Cisco 1701 and VLAN ?

[Tony414]

Hello,
I'm not sure if this is possible. And if it is, I'm not sure how to do it.

I have a 1701 router connected to an HP Procurve switch. I also have a wireless AP connected to the switch. I want to isolate the wireless from the LAN. The HP has VLAN capabilities. My router is connected to port 1 on the switch and the wireless is connected to port 18 on the switch. HP is telling me I can't do this without some configuration to the router. Is there VLAN support on the router to keep the wireless of the LAN?

Thanks,
Tony

 

[Tony414]

Ok Cool! I will give this all a shot. Thanks everyone for the help....

 

[Tony414]

Ah ha! One more thing. Can I do this by telnet, or do I have to be directly connected?

 

[kajo]

if i were you... i would console in rather than telnet... because you are going to be messing with the inerface that you are going to change.

 

[Tony414]

That's what I thought. Just wanted to make sure....

 

[burtsbees]

I want to isolate the wireless from the LAN."

Easiest way is acls...

Burt

 

[Tony414]

burtsbees,

acls? Is that access lists? Not sure where to start with that. When you say easiest way, do you mean instead of VLAN?

Thanks,
Tony

 

[burtsbees]

Well, you would make a range for wireless clients and another range for wired clients, and they can be in the same subnet. You can separate them by an access-list with the use of a mask...for example, wireless=10.10.10.1 255.255.255.0 through 10.10.10.126, and wired = 10.10.10.128 through 10.10.10.254
access-list 110 deny ip 10.10.10.0 0.0.0.127 10.10.10.128 0.0.0.127
access-list 110 deny ip 10.10.10.128 0.0.0.127 10.10.10.0 0.0.0.127
int fa0
access-group 110 in

Like that. The masks in the acl's separate them as if they were separate subnets, but they are all the same network.
By the way, the example I gave was just informational---you do need a VLAN 1 IP address for VLAN and switch management.
The acl deal will keep the two vlsm subnets from talking to eachother. The fa0 interface will have a 10.10.10.0 255.255.255.0 IP address on it, so it can route both vlsm subnets. It has been quite some time, but that should work...anyone else agree? I'm tired and am listening to my 2 year old and 3 year old have a Wrestle Royal in the living room as I type---my poor wife...lol

Burt

 

[burtsbees]

Also, the clients themselves would have the normal 255.255.255.0 mask.

Burt

 

[Tony414]

Hi burtsbees,

So are you saying I would still need to setup all that VLAN stuff from earlier?

 

[Tony414]

Hi,
Just checking back into this...

Tony

 

[burtsbees]

Set up the VLANs and put in the access list with this at the end...

access-list 110 permit ip any any

Burt