CCIE Security – Creating vlans on a router

I just tried to create a third L3-interface in one of my C1811-routers. These are equipped with two FastEthernet router-interfaces and one 8-port FastEthernet-switch. Since the latter are L2-interfaces I need to create a vlan and tie that to one of the switchports rather than configuring IP-addressing directly on the interface like I´ve done on Fa0 and Fa1:


interface FastEthernet0
ip address 10.0.12.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1
ip address 10.0.20.2 255.255.255.0
duplex auto
speed auto
standby 0 ip 10.0.20.1
standby 0 priority 2

However, when doing that I found that I couldnt create the vlan (more like: the vlan wasnt auto-created like I am used to):


r2#sh run int vlan30
Building configuration...

Current configuration : 60 bytes
!
interface Vlan30
ip address 10.0.30.1 255.255.255.0
end

r2#
r2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r2(config)#int fa2
r2(config-if)#switchport access vlan 30
%Access VLAN 30 does not exist. Please add it to vlan database
r2(config-if)#

What vlan database?

r2(config)#vlan ?
accounting VLAN accounting configuration

There is for sure no vlan-command for adding vlans into the config…

Does there exist any vlan in any database?


r2#sh vlans

No Virtual LANs configured.

r2#

So, I have my L3 configured for vlan30, as well as my other interfaces. But i miss the Vlan.


r2#sh ip int brie
Interface IP-Address OK? Method Status Prot ocol
FastEthernet0 10.0.12.2 YES NVRAM up up
FastEthernet1 10.0.20.2 YES NVRAM up up
FastEthernet2 unassigned YES unset up down
FastEthernet3 unassigned YES unset up down
FastEthernet4 unassigned YES unset up down
FastEthernet5 unassigned YES unset up down
FastEthernet6 unassigned YES unset up down
FastEthernet7 unassigned YES unset up down
FastEthernet8 unassigned YES unset up down
FastEthernet9 unassigned YES unset up down
Vlan1 unassigned YES NVRAM up down
Async1 unassigned YES NVRAM down down
Loopback0 10.12.12.12 YES NVRAM up up
Vlan30 10.0.30.1 YES manual up down
r2#

At this point I was thinking of an upgrade. I ran IOS 12.4(6)T8 and upgraded to latest 12.4T: 12.4(24)T2. After that it looks different. I am now able to create vlans.


r2#sh vlans

No Virtual LANs configured.

r2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
r2(config)#vlan 30
r2(config-vlan)#name yadayo
r2(config-vlan)#
r2#

Ok. All good?


r2#sh vlans

No Virtual LANs configured.

r2#

What? Hmm… Let´s see…


r2(config)#vlan ?
WORD ISL VLAN IDs 1-4094
accounting VLAN accounting configuration
ifdescr VLAN subinterface ifDescr

r2(config)#vlan

What? ISL vlan? It shouldn´t really matter since this vlan is all internal of the router, but still, ISL is real old-fashion. What am I doing wrong here? I have gut feeling that I am on the wrong track…

What can we look at? Remember: when stuck, try fooling around with command-completion and question-mark!


r2#sh vla?
vlan-range vlan-switch vlans

r2#sh vlan-swi
r2#sh vlan-switch

VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa3, Fa4, Fa5, Fa6, Fa7, Fa8
Fa9
30 yadayo active Fa2
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup

VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 1002 1003
30 enet 100030 1500 - - - - - 0 0
1002 fddi 101002 1500 - - - - - 1 1003
1003 tr 101003 1500 1005 0 - - srb 1 1002
1004 fdnet 101004 1500 - - 1 ibm - 0 0
1005 trnet 101005 1500 - - 1 ibm - 0 0
r2#

So we have a “show vlan-switch”-command that shows us that the vlan30 with name yadayo we created earlier actually exists. But not in the running-config:


r2#sh run | incl vlan
switchport access vlan 30
r2#

Explanation: The vlans are stored in the vlan-database (vlan.dat) on flash:

r2#dir flash:
Directory of flash:/

1 -rw- 24539200 Jan 11 2010 07:50:34 +00:00 c181x-adventerprisek9-mz.124-24.T2.bin
2 -rw- 2374 Aug 12 2007 08:14:14 +00:00 sdmconfig-1811-1812.cfg
3 -rw- 861696 Aug 12 2007 08:14:32 +00:00 es.tar
4 -rw- 1164288 Aug 12 2007 08:14:54 +00:00 common.tar
5 -rw- 1038 Aug 12 2007 08:15:06 +00:00 home.shtml
6 -rw- 113152 Aug 12 2007 08:15:20 +00:00 home.tar
7 -rw- 527849 Aug 12 2007 08:15:38 +00:00 128MB.sdf
8 -rw- 660 Jan 11 2010 08:06:40 +00:00 vlan.dat

31940608 bytes total (4710400 bytes free)
r2#

Just to verify that it works. My L3-interface:


r2#sh run int vlan30
Building configuration...

Current configuration : 60 bytes
!
interface Vlan30
ip address 10.0.30.1 255.255.255.0
end

Does it work? Let´s ping an adjacent router…


r2#ping 10.0.30.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.30.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r2#

Conclusion: Handling of vlans are confusing and differ between different IOS version. Be aware. 🙂

Tagged with: , , , ,
Posted in Uncategorized

Signuppp

[mc4wp_form id="2457"]
Website Security Test