This document explains how to setup a Cisco ICS 7750 that runs software version 2.5 or 2.6 with at least one Multiservice Route Processor (MRP) 300 so that it can connect to a local network that uses 802.1q VLANs. Cisco ICS software versions 2.5 and 2.6 have limited VLAN capabilities. All of the cards in the chassis must be on the Native VLAN (typically VLAN1) that uses untagged frames. The MRP can have additional sub-interfaces defined for the other 802.1q VLANs in the network to allow for inter-VLAN traffic.
For more information on document conventions, refer to Cisco Technical Tips Conventions.
Before you attempt this configuration, ensure that you meet these prerequisites:
The Cisco ICS 7750 ICSConfig utility is able to run without any errors.
The Cisco ICS Administrative Tool recognizes all of the cards in the chassis.
You have an external switch setup with 802.1q VLANs with a trunk port that will be connected to the system switch processor (SSP) on the Cisco ICS 7750.
The system processing engine (SPE) cards must be on the Native VLAN.
The SSP must have its Management VLAN on the Native VLAN.
The MRP FastEthernet interface 0/0 must be the Native VLAN interface.
The Native VLAN is typically VLAN 1 and does not use 802.1q tagging for its frames.
Cisco ICS 7750 Software versions 2.5 and 2.6 require that all cards in the 7750 chassis are configured for connectivity to the Native VLAN (typically VLAN 1) so that they send untagged 802.1q frames. MRPs and the SSP can have additional connections to other VLANs that use tagged 802.1q frames as required to connect the ICS 7750 to a local network.
This document assumes that you are already familiar with these topics:
To use 802.1q VLANs on Catalyst switches and Cisco IOS® based routers. If you would like to review 802.1q trunking concepts and implementation, there are several documents available on the Virtual LANs/VLAN Trunking Protocol (VLANs/VTP) Support Page.
Management VLANs. For further information, refer to Configuring a Management IP Address on Catalyst 4500/4000, 5500/5000, 6500/6000, and Catalyst Fixed Configuration Switches.
Use of the VLAN Trunking Protocol (VTP). For further information, refer to Understanding and Configuring VLAN Trunk Protocol (VTP).
The information in this document is based on the software and hardware versions below.
Verified with Cisco ICS software versions 2.5 and 2.6
Cisco ICS 7750 with SAP and SSP
1 x MRP 300
5 x SPEs
The information presented in this document was created from devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If you are in a live network, ensure that you understand the potential impact of any command before you use it.
This document uses the network setup shown in the diagram below.
In this diagram, you can see that all of the cards are connected to VLAN 1. In addition, the MRP and the SSP are also connected to VLANs 2 through 4. This is how the network looks when you have completed the tasks in this document.
In this configuration, the Catalyst Switch is connected to the SSP port on port 0/1. Use the commands shown here to set this up.
3500 PWR XL 802.1q Trunk Configuration |
---|
3500XL>enable 3500XL#configure terminal Enter configuration commands, one per line. End with CNTL/Z. 3500XL(config)#interface FastEthernet0/1 3500XL(config-if)#switchport trunk encapsulation dot1q 3500XL(config-if)#switchport mode trunk 3500XL(config-if)#switchport trunk allowed vlan all 3500XL(config-if)#exit 3500XL(config)#exit 3500XL#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] 3500XL# |
This section provides information you can use to confirm your configuration works properly.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
In the output below you can see:
The switchport is Enabled.
The Administrative and Operational modes are both set to Trunk.
The Trunking Encapsulation is set to 802.1q.
The Operational Trunking Encapsulation is set to dot1q.
The Native VLAN is VLAN 1.
The Active VLANs are 1 through 4.
This command output is from the show interface fastEthernet 0/1 switchport command.
cat2924#show interface fastEthernet 0/1 switchport Name: Fa2/1 Switchport: Enabled Administrative mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Disabled Access Mode VLAN: 0 ((Inactive)) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: ALL Trunking VLANs Active: 1-4 Pruning VLANs Enabled: 2-1001 cat2924# Priority for untagged frames: 0 Override vlan tag priority: FALSE Voice VLAN: none Appliance trust: none 3500XL#
There are no steps to troubleshoot this part of the configuration.
The 3500 PWR XL is a server in this network. Use the commands shown here to set up the VTP settings.
3500 PWR XL VTP |
---|
3500XL#vlan database 3500XL(vlan)#vtp server Device mode already VTP SERVER. 3500XL(vlan)#vtp domain tacweb Changing VTP domain name from tt to tacweb 3500XL(vlan)#vtp password 1P6c3J9z Setting device VLAN database password to 1P6c3J9z 3500XL(vlan)#exit APPLY completed. Exiting.... 3500XL# |
This section provides information you can use to confirm your configuration is operational.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
In the output below you can see:
There are eight known VLANs.
The VTP mode is Server.
The VTP domain is tacweb.
This is sample command output of the show vtp status command.
3500XL#show vtp status VTP Version : 2 Configuration Revision : 2 Maximum VLANs supported locally : 254 Number of existing VLANs : 8 VTP Operating Mode : Server VTP Domain Name : tacweb VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x25 0x8F 0xFF 0x30 0xEF 0xB1 0xA2 0x57 Configuration last modified by 10.21.9.1 at 4-9-93 18:53:07 3500XL#
There are no steps provided to troubleshoot this part of the configuration.
The 3500 PWR XL is a server in this network. Use the commands shown here to set up the IP default gateway.
3500 PWR XL IP Default Gateway |
---|
3500XL>en Password:3500XL#configure terminal Enter configuration commands, one per line. End with CNTL/Z. 3500XL(config)#ip default-gateway 10.21.9.61 3500XL(config)#exit 3500XL#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] 3500XL# |
There are no steps provided toverify this part of the configuration.
There are no steps provided to troubleshoot this part of the configuration.
This task establishes two ports on the ICS 7750 SSP as 802.1q trunk ports. The ports that you configure are the ones that connect the SSP to the external Catalyst Switch and the SSP to the internal MRP Ethernet interface. The MRP is in slot 1 of the ICS 7750 chassis. Slot 1 is port 0/3 on the SSP. Use the commands shown here to set this up.
ICS 7750 SSP 802.1q Trunk Configuration |
---|
SSP>enable SSP#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SSP(config)#interface FastEthernet0/1 SSP(config-if)#switchport trunk encapsulation dot1q SSP(config-if)#switchport mode trunk SSP(config-if)#switchport trunk allowed vlan all SSP(config-if)#interface FastEthernet0/3 SSP(config-if)# switchport trunk encapsulation dot1q SSP(config-if)# switchport mode trunk SSP(config-if)#switchport trunk allowed vlan all SSP(config-if)#exit SSP(config)#exit SSP#copy running-config startup-config Destination filename [startup-config]? Building configuration... [OK] SSP# |
Note: The MRP in this configuration is the slot on the far left as you face the front of the ICS 7750 chassis. The card slot numbers are 3 through 8 from left to right. This is why the interfaces used in this configuration are FastEthernet 0/1 and 0/3.
This section provides information you can use to confirm your configuration is operational.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
In this output here you can see:
The switchport is Enabled.
The Administrative and Operational modes are both set to Trunk.
The Trunking Encapsulation is set to 802.1q.
The Operational Trunking Encapsulation is set to dot1q.
The Native VLAN is VLAN: 1.
The Active VLANs are 1-4.
This is sample command output of the show interface fastEthernet mod_num/port_num switchport command.
SSP#show interface fastEthernet 0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Disabled Access Mode VLAN: 0 ((Inactive)) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: ALL Trunking VLANs Active: 1-4 Pruning VLANs Enabled: 2-1001 SSP# Priority for untagged frames: 0 Override vlan tag priority: FALSE Voice VLAN: none Appliance trust: none SSP#
This is another example of the show interface fastEthernet mod_num/port_num switchport command.
SSP#show interface fastEthernet 0/3 switchport Name: Fa0/3 Switchport: Enabled Administrative mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Disabled Access Mode VLAN: 0 ((Inactive)) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: ALL Trunking VLANs Active: 1-4 Pruning VLANs Enabled: 2-1001 Priority for untagged frames: 0 Override vlan tag priority: FALSE Voice VLAN: none Appliance trust: none SSP#
There are no steps provided to troubleshootthis part of the configuration.
The SSP is a VTP client in this network. Use the commands shown here to set this up.
Caution: The SSP can only support 256 VLANs. If your network has more than 256 VLANs you need to enable VLAN Pruning to reduce the number of VLANs the SSP sees in VTP advertisements. For further information, refer to Understanding and Configuring VLAN Trunk Protocol (VTP).
ICS 7750 SSP VTP |
---|
SSP>enable SSP#vlan database SSP(vlan)#vtp client Setting device to VTP CLIENT mode. SSP(vlan)#vtp domain tacweb Changing VTP domain name from hhgttg to tacweb SSP(vlan)#vtp password 1P6c3J9z Setting device VLAN database password to 1P6c3J9z SSP(vlan)#exit !--- This message appears. Although the message is normal, it is not !--- completely accurate. It is possible to change some VTP parameters on a VTP Client. !--- In this case the VTP domain name and password were changed. If this switch !--- never had a domain name configured, it would have learned it from its upstream VTP !--- partner. There is no harm in entering the domain name manually. In CLIENT state, no apply attempted.Exiting.... SSP# |
This section provides information you can use to confirm your configuration is operational.
Certainshow commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
In the output here you can see:
There are eight known VLANs.
The VTP mode is Client.
The VTP domain is tacweb.
This is a sample command output of the show vtp status command.
SSP#show vtp status VTP Version : 2 Configuration Revision : 2 Maximum VLANs supported locally : 254 Number of existing VLANs : 8 VTP Operating Mode : Client VTP Domain Name : tacweb VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Enabled MD5 digest : 0x25 0x8F 0xFF 0x30 0xEF 0xB1 0xA2 0x57 Configuration last modified by 10.21.9.1 at 4-9-93 18:53:07 SSP#
In the output here you can see:
Ports 2, 4, 5, 6, 7, and 8 are in VLAN 1 (ports 1 and 3 are trunk ports).
All the VLANs are active.
Note: VLANs 1002, 1003, 1004, and 1005 are default VLANs. This is why the show vtp status commands shows eight VLANs: VLAN 1 (default);. VLANs 2-4 that you added and the four remains asdefault VLANs.
This is sample command output of the show vlan brief command.
SSP#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/2, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8 2 vlan2 active 3 vlan3 active 4 vlan4 active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active SSP#
In this output, you can see that the SSP knows about VLANs 2 through 4.
There are additional methods to verify that VTP is operational.. One method is to change the name of a VLAN on the VTP server and verify that the VLAN name change is propagated to the VTP clients. The VTP Configuration Revision Number should also increase by one.
There are no steps provided to troubleshoot this part of the configuration.
The MRP is the inter-VLAN router for this network. Use the commands shown here to set this up.
ICS 7750 MRP 802.1q |
---|
MRP>enable Password: MRP#configure terminal Enter configuration commands, one per line. End with CNTL/Z. MRP(config)#interface FastEthernet0/0 MRP(config-if)#ip address 10.21.9.61 255.255.255.0 !--- Interface 0/0 is the Native VLAN interface that uses untagged frames. !--- Do not configure 802.1q encapsulation on it. MRP(config-if)#interface FastEthernet0/0.1 MRP(config-if)#encapsulation dot1Q 2 MRP(config-if)#ip address 10.21.8.61 255.255.255.0 MRP(config-if)#no cdp enable MRP(config-if)#interface FastEthernet0/0.2 MRP(config-if)#encapsulation dot1Q 3 MRP(config-if)#ip address 10.21.7.61 255.255.255.0 MRP(config-if)#no cdp enable MRP(config-if)#interface FastEthernet0/0.3 MRP(config-if)#encapsulation dot1Q 4 MRP(config-if)#ip address 10.25.14.196 255.255.255.248 MRP(config-if)#no cdp enable MRP(config-if)#exit MRP(config)#exit MRP# |
This section provides information you can use to confirm your configuration is operational.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
This is a sample command output of the show vlans command.
MRP#show vlans Virtual LAN ID: 1 (IEEE 802.1Q Encapsulation) vLAN Trunk Interface: FastEthernet0/0 This is configured as Native VLAN for the following interface(s) : FastEthernet0/0 Protocols Configured: Address: Received: Transmitted: IP 10.21.9.61 3664824 3660021 Virtual LAN ID: 2 (IEEE 802.1Q Encapsulation) vLAN Trunk Interface: FastEthernet0/0.1 Protocols Configured: Address: Received: Transmitted: IP 10.21.8.61 3020581 3116540 Virtual LAN ID: 3 (IEEE 802.1Q Encapsulation) vLAN Trunk Interface: FastEthernet0/0.2 Protocols Configured: Address: Received: Transmitted: IP 10.21.7.61 100073 82743 Virtual LAN ID: 4 (IEEE 802.1Q Encapsulation) vLAN Trunk Interface: FastEthernet0/0.3 Protocols Configured: Address: Received: Transmitted: IP 10.25.14.196 157686 34398 MRP#
There are no steps provided to troubleshoot this part of the configuration.
Configure the IP routing parameters to set up the MRP as a viable default gateway for remote IP networks that end-systems on the local network can use.
A thorough explanation of IP routing, default gateways, and gateways of last resort is beyond the scope of this document. The option presented in this document is only one of the possible solutions to ensure adequate IP routing connectivity. For more information on this subject, refer to Configuring a Gateway of Last Resort Using IP Commands.
In this network design, end-systems on the local network use the IP address of the MRP for the VLAN that they are connected to as their default gateway. For instance, a device on VLAN 3 will have 10.21.7.61 configured as its default gateway. If the IP traffic is destined for remote IP networks, the MRP forwards the traffic to the other router in the network diagram over VLAN 4.
Use the commands shown here to set this up.
ICS 7750 MRP Default Network; Gateway of Last Resort |
---|
MRP>enable Password: MRP#configure terminal Enter configuration commands, one per line. End with CNTL/Z. MRP(config)# MRP(config)#ip classless MRP(config)#ip default-network 0.0.0.0 MRP(config)#ip route 0.0.0.0 0.0.0.0 10.25.14.193 MRP(config-if)#exit MRP(config)#exit MRP# |
This section provides information you can use to confirm your configuration is operational.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
This is a sample command output of the show ip route command.
MRP#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is 10.25.14.193 to network 0.0.0.0 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks C 10.21.9.0/24 is directly connected, FastEthernet0/0 C 10.21.8.0/24 is directly connected, FastEthernet0/0.1 C 10.21.7.0/24 is directly connected, FastEthernet0/0.3 C 10.25.14.192/29 is directly connected, FastEthernet0/0.2 S* 0.0.0.0/0 [1/0] via 10.25.14.193 MRP#
In the output above you can see that the gateway of last resort is 10.25.14.193 to network 0.0.0.0 and that the MRP has a route to 0.0.0.0 through the IP address 10.25.14.193. This is the IP address of the other router in the network diagram.
This is a sample command output of the ping ip_address command.
3500XL#ping 10.21.9.61 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.21.9.61, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/5 ms 3500XL#ping 10.21.8.61 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.21.8.61, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/5 ms 3500XL#ping 10.21.7.61 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.21.7.61, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/6 ms 3500XL#ping 10.25.14.196 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.25.14.196, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/5 ms 3500XL# 3500XL#ping 10.25.14.193 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.25.14.196, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/5 ms 3500XL#
In the output above you can see that the 3500 switch is able to ping each of the subnet addresses assigned to the VLANs on the MRP. 10.21.9.61 is the Native VLAN (VLAN 1) that uses untagged frames.
There are no steps provided to troubleshoot this part of the configuration.
In this task you must verify, and if required, change the default gateway for the cards in the chassis.
Access Internet Explorer on the SM SPE or another device that has connectivity to the SM SPE.
Start ICSConfig and enter the url http://ip_address/icsconfig.
The CheckDiscovery process begins.
When the CheckDiscovery process finishes, you are prompted to click Continue with ICSConfig.
When the ICS 7700 System Configuration Menu appears, click ICS 7700 System Setup.
The Summary screen appears and shows the current settings. Scroll down to the section named Network Configuration-DNS and Gateway.
In this case, the default gateway is already setup correctly. The remainder of this task shows you how to change this setting if you need to.
If your system is already setup properly, you do not need to complete this task. Click Cancel and close all of the open windows.
If you need to change this setting continue with this task. Click the Network Configuration-DNS and Gateway link.
When the menu to change the default gateway appears, enter the correct IP address and click Continue.
When the Summary screen appear again, click Next.
When the Ready to Submit screen appears, click Submit.
Wait until the Setup In Progress screen completes.
When prompted, click Close Window.
There are no specific verification steps for this task. Proceed to the Verify section below.
There are no specific to troubleshoot steps for this task. Proceed to the Verify section below.
This section provides information you can use to confirm your configuration is working properly.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
You can verify that the SPE cards can access end systems on VLANs 2 through 4 with the help of the ping command from a DOS prompt to ping the IP addresses on the MRP for the other VLANs.
Select Start > Run > cmd [Enter] on the console of any of the SPEs.
Ping the IP addresses on the MRP.
Note: Because the SPEs are on VLAN 1 (subnet 10.21.9.0) you do not need to ping the MRP's interface for this VLAN. This step is included below to show that the SPE can access all of the subnets in this configuration.
C:\>ping 10.21.9.61 Pinging 10.21.9.61 with 32 bytes of data: Reply from 10.21.9.61: bytes=32 time<10ms TTL=255 Reply from 10.21.9.61: bytes=32 time=10ms TTL=255 Reply from 10.21.9.61: bytes=32 time=10ms TTL=255 Reply from 10.21.9.61: bytes=32 time=10ms TTL=255 Ping statistics for 10.21.9.61: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 10ms, Average = 7ms C:\>ping 10.21.8.61 Pinging 10.21.8.61 with 32 bytes of data: Reply from 10.21.8.61: bytes=32 time<10ms TTL=255 Reply from 10.21.8.61: bytes=32 time<10ms TTL=255 Reply from 10.21.8.61: bytes=32 time<10ms TTL=255 Reply from 10.21.8.61: bytes=32 time<10ms TTL=255 Ping statistics for 10.21.8.61: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\>ping 10.21.7.61 Pinging 10.21.7.61 with 32 bytes of data: Reply from 10.21.7.61: bytes=32 time<10ms TTL=255 Reply from 10.21.7.61: bytes=32 time<10ms TTL=255 Reply from 10.21.7.61: bytes=32 time<10ms TTL=255 Reply from 10.21.7.61: bytes=32 time<10ms TTL=255 Ping statistics for 10.21.7.61: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\>ping 10.25.14.196 Pinging 10.25.14.196 with 32 bytes of data: Reply from 10.25.14.196: bytes=32 time=10ms TTL=255 Reply from 10.25.14.196: bytes=32 time=10ms TTL=255 Reply from 10.25.14.196: bytes=32 time=10ms TTL=255 Reply from 10.25.14.196: bytes=32 time=10ms TTL=255 Ping statistics for 10.25.14.196: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 10ms, Maximum = 10ms, Average = 10ms C:\>ping 10.25.14.193 Pinging 10.25.14.193 with 32 bytes of data: Reply from 10.25.14.193: bytes=32 time<10ms TTL=128 Reply from 10.25.14.193: bytes=32 time<10ms TTL=128 Reply from 10.25.14.193: bytes=32 time<10ms TTL=128 Reply from 10.25.14.193: bytes=32 time<10ms TTL=128 Ping statistics for 10.25.14.193: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\>
The most common cause of inter-VLAN routing problems are configuration errors.
It is also possible that there are static IP routes on the SPEs that are overriding the default gateway setting. Use the c:\> netstat -rn command in a DOS prompt on the SPEs to verify the current routing table. Delete any conflict routes and try the test again. If the routes come into conflict then you must determine how they were created and prevent them from its occurs again..
Revision | Publish Date | Comments |
---|---|---|
1.0 |
13-Dec-2005 |
Initial Release |