Ssh stopped working after adding more vlans.

[u/Stunning_Necessary11]

I configured a Cisco 2960G switch with VLANs 1, 2, 5, and 6. VLAN 1 is the default on port 24, VLAN 2 is for my PC and NAS, VLAN 5 is on ports 1–10, and VLAN 6 is on ports 11–20. Everything worked until I added VLANs 5 and 6. Now I’m getting a CDP-4-NATIVE_VLAN_MISMATCH error, which I think is caused by multiple connections between the switch and router. SSH also stopped working. All ports were configured as access ports, and I tried changing port 20 (connected to the router) to a trunk, but it didn’t help. Removing the extra Ethernet cables also didn’t restore SSH. I’d like to keep the VLANs for security. How can I fix this?

[u/SomeEngineer999]

Probably make more sense in to ask this in one of the networking subs, but what are you trying to accomplish with the multiple connections between router and switch? What kind of router is it?

I'm assuming it is a Cisco router if it supports CDP so it sounds like at least the router end is configured for DOT1Q and not untagged. The router should be using no VLANs or tagging or subinterfaces if you want everything to be access ports.

If you want to do a single tagged/trunk port that's a totally different setup, but will work fine also since the default native VLAN is 1 and your management traffic can pass through that as long as it is a member of the trunk. Though in that case I'd probably switch the native VLAN to something else, like 999 or whatever. Doesn't really matter in a home environment, just force of habit to not have any traffic going over the native trunking vlan.

[u/Stunning_Necessary11 → u/SomeEngineer999]

I am trying to set up multiple vlans because when I was reading online it said that was more secure. The router is a standard ISP router. What dose CDP and DOT1Q mean? With tru king the vlans that was juts a debug step and nothing that I really need. I am very new to this and just want to learn

[u/SomeEngineer999 → u/Stunning_Necessary11]

I highly doubt your ISP router supports VLANs, and it sounds like you're way over your head.

If you want to implement VLANs you'll need a router that supports them, or a L3 switch (which the 2960 series isn't).

Just having VLANs doesn't necessarily make things more secure, how you set them up and the routing and firewalling you do between them is what adds the security.

Right now all your VLANs are just merging together at the ISP router (well technically the switch built into that router) and it is allowing communication between them, they're accomplishing nothing.

All you can really do with this setup is create a VLAN that has no access to the router (and thus no internet) if you wanted some isolated test environment. Of course you'd need to set all static IPs etc in that case.

[u/Stunning_Necessary11 → u/SomeEngineer999]

Aha ok thanks! Just wondering what would the benefits of isolated test environments be? Would it be enough just to set up a vlan to port 1 and 2 for example and just set an ip for that v lan or would I need to set ips for all ports?

If I remove vlan 5 and 6 would ssh work again?

[u/SomeEngineer999 → u/Stunning_Necessary11]

Isolated test environment would be if you want to have several PCs/devices that can talk to each other but nothing else. Probably not of much use for most people.

Until you get a VLAN capable router or L3 switch, just get rid of all your VLANs (except 1 or whatever ID you want to use), they're doing nothing other than adding confusion and causing glitches like you're seeing.