?
Solved

VLAN Routing problems on 3560

Posted on 2007-08-06
11
Medium Priority
?
401 Views
Last Modified: 2013-11-05
I have vlan2 ip address 201.1, my ip is 201.2, i can ping the 201.1 from my pc. The documentation also calls for the 'routing' port of the switch to be on the same subnet as the router or 'default route' so i gave it a 10.10 and the inside int of the firewall is 10.1. I from my box at 201.2 I can ping 10.10 on the switch, but thats all.

I have a default route for 0.0.0.0 0.0.0.0 192.168.10.1

what am i doing wrong?
0
Comment
Question by:jaysonfranklin
  • 6
  • 3
  • 2
11 Comments
 
LVL 19

Expert Comment

by:nodisco
ID: 19641993
hi jayson

if you can ping the switch on the local address, and the switch can ping the firewall using the 10.10 to 10.1 address then it looks like the problem is with your firewall.  You have a default route on the switch to send all traffic to the inside of the firewall.  But as you are using a 192.168.201.2 source ip address, the firewall will need to know how to route traffic back to it.  What firewall is it?

For example - if its a Cisco PIX - you would need a route statement like:
route inside 192.168.201.0 255.255.255.0 192.168.10.10

hth
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19642078
i have a route on the pix that looks like this:

route inside 192.168.0.0 255.255.0.0 192.168.10.10 -this way it covers all vlans...

....and actually i got it to work now....the pix was failed over to a secondary. i can ping the pix at 10.1 but cannot ping any of the other devices on the 10.0 network.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19642108
why can't i ping any other devices on the network though?
0
Exciting career futures for women in IT

Education has the power to transform lives and open the door to new career opportunities. By earning an IT degree from WGU, you can become a highly skilled IT professional. Get the credentials and certifications you need to become a leader in this rewarding field.  

 
LVL 19

Expert Comment

by:nodisco
ID: 19642119
Are the other devices you are trying to ping using the PIX as their default gateway?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19642137
yes. so, i need to put them on a vlan too..?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19642205
ah...so i need to just make them have a gateway of the 10.10?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19642262
how can i pass dns traffic from one vlan to another?
0
 
LVL 9

Accepted Solution

by:
predragpetrovic earned 2000 total points
ID: 19657082
Hi,

Could you tell me the several things:
1. You must have at least two VLANs, do you have at least two VLANs created ?
2. You must enable ip routing on the switch, have you enabled it ?
3. Each VLAN needs a default gateway, create an interface for each VLAN and assign it an IP address, have you done this ?
4. Plug the PIX into one port, assign that port an IP address (the port is not supposed to be in a VLAN or switchport). Have you done this ?

So here is what you need to do (int Gi0/1 is the port for connection to the pix), interfaces gi0/12 - 16 are in VLAN 10, interfaces gi0/17 - 20 are in VLAN 20.

On the 3560:
ip routing
interface gi0/1
no switchport
ip address $SWITCHPORTIP 255.255.255.0
no shut
exit
interface range gi0/12 - 16
switchport mode access
switchport access vlan 10
description VLAN 10
no shut
exit
interface range gi0/17 - 20
switchport mode access
switchport access vlan 20
description VLAN 20
no shut
exit
interface VLAN 10
ip address $VLAN10IPADDRESS 255.255.255.0
no shut
exit
interface VLAN 20
ip address $VLAN20IPADDRESS 255.255.255.0
no shut
exit

On the pix:
ip address inside $PIXINSIDEADDRESS 255.255.255.0
route inside 192.168.X.X 255.255.255.0 $SWITCHPORTIP

So I would route each VLAN not the entrie 192.168.0.0/16 class, replace the $PIXINSIDEADDRESS with the real address of the pix, replace the $SWITCHPORTIP with the address of the switch (the one on which the PIX is connected), as well default gateway for all members in VLAN 20 is $VLAN20IPADDRESS (you must set it) and for all members in VLAN 10 the default IP address is $VLAN10IPADDRESS (you must set it).

Hope that this helps.
0
 
LVL 9

Expert Comment

by:predragpetrovic
ID: 19657104
All of the routing is being managed by Cisco 3560 not PIX. As well all traffic is enabled, if you wish to apply access lists please think what is supposed to be allowed and what is supposed to be forbidden, after start implementing them.
0
 
LVL 9

Expert Comment

by:predragpetrovic
ID: 19657121
And I have forgot, you must add a default route on the switch...
configure terminal
ip route 0.0.0.0 0.0.0.0 $PIXINSIDEADDRESS
exit

Replace the address with the real IP address of the inside interface of the PIX
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 19688080
Ok, Everything is working great now...it turns out, one of our techs who was given the vlan map for the topology, plugged a bunch of stuff into the wrong ports.. Thanks much for your help though!
0

Featured Post

Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange’s free Course of the Month is focused on CompTIA IT Fundamentals.
Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question