Hi Again :)
I preprared the Configuration for you, and i tried to explain as much to clear the idea.
Before we start, i just want to remind you not forget to assign points to posts you got. :)
Try to be generous man :)
-----------------------------------------------
I have a better desing for you.
Since you want to inclufe Vlan100 in your access policy, so change its IP address to something else,
maybe 10.1.1.x/24 , and then change the IP address of your Default_Vlan on switch1 to the same range of
the Internet Router, (example 172.16.0.250/16).
Then you have the default_vlan for the Routing Switch, and the Main Router, and the Servers in the same
subnet (same Vlan).
Now, configuration part based on the New IP address for Vlan1 and Vlan100, i will break it out for Edge
Swtiches, and Core Switches with explaination then the Internet Router --- the Boss :)
----
Edge
----
1- Create all the 4 vlans:
(config)# vlan 100 ip address 10.1.1.2 255.255.255.0
(config)# vlan 200 ip address 192.168.0.2 255.255.255.0
(config)# vlan 300 ip address 10.0.0.2 255.255.254.0
(config)# vlan 400 ip address 172.16.0.2 255.255.255.0
2- Enable Default Gateway, and it should be the Vlan1 IP Address on the Routing Switch (switch1),
because this edge switch need an external router to do routing between its vlans:
(config)# ip default-gateway 172.16.0.250
3- Untagg all the Ports on this Edge Switch that will connect to workstations, every port with its
corresponding vlan,
(config)# vlan 200 untag 5 ---- this will untage port 5 to be used for PC in vlan 200.
4- Tag the UPLINK port the connect this switch to the core switch 5308 (switch1) with all vlans other
than Vlan1 - the default_vlan, example, if you connect this switch to the core using port 1:
(config)# vlan 100 tag 1
(config)# vlan 200 tag 1
(config)# vlan 300 tag 1
(config)# vlan 400 tag 1
5- Repeat these steps for all edge switches, after changing Vlan ip addresses, like vlan100 we used
here 10.1.1.2 and on the core we will use 10.1.1.1, then use 10.1.1.3 and so on....
6- A PC under Vlan 100 will have IP: 10.1.1.5 255.255.255.0, Gateway is his Vlan 100 IP address on the
Routing Switch or the COre (Switch1) gw: 10.1.1.1
7- A PC under Vlan 200 will have IP: 192.168.0.5 255.255.255.0, Gateway is his Vlan 200 IP address on
the Routing Switch or the COre (Switch1) gw: 192.168.0.1
And so on ....
----------------------------------------------------------------------------------------------------
----
Core
----
1- Create all the 4 vlans:
(config)# vlan 100 ip address 10.1.1.1 255.255.255.0
(config)# vlan 200 ip address 192.168.0.1 255.255.255.0
(config)# vlan 300 ip address 10.0.0.1 255.255.254.0
(config)# vlan 400 ip address 172.16.0.1 255.255.255.0
2- Enable IP Routing between all Vlans.
(Config)# ip routing
3- Enable Route to Internet:
(config)# ip route 0.0.0.0 0.0.0.0 172.16.0.254
4- Tagg the Ports coming from each Edge with all vlans, lets say port C1 is connecting to Edge1, then:
(config)# vlan 100 tag C5
(config)# vlan 200 tag C5
(config)# vlan 300 tag C5
(config)# vlan 400 tag C5
5- Repeat this taggin for all uplink ports that connect each edge switche to the core.
6- Now in this Stage, and if you do the Internet Router configuration section (down), then All the
Vlans can route between each other, and they can access the internet and the Servers as well.
7- Security Access for Severs:
you mentioned before that ports C1-C5 and E1-E4 and F2, are conencted to the Servers and Services, so
Simply don't do anything for these ports, just keep them untagged to the default vlan1 and BE SURE they
have the Same IP address range for Vlan1 and the Internet Router 172.16.0.x/255.255.0.0 , if yo udo
this then all these servers will be accessed from all Vlans.
8- Security Access for Vlans:
Create Access Control List to deny access to VLan100,200,300 and 400 from other Vlans except the
default vlan1 or Internet Traffic:
----VLAN100----
(config)# access-list 1 deny 192.168.0.1 0.0.0.255 --- deny Vlan200
(config)# access-list 1 deny 10.0.0.1 0.0.1.255 --- deny Vlan300
(config)# access-list 1 deny 172.16.0.1 0.0.0.255 --- deny Vlan400
(config)# access-list 1 permit any --- permit other traffic
(Config)# vlan 100 ip access-group 1 in --- apply ACL 1 to Vlan100
----VLAN200----
(config)# access-list 2 deny 10.1.1.1 0.0.0.255 --- deny Vlan100
(config)# access-list 2 deny 10.0.0.1 0.0.1.255 --- deny Vlan300
(config)# access-list 2 deny 172.16.0.1 0.0.0.255 --- deny Vlan400
(config)# access-list 2 permit any --- permit other traffic
(Config)# vlan 200 ip access-group 1 in --- apply ACL 2 to Vlan200
----VLAN300----
(config)# access-list 3 deny 10.1.1.1 0.0.0.255 --- deny Vlan100
(config)# access-list 3 deny 192.168.0.1 0.0.0.255 --- deny Vlan200
(config)# access-list 3 deny 172.16.0.1 0.0.0.255 --- deny Vlan400
(config)# access-list 3 permit any --- permit other traffic
(Config)# vlan 300 ip access-group 1 in --- apply ACL 3 to Vlan300
----VLAN400----
(config)# access-list 4 deny 10.1.1.1 0.0.0.255 --- deny Vlan100
(config)# access-list 4 deny 192.168.0.1 0.0.0.255 --- deny Vlan200
(config)# access-list 4 deny 10.0.0.1 0.0.1.255 --- deny Vlan300
(config)# access-list 4 permit any --- permit other traffic
(Config)# vlan 300 ip access-group 1 in --- apply ACL 4 to Vlan400
9- Now the Core Switch is ready and will deny any Vlan to access to other except the Default_Vlan
----------------------------------------------------------------------------------------------------
---------------
Internet Router
---------------
You have to give every Vlan its way back to the Core from this router, so you have to add 4 static
routes for each vlan on this router, the command is : ip route network mask gateway, now the gateway
for all vlans is the Default_Vlan (vlan1) ip address:
(Config)#ip router 10.1.1.0 255.255.255.0 10.1.1.1
(Config)#ip router 192.168.0.1 255.255.255.0 10.1.1.1
(Config)#ip router 10.0.0.1 255.255.254.0 10.1.1.1
(Config)#ip router 172.16.0.1 255.255.255.0
----------------------------------------------------------------------------------------------------
I hope that was enough information for you to run a proper Setup for your network.
Good Luck !!!