Aruba AOS config to CISCO config

alanfromit · 2025-07-09T14:56:27.456Z

Hi all. I have Aruba 2930M switches here, all configured and working just fine. I have a couple of CISCO SG350 switches that have come along to spoil the party!

Basically, I need to run a couple of CISCO switches in situ with our HPE Aruba kit for now. It should be easy peasy, but why is it causing me so much headache! The reason is simple, and it’s my complete lack of experience with CISCO switches in terms of config around VLANs specifically. I have never been a networking guy I should add, I just get by. But most networking people know one or the other mostly, but enough of either to get by. On that note, can anybody solve this ‘simple’ one please?

On the Aruba kit, the config is basically something like…

NOTE Trk1, Trk2 are ‘uplinks’. 1/1-1/4 are CCTV cameras. 1/45-1/48 are Wifi APs.

vlan 1
name “Data”
no untagged 1/1-1/4,1/45-1/48
untagged Trk1-Trk2

vlan 50
name “WIFI Access Points”
untagged 1/45-1/48
tagged Trk1-Trk2

vlan 51
name “Staff WiFi”
tagged 1/45-1/48,Trk1-Trk2

vlan 52
name “Guest WiFi”
tagged 1/45-1/48,Trk1-Trk2

vlan 53
name “CCTV”
untagged 1/1-1/4
tagged Trk1-Trk2

All fine. Easy. On CISCO kit, I cannot get it to work at all. I have the following config on the CISCO kit, I am doing something really silly I’m sure…

NOTE GigabitEthernet1 is an ‘uplink’. GigabitEthernet2 is a WiFi AP. I have not bothered with a CCTV camera yet!

vlan database
vlan 50-53
exit
!
interface vlan 1
ip address xxxxxx
!
interface vlan 50
name “Wifi Access Points”
!
interface vlan 51
name “Staff WiFi”
!
interface vlan 52
name “Guest WiFi”
!
interface vlan 53
name CCTV
!
interface GigabitEthernet1
spanning-tree portfast
switchport mode trunk
switchport general allowed vlan add 50-53 tagged
switchport general allowed vlan add 1 untagged
switchport access vlan 53
switchport trunk allowed vlan 1,50-53
!
interface GigabitEthernet2
switchport mode trunk
switchport general allowed vlan add 51-52 tagged
switchport general allowed vlan add 50 untagged
switchport general forbidden vlan add 1,53
switchport trunk allowed vlan 50-52
!

The AP does not get an IP address (VLAN 50), so there’s no hope of even getting onto dishing out Staff or Guest wifi.

Thanks in advance anybody!

spiceuser-62ai · 2025-07-09T15:15:02.460Z

Main thing is not mixing general and trunk modes on the Cisco like you’ve done. Just set the uplink as a trunk with VLAN 1 native, and the AP port as access on VLAN 50. That should sort it

something like the below might help for the uplink port

interface GigabitEthernet1
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan 1,50,51,52,53
spanning-tree portfast trunk

then for wifi wap port

interface GigabitEthernet2
switchport mode access
switchport access vlan 50
spanning-tree portfast

if im wrong or missed anything let me know

phildrew · 2025-07-09T20:15:45.935Z

The AP is still going to need to be able to get to the VLANs for the corp and guest WiFi networks. It has to be a trunk (Cisco trunk) to the AP.

int gi 1/0/1
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan 1,50-53
spanning-tree portfast

int gi 1/0/2
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 50-52
spanning-tree portfast

I think your issue derives from mixing switchport mode trunk and switchport general commands.
When in doubt, assign a VLAN interface and start pinging to see if it communicates upstream

alanfromit · 2025-07-10T06:38:58.613Z

Thanks all, I will give this a go, makes sense to not mix trunk and general, but honestly I tried and failed a good few times doing it manually from documentation, so moved to the web GUI - I think that mix of commands is what the GUI spat out. Or maybe a bit of both. Thanks for the responses, I will give it a bash as above later.

alanfromit · 2025-07-10T07:03:09.352Z

Also, with your example config, there’s no TAGGED and UNTAGGED - is that right then with CISCO trunks?

alanfromit · 2025-07-10T08:38:15.339Z

Another hour on this and still no luck. I tried a combination of things, the exact config above does not issue a DHCP to the AP’s, and then when I tried using switchport mode general with tagged and untagged ports, to try and mirror the Aruba config, still no DHCP to the AP’s. I should point out that the network VLAN 50 is not tagging any packets. It’s an interface on our FW that’s running a DHCP server.

matt7863 · 2025-07-10T11:35:59.948Z

First things first - what is the topology?
What are the cisco devices connecting to? are they uplinking to an existing core switch like the Aruba devices appear to?

Must dos:
ensure device that cisco are uplinking to are running compatible spanning tree to the cisco and be set as root bridge.
On the Cisco uplink both ends must use same vlan set and the same untagged vlan.

good ideas:
On the cisco - disable smart ports

Useful knowledge - the Cisco SG350 is a small business range switch and it’s CLI configuration and behaviour is not exactly the same as a ‘standard’ cisco enterprise switch. e..g a quick google on cisco config may misslead you as an enterprise cisco switch has worked in the same way for 30+ years but these differ.
Cisco terminology - native = untagged. port type should be ‘trunk’. General is a port type that allows both trunk and access it is equivalent on ‘hybrid’ in other makes.

You do not need interfaces for vlans that do not have an ip address and will not route.
so on the cisco only vlan 1 should have an interface and IP address (if vlan 1 is used to manage them).

SG350 config`uplink needs vlan 1 untagged and vlan 50-53 tagged
Wifi AP needs vlan 50 untagged and vlan 51,52 tagged


interface vlan 1
ip address xxxxxx
!
vlan 50
name “Wifi Access Points”
!
vlan 51
name “Staff WiFi”
!
vlan 52
name “Guest WiFi”
!
vlan 53
name CCTV
!
interface GigabitEthernet1
description Uplink to xxx
no spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan 1,50-53
switchport trunk native vlan 1
!
interface GigabitEthernet2
description Wifi AP port
switchport mode trunk
switchport trunk allowed vlan 50-52
switchport trunk native vlan 1 ( note edited to correct a typo in orignal)
!

To check your vlans are working correctly (with ports 1 and 2 up) use the command:
show spanning tree
it should list vlan 1,50,51,52 active on uplink and wifi port. It should show that gig1 uplink is the path to root and that gig2 is forwarding.
show mac address vlan 50 should show the AP mac address in this vlan.

alanfromit · 2025-07-10T12:47:06.899Z

Many thanks, will try this out.
switchport trunk native vlan 50-52 <— That’s a typo, right?

alanfromit · 2025-07-10T13:02:12.421Z

@matt7863 thank you, that was just the thing I needed, simple syntax explanation, which to be fair I think I’d already read but clearly not well enough! It’s all good now - thanks again, cheques in the post!

matt7863 · 2025-07-10T14:54:43.354Z

AlanFromIT:

switchport trunk native vlan 50-52 <— That’s a typo, right?

yes. well spotted. copy and paste strikes again !
I’ve edited original in case someone looks at it in the future.

alanfromit · 2025-07-15T15:21:16.973Z

@matt7863 I apologise for this additional query.
Re: the topology, the ‘core’ I guess could be considered to be the HP Aruba switch stacks. But we do not have a VLAN’d network, only the Wifi is VLAN’d properly with tagging, the management of the Wifi is untagged, as is CCTV etc on other VLANs that I’ve kept off this for now.

What I am trying to achieve is a recycled ‘no cost’ expansion of the network into another location, I’d buy AR Aruba and mimic the config of our other kit in an ideal world, but in this case, I’ve got only a CISCO SG350 to work with.

The config works just fine on one SG350. Albeit with the config using slightly tweaked version of yours…

interface GigabitEthernet1
description Uplink to HPE
no spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan 1,50-53
switchport trunk native vlan 1
!
interface GigabitEthernet2
description Wifi AP port
switchport mode trunk
switchport trunk allowed vlan 50-52
switchport trunk native vlan 50
!

Note, the “native” or untagged in HPE Aruba language for the AP port is VLAN 50 as this is an isolated network for the APs only.
I had sort of expected this to not work, as the uplink port Gi1 has native vlan 1 (flat network here for the trusted/lan) but the AP has native vlan 50, but it doesn’t seem to mind. Note, neither VLAN 50 or VLAN 1 has tagged traffic.

So, to complicate things, I need a second SG350 hanging off this first SG350. Assumed it’s easy, just replicate the configuration of the first switch, but the AP will not work on switch number 2 with the same config.

The trunk / uplink for SG350-1 and SG350-2 works, is up, and VLAN 1 works (ie can get on our network and manage the switch itself over vlan1). But the AP will not connect - it manages over vlan 50 as it’s on it’s own isolated network, I guess it can’t deal with this as the uplink/trunk back to SG350-1 is only doing VLAN 1 native/untagged?.

I guess this is as expected to somebody who knows what they’re doing, but me, I have little clue at this point and am left to fiddle with alternative config. In the HPE Aruba world I can TAG and UNTAG multiple ports, it seems the only option (unless I am wrong?) for that sort of arrangement is use “Switchport mode general”?

TIA for any tips.