• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

vlan help

T

the

Weaksauce
Joined
Dec 15, 2005
Messages
67
hey guys, for giggles i wanted to set up a vlan just cuz i was bored. everything in this vlan works, expect the internet. the hosts on vlan 2 and can talk to 3 and so on, but they can't get to the internet. the router's internet facing interface is 10.1.60.22 (fast Ethernet 0/0), and it can talk to the internet fine, and all my host's can ping 10.1.60.22, but no one can go beyond it. here is the config of my router and switch. any help is greatly appreciated.

Code: 
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname test
!
boot-start-marker
boot-end-marker
!
enable password pass
!
no aaa new-model
ip subnet-zero
!
!
!
ip name-server 10.1.60.1
no ftp-server write-enable
!
!
!
!
interface FastEthernet0/0
 description Connection to internet
 ip address 10.1.60.22 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1.1
 encapsulation dot1Q 1 native
 ip address 10.15.5.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.2
 encapsulation dot1Q 2
 ip address 10.15.10.15 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.3
 encapsulation dot1Q 3
 ip address 10.15.20.1 255.255.255.0
!
interface FastEthernet0/1.4
 encapsulation dot1Q 4
 ip address 10.15.30.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.5
 encapsulation dot1Q 5
 ip address 10.15.40.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.6
 encapsulation dot1Q 6
 ip address 10.15.50.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.7
 encapsulation dot1Q 7
 ip address 10.15.60.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.8
 encapsulation dot1Q 8
 ip address 10.15.70.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.9
 encapsulation dot1Q 9
 ip address 10.15.80.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.10
 encapsulation dot1Q 10
 ip address 10.15.90.1 255.255.255.0
 no ip redirects
!
interface FastEthernet0/1.11
!
no ip classless
ip route 0.0.0.0 0.0.0.0 10.1.60.1
no ip http server
!
banner motd ^C
test rooter
^C
!
line con 0
 login
 transport preferred none
line aux 0
 password pass
 login
 modem InOut
 transport preferred none
 transport input all
 transport output all
 stopbits 1
 flowcontrol hardware
line vty 0 4
 password pass
 login
 transport preferred none
!
!
!
end

test#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.1.60.1 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 11 subnets
C       10.15.5.0 is directly connected, FastEthernet0/1.1
C       10.15.10.0 is directly connected, FastEthernet0/1.2
C       10.15.20.0 is directly connected, FastEthernet0/1.3
C       10.15.30.0 is directly connected, FastEthernet0/1.4
C       10.15.40.0 is directly connected, FastEthernet0/1.5
C       10.15.50.0 is directly connected, FastEthernet0/1.6
C       10.1.60.0 is directly connected, FastEthernet0/0
C       10.15.60.0 is directly connected, FastEthernet0/1.7
C       10.15.70.0 is directly connected, FastEthernet0/1.8
C       10.15.80.0 is directly connected, FastEthernet0/1.9
C       10.15.90.0 is directly connected, FastEthernet0/1.10
S*   0.0.0.0/0 [1/0] via 10.1.60.1

Switch#sh run
Building configuration...

Current configuration : 953 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password pass
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
interface FastEthernet0/1
 switchport access vlan 2
!
interface FastEthernet0/2
 switchport access vlan 2
!
interface FastEthernet0/3
 switchport access vlan 3
!
interface FastEthernet0/4
 switchport access vlan 3
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
 switchport mode trunk
!
interface Vlan1
 ip address 10.15.5.10 255.255.255.0
 no ip route-cache
!
ip default-gateway 10.15.5.1
ip http server
!
!
line con 0
line vty 0 4
 password pass
 login
line vty 5 15
 login
!
end

Switch#sh vlan

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11
2    engineering                      active    Fa0/1, Fa0/2
3    acct                             active    Fa0/3, Fa0/4
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
2    enet  100002     1500  -      -      -        -    -        0      0
3    enet  100003     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    -        0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

Remote SPAN VLANs
------------------------------------------------------------------------------


Primary Secondary Type              Ports
------- --------- ----------------- ------------------------------------------

Switch#
 
something wrong wih the default gateway

your connection to the internet is set to ip address 10.1.60.22 it should be 10.1.60.1 as you have in that setup?

EDIT: i dont see any interface set to 10.1.60.1 ?
 
10.1.60.1 is the interface of my firewall, 10.1.60.22 is the outside interface of the router. if you try to make the gateway 10.1.60.22 it gives an error saying that ip address is the router. if i plug a computer up right to my firewall with the address 10.1.60.22 and a gateway of 10.1.60.1 it works like a charm. likewise with the gatway set at 10.1.60.1 the router can ping the internet (google.com) if i remove that default route, it can't ping anything outside.

does this make sense or do i have a backwards picture of it?
 
from what i can see, you're not allowing any vlans to be passed through your trunk port. You don't need a DG for your switch, remove that.

Use the "switchport trunk access <vlans>" command.

Can you ping the firewalls inside interface from the switch?
Can you ping any of the sub-interfaces from the switch?
 
xphil
thanks for your reply, i cant find that "switchport trunk access <vlan>" is a command, maybe its the wrong syntax? im thinking im lacking the "switchport trunk native vlan <number>" command, im getting ready to try that.
Can you ping the firewalls inside interface from the switch?
Click to expand...
from the switch no, from the router yes, the farthest i make it from the swtich, or a host on the switch is to the routers outside interface.
Can you ping any of the sub-interfaces from the switch?
Click to expand...
well i was able to, now im not. ?? let me get back to this point and go from there?

my thinking is i'm missing a single command to allow traffic outside the router. i can get to the external interface of the router, just not beyond it, however the router can ping outside to the firewalls internal interface, and beyond. ijsut for giggles i;ve opened the firewall completely to make sure there isn;t any conflict there.
 
ugh, sorry man... i guess it was a bit late last night:p

The correct command is "switchport trunk allowed <vlans>"
 
hey thanks for the reply, the answer to the "can you ping the sub interfaces from the switch" is yes. i can ping every sub interface from the switch, and from any host on the switch, and i can ping the out side interface of the router from the switch and any host on the switch. i can ping any subinterface, from any host, even if on different vlan (for instance i can ping the sub interface of vlan4 from a host on vlan2

let me go try that command and see what i gots.
 
aight i added that command to no avail, my config for the port im testing looks like this

Code: 
interface FastEthernet0/3
 switchport access vlan 3
 switchport trunk allowed vlan 3
 switchport mode access

can still hit the outside interface of the router, but not the inside interface of hte firewall.
 
added it to port 12, and now i can ping no sub interfaces, nor the external interface on the router from the swtich. config is below

Code: 
Current configuration : 981 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password pass
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
interface FastEthernet0/1
 switchport access vlan 2
!
interface FastEthernet0/2
 switchport access vlan 2
!
interface FastEthernet0/3
 switchport access vlan 3
 switchport mode access
!
interface FastEthernet0/4
 switchport access vlan 3
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
 switchport trunk allowed vlan 3
 switchport mode trunk
!
interface Vlan1
 ip address 10.15.5.10 255.255.255.0
 no ip route-cache
!
ip http server
!
!
line con 0
line vty 0 4
 password 29Low40
 login
line vty 5 15
 login
!
end
 
you have to allow all vlans to pass, so..

switchport trunk allowed vlan 1,2,3,1002-1005

i believe that the 1002-1005 are by default... I have tons of configs that are doing exactly what you want to do, but you need to allow those VLANS to be passed through the trunk. Right now, how you have it you should be able to ping VLAN 3's sub-interface.
 
i dont know what the deal is. now from the switch i can ping only itself (10.15.5.10 which is vlan1) i can't ping the subinterface of vlan1 (10.15.5.1) however from a host on vlan3 i can ping every subinterface, and the external interface of the router (10.1.60.22), just not beyond it (10.1.60.1)

no idea what i've done config is as follows

Code: 
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password pass
!
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
interface FastEthernet0/1
 switchport access vlan 2
!
interface FastEthernet0/2
 switchport access vlan 2
!
interface FastEthernet0/3
 switchport access vlan 3
 switchport mode access
!
interface FastEthernet0/4
 switchport access vlan 3
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
 switchport trunk allowed vlan 3
 switchport mode trunk
!
interface Vlan1
 ip address 10.15.5.10 255.255.255.0
 no ip route-cache
!
ip http server
!
!
line con 0
line vty 0 4
 password 29Low40
 login
line vty 5 15
 login
!
end

adding 1002-1005 manually has no effect
 
*sigh* i dont know what's up. i added vlan 1 2 3 1002-1005 and it didint work for a good 10 minutes. now all the sudden it jsut starts working, but in the same boat i was before.

i can ping all sub interfaces from the switch, and the external interface (10.1.60.22) of the router, just not beyond. (10.1.60.1)

this takes me back to thinking its a router config not allowing traffic out. do i need to set an acl to allow that? or nat?

i must be dumber than i had hoped: (
 
the said:
*sigh* i dont know what's up. i added vlan 1 2 3 1002-1005 and it didint work for a good 10 minutes. now all the sudden it jsut starts working, but in the same boat i was before.

i can ping all sub interfaces from the switch, and the external interface (10.1.60.22) of the router, just not beyond. (10.1.60.1)

this takes me back to thinking its a router config not allowing traffic out. do i need to set an acl to allow that? or nat?

i must be dumber than i had hoped: (
Click to expand...

IDK man, you don't need NAT ,you also do not need any ACLs. Your static route should be all you need. If you want(what i would do and tested) is run rip v2, as long as you rip the network it will 100% work. If you have netvisualizer Ill send you the file.... ill post the working configs though...
Code: 
switch#sh run

Building configuration...
Current configuration : 866 bytes
!
version 12.1
no service single-slot-reload-enable
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname switch
!
!
ip subnet-zero
!
!
spanning-tree extend system-id
!
!
interface FastEthernet0/1
  switchport mode access
!
interface FastEthernet0/2
  switchport access vlan 2
  switchport mode access
!
interface FastEthernet0/3
  switchport mode access
!
interface FastEthernet0/4
  switchport mode access
!
interface FastEthernet0/5
  switchport mode access
!
interface FastEthernet0/6
  switchport mode access
!
interface FastEthernet0/7
  switchport mode access
!
interface FastEthernet0/8
  switchport mode access
!
interface FastEthernet0/9
  switchport mode access
!
interface FastEthernet0/10
  switchport mode access
!
interface FastEthernet0/11
  switchport mode access
!
interface FastEthernet0/12
  switchport mode trunk
!
interface Vlan1
  ip address 10.59.1.2 255.255.255.0
  no ip route-cache
!
ip http server
!
!
line con 0
line vty 0 15
  login
!
end

switch#




Router>en
Router# sh run

Building configuration...
Current configuration : 625 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
!
!
ip subnet-zero
!
!
!
!
!
interface FastEthernet0/0
  ip address 10.0.0.1 255.255.255.0
  no ip directed-broadcast

!
interface Serial0/0
  no ip address
  no ip directed-broadcast
  shutdown
!
interface FastEthernet0/1
  no ip address
  no ip directed-broadcast

!
interface FastEthernet0/1.1
  encapsulation isl 1
  ip address 10.59.1.1 255.255.255.0
!
interface FastEthernet0/1.2
  encapsulation isl 2
  ip address 10.10.1.1 255.255.255.0
!
interface Serial0/1
  no ip address
  no ip directed-broadcast
  shutdown
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.0.0.2
!
!

!
!
line con 0
line aux 0
line vty 0 4
  login
!
end

Router#

for my test, i had another router connected to the other end with the two IPs configured, 10.0.0.2 and 11.1.1.1. My host on the 10.10.1.0 network could successfully ping the 11.1.1.1 address. Hope this helps some:)
 
sorry i only got hte boson sim, this setup is on an actal touer and switch. i reloaded each after lunhc and started from scratch, but it really doesnt seem to matter. even bfore i put any vlans in the mix the router can ping inside and out, and the switch can ping any interface on the router, just not beyond it. putting vlans in the mix only allows me to ping the subinterfaces at that point. i turned on rip 2. i used the command "network 10.15.5.1" but it only shows up at network 10.0.0.0 in the config. i assume that is right?

here are my two configs as it sits. im stumped

Code: 
Router#sh run
Building configuration...

Current configuration : 1053 bytes
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable password pass
!
no aaa new-model
ip subnet-zero
!
!
!
ip name-server 10.1.60.1
no ftp-server write-enable
!
!
!
!
interface FastEthernet0/0
 description Connection to Firebox
 ip address 10.1.60.22 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 duplex auto
 speed auto
!
interface FastEthernet0/1.1
 encapsulation dot1Q 1 native
 ip address 10.15.5.1 255.255.255.0
!
interface FastEthernet0/1.2
 encapsulation dot1Q 2
 ip address 10.15.10.1 255.255.255.0
!
interface FastEthernet0/1.3
 encapsulation dot1Q 3
 ip address 10.15.20.1 255.255.255.0
!
router rip
 version 2
 network 10.0.0.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.1.60.1
ip http server
!
banner motd ^C
test rooter
^C
!
line con 0
 password pass
 login
line aux 0
line vty 0 4
 password pass
 login
!
!
!
end

sh run
Building configuration...

Current configuration : 977 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
enable password pass
!
ip subnet-zero
!
ip name-server 10.1.60.1
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
interface FastEthernet0/1
 switchport access vlan 2
!
interface FastEthernet0/2
 switchport access vlan 2
!
interface FastEthernet0/3
 switchport access vlan 3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
 switchport mode trunk
!
interface Vlan1
 ip address 10.15.5.10 255.255.255.0
 no ip route-cache
!
ip default-gateway 10.15.5.1
ip http server
!
!
line con 0
 password pass
 login
line vty 0 4
 password pass
 login
line vty 5 15
 login
!
end

Switch#

i put the DG in there cuz now im referring back to my ccna book and he;s done so as well in his. only in the vlan section it has nothing to do with getting routes outside the network.
im stumped.

thanks for all the help though so far. im determiend to get this licked. think it has anything to do with 12.1 and 12.3 IOS not likingeach other? maybe spanning tree isn;t happy? im shooting in the dark here.
 
yes, when you rip that network it will go to 10.0.0.0. Just for shits copy and paste my exact configs. They worked through the simulator, i haven't tried it on my actual equipment as i do not have 26xx series routers.

I wanted to stick with exactly what you had. The only difference is ISL vs. .1q. Try my config with both. It def. works with ISL and can't see why it wouldn't for .1q. Also, it doesn't have anything to do with differences of IOS's
 
i tftp'd your files onto my swithc and router to no avail, however when i come in tomorrow i'll set up a router at the other end instead of a firewall. i have a few 2500's laying to where i can perfectly mimic your setup. only thing i cant mimic is your isl, i dont have any 1900 switched and my 2950's only support dot1q. i really do appreciate all your help, tomorrow i'll have some more posts on here. and thanks again for all this.
 
I looked through most of the posts, but did not see where anyone had touched on this. Do you have the appropriate routes on your firewall for the return traffic to all of these networks?

As far as your router goes, the subinterfaces look fine. On the switch you need...

Interface FastEthernet0/24
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed all <---- Trying to remember the correct syntax, not in front of a switch at the moment
 
PHUNBALL said:
I looked through most of the posts, but did not see where anyone had touched on this. Do you have the appropriate routes on your firewall for the return traffic to all of these networks?

As far as your router goes, the subinterfaces look fine. On the switch you need...

Interface FastEthernet0/24
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed all <---- Trying to remember the correct syntax, not in front of a switch at the moment
Click to expand...

You don't need to specify an encapsulation on your trunk port. I also told the OP that he needed to allow all his VLANs to be passed through the trunk port, which did no fix his issue.

I would second what phunball says though, set up appropriate routes on your firewall(using rip) and see if this fixes the issue. How are you coming on simulating my working setup?
 
hey guys, thansk so much again for all these repplies,
sorry i didnt get on here yesterday, i just moved to utah and my transmission froze, so i had to buy adn install a block heater yesterday.

xphil3:
i set up both of our setups in boson router sim and had no problem pinging outside. I'm bakc at work today and am gonan physiclaly setup the network i did in the simulator, hopefully in a half hour or so i'll be finito.

PHUNBALL:
im begninning to think this too, the syntax you posted is the one i've been using ("switchport trunk allowed vlan all"). the current topology of the lab environment i have is this. watchgaurd firebox--multihomed windows 2003 box (hosts the 10.1.60.1 address)--cisco router--switch. my thing is, even before vlan's are setup, the switch can never ping 10.1.60.1, so i'm not certain it's a vlan problem. when i set up the 10.1.60.1 address here with a 2500 i got and fidn it works, i'll know that i;ve wasted all you guy's time and i'll apologize like mad for it. till then thanks again for all this.
 
ok, good news all around, i mentioned i tested both of our setups in the routersim last night, today i set up both of our labs in the real world with acutal routers and it worked, so jsut 20 minutes ago i turned on rip v2 on the windows 2003 box and blamo, a minute later i was able to ping anything form anything. every host see's the internet and all, im super releieved, for a second there i thought i was too dumb to set up a vlan. WHEW.

i only have one question left, that i haven't done any research on my own yet, how can i set the router to forward dns requests? there is a DNS server running on the windows 2003 box (10.1.60.1) and if i set that as the dns server on the hosts, it works great, however i was hoping the dns server for each host could be the router, and the router would forward all requests to 10.1.60.1

example:
my host is 10.15.20.11 GTW is vlan3 10.15.20.1, DNS is 10.1.60.1 i;d like DNS to be 10.15.20.1 and have the rotuer forward the request to 10.1.60.1, is that possible?
 
the said:
ok, good news all around, i mentioned i tested both of our setups in the routersim last night, today i set up both of our labs in the real world with acutal routers and it worked, so jsut 20 minutes ago i turned on rip v2 on the windows 2003 box and blamo, a minute later i was able to ping anything form anything. every host see's the internet and all, im super releieved, for a second there i thought i was too dumb to set up a vlan. WHEW.

i only have one question left, that i haven't done any research on my own yet, how can i set the router to forward dns requests? there is a DNS server running on the windows 2003 box (10.1.60.1) and if i set that as the dns server on the hosts, it works great, however i was hoping the dns server for each host could be the router, and the router would forward all requests to 10.1.60.1

example:
my host is 10.15.20.11 GTW is vlan3 10.15.20.1, DNS is 10.1.60.1 i;d like DNS to be 10.15.20.1 and have the rotuer forward the request to 10.1.60.1, is that possible?
Click to expand...

Great news bud! I told ya rip would work ;-). Im glad we got this working too:)

onto your questions, but first.. are you going to be running DHCP from the router or the win2k3 box? If on the win2k3 box just create separate pools and set the DNS server as the IP of your DNS server(same box im assuming?). same goes for doing DHCP on the cisco, just create pools and set the DNS server ip address in the pool config. That seems like the easiest way IMHO and the only way I have ever done it.
 
well i guess i'm too late. I've had this happen before, and it took me a while to figure out but yeah, your firewall needed the route back to the subnets. In a small network you could always do static routes instead of rip...but in the end whatever works.
 
xphil3:
no DHCP, i know i know call me a doofus, its a management nightmare etc etc. the way we audit here at work is via computer name, from the computer name i can get the ip, room, computer model, and dept that computer is in, so we go static. so far its worked great, you just gotta document changes. but in the end it;s been worth it, pinpointing problems is pretty smooth, and in the midst of a clusterbang its really helped out. buti digress, here in the lab our dns server is on a multi homed dc, along with the email server (hey its the lab, its not like we have a billion dollar budget, geez) it gives us tons of errors all the time because of that, and once i had the vlans working (less internet) we decided to make a single homed server to eliminated some of the ambiguous problems of having a mulithomed everything server. even so i want to keep it as close to our working environment as possible.

So where i sit right now, is the DNS server sits on a multi homed windows box, this router config will be replacing that, as we all know multihomed dns aint so great. id like to throw the router in place transparently without having to change the dns server for each host. i know on linksys routers you can do that, the dns will be the same as the gateway, and the lynksis just forwards the dns request to the dns server it has in it';s little configuration, i'm hoping for the same thing here. now that im back for liek a 3 hour lunch break in wich i didnt even get any food, i'll see about how to do that. if anyone knows the answer, that;d be great. i wont lie. im as lazy as i can be.

Stinn:
its never too late, thanks for the reply. unfortunately my stupidity has wasted enough of xphile's time, and i might have to send him a fruit basket so he won't bomb my house and sell my kids on the black market. luckily i dont have kids.
 
i found this
AM schrieb:

> is it possible for the router to act as a DNS proxy?
> I mean that hosts can refer to it as DNS server and it forwards all the
> queries to DNS servers specified in the conf file.
> 837 with 12.3.8

enable
conf t
ip name-server 1.1.1.1 2.2.2.2 3.3.3.3
ip domain name example.yourispdomain.aq
ip dns server
exit

and your router will forward DNS request from it's internal IP address
to 1.1.1.1 first.
Click to expand...
but i don't have the "ip dns server" command. my router is a 2621xm runnung 12.3(5a). guess i'll have to upgrade my ios before i can do that. sucks.
 
the said:
i found this

but i don't have the "ip dns server" command. my router is a 2621xm runnung 12.3(5a). guess i'll have to upgrade my ios before i can do that. sucks.
Click to expand...

nice, we all learn something new everyday. I just did;) Get that IOS upgrade, and make sure you got enough dram and flash to do it! I know a few people that have unsuccessfully loaded half an IOS that way:eek:
 
You must log in or register to reply here.
Back
Top