Solved

network routing, Cisco catalyst, 4507, VLAN

Posted on 2011-03-22
21
1,036 Views
Last Modified: 2012-06-21
Hi folks,

I connected two networks by running a a cable from one layer 3 switch to the router on the other network.
added the needed routing rules and set up the correct vlans.
From the catalyst 4507 i can hit every IP on the other network with no problems.  From some reason the computers connected to the 4507 i cant hit anything.

Any ideas?
0
Comment
Question by:vburshteyn
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 5
  • 4
  • +2
21 Comments
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 35190290
Is there a route on the computers to the other network through the ip of the 4507?
0
 
LVL 4

Expert Comment

by:JoshuaJE
ID: 35190487
vburshteyn,

You need to create a gateway for your computers access VLAN.

int vlan x
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
no shut

Then you need to configure your computers to not only use an IP and subnet mask, but also the default-gateway you just created, so that your computers know where to send information bound for a remote subnet.

As long as your 4500 has a route for a remote subnet, any computer that can reach their default gateway will be able to also reach the remote subnets.
0
 

Author Comment

by:vburshteyn
ID: 35191604
hmmm i tried adding the second gateway and such but cant get it to work, any chance you can point me in the right direction?
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 4

Expert Comment

by:JoshuaJE
ID: 35191678
We need your configuration to see what's going on.
0
 

Author Comment

by:vburshteyn
ID: 35191731
sorry, i mean to say my vlan is configured on the 4507


interface Vlan40
 ip address 10.60.1.1 255.255.255.0


sho ip int brief
Vlan40                 10.60.1.1       YES manual up                    up

sho ip route:

     172.17.0.0/24 is subnetted, 2 subnets
C       172.17.30.0 is directly connected, Vlan2
C       172.17.20.0 is directly connected, Vlan1
     10.0.0.0/24 is subnetted, 3 subnets
S       10.59.1.0 is directly connected, Vlan40
C       10.60.1.0 is directly connected, Vlan40
S       10.234.1.0 is directly connected, Vlan40
S*   0.0.0.0/0 [1/0] via 172.17.20.1

so 10.60.1.1 is the 4507 side ip, and 10.60.1.10 is the router side.  From the 4507 i can ping everything.  From my desktop i can ping the 10.60.1.1 but not the router side 10.60.1.10.







0
 
LVL 4

Expert Comment

by:JoshuaJE
ID: 35191757
You need to change your default route to:

ip route 0.0.0.0 0.0.0.0 10.60.1.10
0
 
LVL 4

Expert Comment

by:JoshuaJE
ID: 35191785
Alright my friend,

Please paste your entire configuration so we can get this solved for you.

please give us the command output for "show run" as well, thanks.
0
 

Author Comment

by:vburshteyn
ID: 35191869
here is all the relevant info.

Current configuration : 114152 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service compress-config
service sequence-numbers
!
hostname BW4507
!
boot-start-marker
boot-end-marker
!
logging event link-status global
logging event trunk-status global
enable secret 5 $1$..TJ$eVZs7a9JgfF2SAJgEQvzH/
!
no aaa new-model
qos
qos dbl
qos map dscp 24 25 26 27 28 29 30 31 to tx-queue 4
qos map dscp 32 33 34 35 36 37 38 39 to tx-queue 4
qos map cos 3 to dscp 26
qos map cos 5 to dscp 46
ip subnet-zero
!
vtp domain cisco
vtp mode transparent
!
!
!
power redundancy-mode redundant
!
redundancy
 mode sso
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 2
 name VoiceVLAN
!
vlan 40
!

interface GigabitEthernet7/21
!
interface GigabitEthernet7/22
!
interface GigabitEthernet7/23
 switchport access vlan 40
 switchport mode dynamic desirable
!
interface GigabitEthernet7/24
!
interface GigabitEthernet7/36
!
interface GigabitEthernet7/37
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 2
 switchport mode trunk
 switchport nonegotiate
 qos trust dscp
 macro description cisco-router | cisco-router
 auto qos voip trust
 tx-queue 3
   bandwidth percent 33
   priority high
   shape percent 33
 spanning-tree portfast
 spanning-tree bpduguard enable
 service-policy output autoqos-voip-policy

!
interface Vlan1
 ip address 172.17.20.2 255.255.255.0
!
interface Vlan2
 ip address 172.17.30.2 255.255.255.0
!
interface Vlan10
 description baa
 no ip address
!
!
interface Vlan40
 ip address 10.60.1.1 255.255.255.0
!
interface Vlan50
 no ip address
 shutdown
!
ip route profile
ip route 0.0.0.0 0.0.0.0 172.17.20.1 permanent
ip route 10.59.1.0 255.255.255.0 Vlan40
ip route 10.60.1.0 255.255.255.0 Vlan40
ip route 10.234.1.0 255.255.255.0 Vlan40
ip http server
!
!
!
snmp-server community Br0adway1 RO
!
control-plane
!
!
line con 0
 stopbits 1
line vty 0 4
 password
 login
 length 0
!
end

BW4507#
0
 
LVL 6

Expert Comment

by:602650528
ID: 35197379
This configure looks wrong and confusing .

1. You didn't tell us exactly what subnet on the other side you are trying to ping.
2. You didn't tell us what subnet or vlan are these computers (you referred to in  your question) conencted to.
3. I don't see how several subnet 10.59.1.0, 10.60.1.0 and 10.234.1.0 would be in vlan 40 and be able to communicate with the SVI of vlan 40 on subnet 10.60.1.1. The only computers in vlan 40 able to speak with SVI 10.60.1.1 is the computers on subnet 10.60.1.0 using 10.60.1.1 as its gateway and therefore has any chance of talking to any other side. Computers in 10.59.1.0 and 10.234.1.0 can talk to 10.60.1.1 within same vlan.

So please clarify;
what subnet on other side
what subnet and vlan  is your computer on the 4507
0
 

Author Comment

by:vburshteyn
ID: 35197457
ok sorry about that.

on 4507
vlan 1 (172.17.20.0) is general vlan and goes out via 172.17.20.1  -- this is where the computer in question is in.

vlan 2  (172.17.30.0) is voice and goes out via 172.17.20.1

subnets 10.59.1.0 and 10.60.1.0 will go to the router via vlan 40.

0
 
LVL 6

Expert Comment

by:602650528
ID: 35197984
from your submission above, the computer would have an ip address in subnet 172.17.20.0 with a gateway
of 172.17.20.1. You are trying to ping an device  10.60.1.10. Now please confirm the follow;

1. The computer must be plugged into a port in vlan 1.
2. Default gateway on the computer must be 172.17.20.1
3. Device 10.60.1.10 must be plugged into a port in vlan 40
4. Device 10.60.1.10 must be configured with a default gateway 10.60.1.1 or if it is a network device , it must have a static route point to 172.17.20.0 using 10.60.1.1 as the gateway.
0
 

Author Comment

by:vburshteyn
ID: 35198215
1. yes
2. no its 172.17.20.2  which is the ip of the 4507.
3. 10.60.1.10 is the ip on the eth0/1 interface on the router of the second network i am conectecting too.
10.
4. yes


here is the thing. when i am in the 4507 i can ping all the subnets and devices connected to them.  Yet, the pc on 4507 with the ip of 172.17.20.125 cant ping the 10.x.x.x subnets.
0
 
LVL 6

Expert Comment

by:602650528
ID: 35200115
Hi, Haven gone through your config now, this is a layer 3 switch and it looks like you have not enable routing on the switch. On the global config, can you add the command ;

ip routing

0
 

Author Comment

by:vburshteyn
ID: 35200177
its enabled.
0
 
LVL 6

Expert Comment

by:602650528
ID: 35200401
Can i see the config on this router where you have the 10.60.1.10  and pls specify what the connection between the 4507 and the router is . trunk ?
0
 
LVL 4

Expert Comment

by:JoshuaJE
ID: 35200474
Sir, if you would please post ALL of your configuration
0
 
LVL 1

Accepted Solution

by:
arasmy earned 500 total points
ID: 35299431
Hi vburshteyn,

Sorry man but this is a total mess.

what are these routes?
ip route 10.59.1.0 255.255.255.0 Vlan40
ip route 10.60.1.0 255.255.255.0 Vlan40
ip route 10.234.1.0 255.255.255.0 Vlan40

first of all the second route does not make sense because it's vlan 40 already
the others are also pretty strange, you don't point a static route to a vlan unless you weren't directly connected to a layer 3 port, because this will cause all traffic to flow throw all ports assigned to vlan 40 witch will cause 2 problems, First the processing of unneeded traffic and Second is that anyone with a network sniffer can see the whole network traffic since it's all directed to vlan 40.

Best Regards

So here is my advice to get this working :
1- Remove all static routes(except the default GW route) and assign them to the routers int IP 10.60.1.10
2- Assign the port connected to the router to vlan 40 as an access port (remove the trunk and native vlan)
3- What I get about the topology is that your Internet GW is connected to the 4507 and that the networks behind the router are going to use this link, if this is correct you should assign a default route on the router pointing to the vlan 40 interfaces IP address
0
 

Author Comment

by:vburshteyn
ID: 35299456
Arasmy, where were you a week ago :)

You could have saved me lots of trouble.  I inherited that.  Wound up doing is wiping out the whole thing and going from scratch, using the same approach.
0
 
LVL 1

Expert Comment

by:arasmy
ID: 35299503
vburshteyn,
:)
You don't have to wipe out the whole thing just the routes

Regards,

0
 

Author Comment

by:vburshteyn
ID: 35299516
ya i know.  Problem is there was so much crap in there, and i was starting over it with no knowledge transfer of any kind.

Easiest way to do it that way.
0
 
LVL 1

Expert Comment

by:arasmy
ID: 35299522
vburshteyn,

By the way you are going to make a sub interface on the router with dot1q encapsulation to vlan 40 and the same IP address you are using now on the main interface

Regards
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question