not have a switch in front of me so I may tell lies here. I think you can apply a inbound access list vlan 22 and vlan 26 that says

permit tcp x.x.x.x y.y.y.y established
deny any 10.x.x.x/8
permit ip any any

 

[bill001g]

There are a couple options but they are subnets. The syntax I used is just for explanation the actual commands have lots of option. I was just trying to point out the "established" option. Same with /8 I don't think you can use that notation you must use 0.255.255.255


It would be something like
permit tcp 10.0.2.0 0.0.0.255 10.0.7.0 0.0.0.255 established.

You might get away with

permit tcp any any established.

The nasty thing about access lists is you must invert the subnet mask so 255.255.255.0 becomes 0.0.0.255