Solved

Need cisco 3560 switch config verified..unable to use WINS

Posted on 2007-11-26
37
770 Views
Last Modified: 2013-11-25
It appears NetBios is not working on the network. I can ping hosts on other subnets by name and IP address, but when i do a 'net view' I get System Error 53 - The Network path was not found.

Here is the config. Can somebody verify that netbios isn't being blocked by the switch (which is doing the routing)

also, it may be helpful to know that everything works for each individual subnet plus vlan5 where the servers are. So, if i am on vlan 2 i can communicate with all the hosts on vlan 2 plus vlan 5 where the servers are. However, cannot 'net view' vlan4, or any other vlan besides the one im on plus the server vlan.

sh run
Building configuration...

Current configuration : 8768 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname 3560
!
no logging console
enable secret
!
no aaa new-model
ip subnet-zero
ip routing
ip domain-name domain.local
ip name-server 192.168.204.2
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
!
vlan access-map vlan 9
 action forward
vlan internal allocation policy ascending
!
!
interface GigabitEthernet0/1
 switchport access vlan 7
 switchport mode access
!
interface GigabitEthernet0/2
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/3
 switchport access vlan 4
switchport mode access
!
interface GigabitEthernet0/4
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/5
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/6
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/7
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/8
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/9
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/10
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/11
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/12
 switchport access vlan 4
 switchport mode access

interface GigabitEthernet0/13
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/1
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/15
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/16
 switchport access vlan 4
 switchport mode access
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/21
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/22
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/23
 switchport access vlan 3
 switchport mode access

interface GigabitEthernet0/24
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/25
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/26
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/27
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/28
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/29
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/30
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/31
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/32
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/33
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/34
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/35
!
interface GigabitEthernet0/36
!
interface GigabitEthernet0/37
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/38
 switchport access vlan 5
 switchport mode access

interface GigabitEthernet0/39
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/40
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/41
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/42
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/43
switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/44
 switchport access vlan 5
 switchport mode access
!
interface GigabitEthernet0/45
 switchport access vlan 9
 switchport mode access
 speed 100
 duplex full
!
interface GigabitEthernet0/46
 switchport access vlan 9
 switchport mode access
 speed 100
 duplex full
!
interface GigabitEthernet0/47
 switchport access vlan 6
 switchport mode access
!
interface GigabitEthernet0/48
 description Trunk to 2960
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 2,4,8
 switchport trunk pruning vlan 2,4,8
 switchport mode trunk
!
interface GigabitEthernet0/49
!
interface GigabitEthernet0/50
!
interface GigabitEthernet0/51
!
interface GigabitEthernet0/52
!
interface Vlan1
 no ip address
!
interface Vlan2
 ip address 192.168.201.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
interface Vlan3
 ip address 192.168.202.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
interface Vlan4
 ip address 192.168.203.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
interface Vlan5
 ip address 192.168.204.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
 interface Vlan6
 ip address 192.168.205.1 255.255.255.0
 ip helper-address 192.168.204.4
!
interface Vlan7
 ip address 192.168.206.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
interface Vlan8
 ip address 192.168.207.1 255.255.255.0
 ip helper-address 192.168.204.4
 ip directed-broadcast
!
interface Vlan9
 ip address 192.168.10.10 255.255.255.0
!
router rip
 passive-interface Vlan1
passive-interface Vlan2
 passive-interface Vlan3
 passive-interface Vlan4
 passive-interface Vlan5
 passive-interface Vlan6
 passive-interface Vlan7
 passive-interface Vlan8
 network 172.16.0.0
 network 192.168.10.0
 network 192.168.201.0
 network 192.168.202.0
 network 192.168.203.0
 network 192.168.204.0
 network 192.168.205.0
 network 192.168.206.0
 network 192.168.207.0
!
ip default-gateway 192.168.10.1
ip classless
ip forward-protocol udp bootpc
ip forward-protocol udp bootps
ip forward-protocol udp netbios-ss
ip forward-protocol udp ntp
p route 0.0.0.0 0.0.0.0 192.168.10.1
ip http server
!
!
!
!
control-plane
!
!
line con 0
 logging synchronous
line vty 0 4
 password
 logging synchronous
 login
line vty 5 15
 password
 login
!
end
0
Comment
Question by:jaysonfranklin
  • 22
  • 11
  • 4
37 Comments
 
LVL 7

Accepted Solution

by:
carcenea earned 250 total points
ID: 20352100
Your switch config is fine. I think the problem is on your routing side. Do you have any access lists on your router?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20352256
the switch is a Layer 3 switch and is doing all the routing. as you can see by the config, there are no access-lists applied.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20352271
do i have the routing set up wrong on the switch?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20352639
the 45th and 46th int's go to a Pix firewall.. but that shouldn't effect the routing on the switch right? please let me know.. thanks.
0
 
LVL 7

Expert Comment

by:carcenea
ID: 20354742
No, your config on those interfaces shouldn't affect your routing. Here are a few things that I noticed that you don't need though...


ip default-gateway 192.168.10.1 <------You only need this command or
ip classless
ip forward-protocol udp bootpc
ip forward-protocol udp bootps
ip forward-protocol udp netbios-ss
ip forward-protocol udp ntp
ip route 0.0.0.0 0.0.0.0 192.168.10.1  <-------the other and not both.



ip default-gateway 192.168.10.1
ip classless
ip forward-protocol udp bootpc  <-----------------Previously when you specified a helper address for
ip forward-protocol udp bootps  <-----------------different vlan int's it automatically enables the
ip forward-protocol udp netbios-ss
ip forward-protocol udp ntp  <------------------forwarding of these protocols so they don't need to be specified.
p route 0.0.0.0 0.0.0.0 192.168.10.1

Finally, on all of you interfaces that you enabled "ip directed-broadcast", unless you are working with legacy applications that need broadcast traffic enabled throughout vlans then you want to disable this option. Look for the caption "IP-Directed Broadcast" for more info on this.

http://www.informit.com/articles/article.aspx?p=102180&seqNum=5&rl=1


Who knows? By correcting the above mentioned things it could resolve the problem...

Just let me know.

0
 
LVL 7

Expert Comment

by:carcenea
ID: 20354784
I just had a brain-fart... :)

When you use the net view command your switch sees the traffic coming in on the port then forwards it to your helper address. If your DHCP server is also a WINS server then it will contain all netbios names of all pc's on the network. Is your DHCP server also a WINS server?

Hope this helps!
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20355837
yes, dhcp and wins on the same box...hopefully editing the config with your recommendations does the trick.

was told i needed ip directed broadcast for nbios
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20359820
removed these:
ip forward-protocol udp bootpc  
ip forward-protocol udp bootps
ip forward-protocol udp netbios-ss
ip forward-protocol udp ntp
no ip default-gateway 192.168.10.1 - it took this but stopped working when the other 'route' statement was removed.

also removed all the ip directed-broadcast statements from each vlan.

now from host 192.168.203.2:  net view 192.168.206.2

System error 53 has occured.
The network path was not found.

Do you have anymore suggestions?
0
 
LVL 7

Expert Comment

by:carcenea
ID: 20360835
Sorry... I doubt very seriously though that this is a routing problem. I'd check up more on your WINS server to verify that it's working properly.

Please let me know when you get this resolved. I'm curious as to what is causing the problem.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20361045
to set up WINS i simply point all the clients to the WINS server via dhcp and i just run the WINS setup wizard right? Is there any special configuration or setting i need to look for to have it service multiple subnets?
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20361271
Hello Jayson. You woke me up (I'm on UK time you know) - most inconsiderate....

Tell me about your dhcp & wins. You say these are on the same box/ip - all your clients are picking up their dhcp addresses OK from this server? If they are then the ip-helper addresses are obviously doing their thing. What is your general network design/network environment??

Your layer 2 config looks the same as mine apart from the fact that I do not put my ip-helper addresses into the VLAN designations, I put this in at the 'conf t' level on the access layer switches  In fact, I need to check that as I don't think I have helper addresses on the L3 switches at all..

We run 4 x Cisco 6509's at the core (still layer 3 switches at the end of the day) so I will need to review that aspect tomorrow - unfortuantely I have not brought my laptop home so do not have access to the network.



0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20361495
Keith, i am very sorry about the time difference. I was not thinking about that.. please accept my apologies.

i tried to apply the helper-address on the config t level, and it wouldn't accept the command. 'sh' confirmed this was not able to be done.

All clients are getting dhcp addresses and checking in with WINS regularly. still unable to 'net view' a client on another subnet though..

gereral network design is just 1 vlan per department, then 1 vlan that all the servers reside on.i took off all the acls.

0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20361774
Naaah - its ok, was just pulling your leg. 9.30PM here.

No there is no special config. The only thing I had to do was on the dhcp and I had to create a scope for each subnet at the /24 boundary. I actually use a class B network and then split into 110-odd class c's and yes, I had to make 110 scopes. Making the scope at the /16 boundary just would not work properly.

So helper-addresses are fine else dhcp wouldn't work, routing is fine else ping wouldn't work either.
Really suprised that dhcp worked at all with the ip directed broadcast set - that is normally a real no-no. the ip-helper address also deals with these ports so that is covered also:

Trivial File Transfer Protocol (TFTP) (port 69)
DNS (port 53), time service (port 37)
NetBIOS name server (port 137)
NetBIOS datagram server (port 138)
Boot Protocol (DHCP/BootP) client and server datagrams (ports 67 and 68)
Terminal Access Control Access Control System (TACACS) service (port 49)
IEN-116 name service (port 42)

Just a silly comment Jayson,but I assume netBt over TCPIP is enabled on the client work station nics?










0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20361932
yep. unfortunately netbios is 'enabled' on each nic.. weird why it is not working...

... do you have separate WINS servers on each subnet?

would you recommend adding ip forward-protocol udp 445?

0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20361989
also, it may be helpful to know that everything works for each individual subnet plus vlan5 where the servers are. So, if i am on vlan 2 i can communicate with all the hosts on vlan 2 plus vlan 5 where the servers are. However, cannot 'net view' vlan4, or any other vlan besides the one im on plus the server vlan.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20361996
Absolutely not - would be a ludicrous state - 110 wins servers? I have 1 at each site (we have 13) which are each on their own subnets across an mpls IP vpn but at the two main sites I have two wins each. Each of the two major sites has upwards of 100+ subnets (vlans).

One wins/dhcp sercver does 110 subnets (the bottom half) and the second dhcp/wins server does the top half of the 110 subnets  ie 30 - 126 on one box and 140 - 250 on the other.

i put both dhcp/wins addresses as ip-helper entries in each of my 2950-48 layer-2 access switches that are all around the local offices. Each 2950 cluster is fibre attached to both 6950's and gigastacked together. Each cluster is in two vlans ports 1-24 in vlan x and 25 -48 in vlan z. Each cluster has a different pair of vlans for resilience/failover etc.

I DO let the management vlan through to every cluster so all trunks allow the management vlan plus the cluster-specific pair of vlans pass.

Only servers (again on their own vlans (1 for infrastructure such as Ad, dns, wins/dhcp, one for exchange, one for dbs etc) are allowed to connect directly to the 6950's on a seperate GB blade so all my 'user' vlans connect by trunbk ports - no switch port modes.


Bottom line, with a few differences we seem to be doing the same thing. If you can wait till tomorrow, unless someomne or yourself comes up with a brainwave, I'll pull my config.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20361998
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20362000
Also, you might want to think about bumping the debug on temporarily on the router - have you got a syslog running? Anything seen there?
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362034
No syslog running on it, but i will set one up and let you know how it goes..

thanks soo much for all your help and support.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20362059
Ah - OK - looks like I have given you corresponding info to what has alreaddy been passed at you by Toniur..

Also, do you have access to the 2003 resource kit etc? items such as netmon?
He is correct in what he says though. i also think wins is working to a fashion.

I would be interested to see what happens if you created an lmhosts entry on one of the clients - if you put in the Master Browser entry for example for the Domain and the server using the #PRE and #DOM conventions, does that then allow you to browse OK?- as i said at the beginning, your config looks very similar to mine but i need to check it from my consoles

0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362069
should i do the lmhosts on one host per subnet? or just on the WINS svr?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362109
192.168.204.2   server1  #PRE #DOM:domain.local
192.168.204.2   "domain         \0x1b"   #PRE
192.168.202.3   host000450  #PRE  


this is what i put in the host file. 202.3 is a host on a different subnet than me. it now shows me the host w/ nbtstat -c  - however it still doesn't like the 'net view 192.168.202.3' still gives me error 53

is this the correct way to do the lmhosts? go to sleep and let me know if i should change something tomorrow.

thanks again.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20362137
No, the lmhosts file goes on the client workstation only but I normally put the wins server in as a name/ip (if the wins/dhcp is not the DC anyway).

Sorry to sound patronising but make sure you don't save it with the .sam or a .txt extension. Also, because this file is only read and power up (not at logon time), you will need to reboot the client PC.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20362154
I just picked up on your earlier comnment that you CAN browse the servers vlan as well as the local vlan simultaneously so cross vlan-browsing is actually working but not as expected. Sorry, I missed that.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20362172
What node type have you put in the wins 0465 entry?   P or H?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362204
What node type have you put in the wins 0465 entry?   P or H?   <--- where can i find P or H?

is this a dhcp scope option?

for option "045 NetBIOS over TCP/IP NBDD - should i have this option set with the WINS server address for the value?

For number "046" WINS/NBT Node Type - they are all set as 0x8 = H

what is the difference with P or H?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362217
is the lmhosts look correct? the 204.2 is the Domain controller.
0
 
LVL 51

Assisted Solution

by:Keith Alabaster
Keith Alabaster earned 250 total points
ID: 20362230
lol - the 046 entry I can't remember the number in the 046 for the P-type but yeah - bed - back tomorrow :)

Night
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20362269
i changed all of them to P type... which is point-to-point with the WINS i guess. i had it on H which queried DNS, etc.
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20367263
Did you get a chance to look at what node type you are using or if anything is different with your sw config?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20367276
I also see option 027 which says "all clients are local" and 028 where you can specify a broadcast address. Should i try and add 192.168.255.255 to that?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20367295
In my DNS i only have reverse lookup zones for all the pc's on my network. Do I need to create forward zones for each subnet as well?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20368778
hello?
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20369038
From a host on the 203 subnet, i tried this: \\192.168.202.13 and Windows Vista told me this:

Windows confirmed that 192.168.202.13 is currently online, but is not responding to connection attempts at this time. This usually means that a firewall is running somewhere between the two computers and is blocking "File and printer sharing (SMB)" Windows has confirmed that Windows Firewall on this computer is correctly configured to allow this connection, however a remote firewall might be blocking your connection.

If you have access to this firewall, then configure the firewall to allow connections through tcp port 445. If you don't have access, contact your network administrator.

I opened cmd and did a 'telnet 192.168.202.13 445'  - no connection

i went on the 202.0 subnet and did the same thing - the connection opened immediately.

There is no firewall in between any of these devices. Just one 3560 switch which has some vlans and is routing for them. The telnet test tells me that everything is working fine, but the switch is not forwarding traffic on port 445. I have added ip forward-protocol udp 445 to the config on the switch, but the error the Vista box gave me says it needs TCP 445 opened.

Isn't this turned on by default? How can I make sure that port 445 traffic is getting through the switch? Maybe I need to reboot it?
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20395301
Hi Jayson, been in bed with man flu and such stuff. Am back at work tomorrow so haven't forgotten you....
0
 
LVL 1

Author Comment

by:jaysonfranklin
ID: 20502311
Not sure what happened... but for a little over a week now I've been able to see every computer in my network places as well as net view them all... i think the resolution was a combination of a couple things.. one being the dhcp scope. Also, the .adm file was messed up on the windows firewall gpo as it gave me an error when trying to view it... re-set up the gpo for that to allow file and print sharing... also, added WINS server to the domain controller and added that IP as an IP helper-address then told that server to pull wins info from the other wins server... i dunno but its working great now. Thanks a bunch guys for all your help!!!!!

Merry Christmas and Happy New Year!!!!!
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 20502761
You too Jayson and well done :)
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now