• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1047
  • Last Modified:

network routing, Cisco catalyst, 4507, VLAN

Hi folks,

I connected two networks by running a a cable from one layer 3 switch to the router on the other network.
added the needed routing rules and set up the correct vlans.
From the catalyst 4507 i can hit every IP on the other network with no problems.  From some reason the computers connected to the 4507 i cant hit anything.

Any ideas?
0
vburshteyn
Asked:
vburshteyn
  • 8
  • 5
  • 4
  • +2
1 Solution
 
Ernie BeekCommented:
Is there a route on the computers to the other network through the ip of the 4507?
0
 
JoshuaJECommented:
vburshteyn,

You need to create a gateway for your computers access VLAN.

int vlan x
ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
no shut

Then you need to configure your computers to not only use an IP and subnet mask, but also the default-gateway you just created, so that your computers know where to send information bound for a remote subnet.

As long as your 4500 has a route for a remote subnet, any computer that can reach their default gateway will be able to also reach the remote subnets.
0
 
vburshteynAuthor Commented:
hmmm i tried adding the second gateway and such but cant get it to work, any chance you can point me in the right direction?
0
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

 
JoshuaJECommented:
We need your configuration to see what's going on.
0
 
vburshteynAuthor Commented:
sorry, i mean to say my vlan is configured on the 4507


interface Vlan40
 ip address 10.60.1.1 255.255.255.0


sho ip int brief
Vlan40                 10.60.1.1       YES manual up                    up

sho ip route:

     172.17.0.0/24 is subnetted, 2 subnets
C       172.17.30.0 is directly connected, Vlan2
C       172.17.20.0 is directly connected, Vlan1
     10.0.0.0/24 is subnetted, 3 subnets
S       10.59.1.0 is directly connected, Vlan40
C       10.60.1.0 is directly connected, Vlan40
S       10.234.1.0 is directly connected, Vlan40
S*   0.0.0.0/0 [1/0] via 172.17.20.1

so 10.60.1.1 is the 4507 side ip, and 10.60.1.10 is the router side.  From the 4507 i can ping everything.  From my desktop i can ping the 10.60.1.1 but not the router side 10.60.1.10.







0
 
JoshuaJECommented:
You need to change your default route to:

ip route 0.0.0.0 0.0.0.0 10.60.1.10
0
 
JoshuaJECommented:
Alright my friend,

Please paste your entire configuration so we can get this solved for you.

please give us the command output for "show run" as well, thanks.
0
 
vburshteynAuthor Commented:
here is all the relevant info.

Current configuration : 114152 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime
no service password-encryption
service compress-config
service sequence-numbers
!
hostname BW4507
!
boot-start-marker
boot-end-marker
!
logging event link-status global
logging event trunk-status global
enable secret 5 $1$..TJ$eVZs7a9JgfF2SAJgEQvzH/
!
no aaa new-model
qos
qos dbl
qos map dscp 24 25 26 27 28 29 30 31 to tx-queue 4
qos map dscp 32 33 34 35 36 37 38 39 to tx-queue 4
qos map cos 3 to dscp 26
qos map cos 5 to dscp 46
ip subnet-zero
!
vtp domain cisco
vtp mode transparent
!
!
!
power redundancy-mode redundant
!
redundancy
 mode sso
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 2
 name VoiceVLAN
!
vlan 40
!

interface GigabitEthernet7/21
!
interface GigabitEthernet7/22
!
interface GigabitEthernet7/23
 switchport access vlan 40
 switchport mode dynamic desirable
!
interface GigabitEthernet7/24
!
interface GigabitEthernet7/36
!
interface GigabitEthernet7/37
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 2
 switchport mode trunk
 switchport nonegotiate
 qos trust dscp
 macro description cisco-router | cisco-router
 auto qos voip trust
 tx-queue 3
   bandwidth percent 33
   priority high
   shape percent 33
 spanning-tree portfast
 spanning-tree bpduguard enable
 service-policy output autoqos-voip-policy

!
interface Vlan1
 ip address 172.17.20.2 255.255.255.0
!
interface Vlan2
 ip address 172.17.30.2 255.255.255.0
!
interface Vlan10
 description baa
 no ip address
!
!
interface Vlan40
 ip address 10.60.1.1 255.255.255.0
!
interface Vlan50
 no ip address
 shutdown
!
ip route profile
ip route 0.0.0.0 0.0.0.0 172.17.20.1 permanent
ip route 10.59.1.0 255.255.255.0 Vlan40
ip route 10.60.1.0 255.255.255.0 Vlan40
ip route 10.234.1.0 255.255.255.0 Vlan40
ip http server
!
!
!
snmp-server community Br0adway1 RO
!
control-plane
!
!
line con 0
 stopbits 1
line vty 0 4
 password
 login
 length 0
!
end

BW4507#
0
 
602650528Commented:
This configure looks wrong and confusing .

1. You didn't tell us exactly what subnet on the other side you are trying to ping.
2. You didn't tell us what subnet or vlan are these computers (you referred to in  your question) conencted to.
3. I don't see how several subnet 10.59.1.0, 10.60.1.0 and 10.234.1.0 would be in vlan 40 and be able to communicate with the SVI of vlan 40 on subnet 10.60.1.1. The only computers in vlan 40 able to speak with SVI 10.60.1.1 is the computers on subnet 10.60.1.0 using 10.60.1.1 as its gateway and therefore has any chance of talking to any other side. Computers in 10.59.1.0 and 10.234.1.0 can talk to 10.60.1.1 within same vlan.

So please clarify;
what subnet on other side
what subnet and vlan  is your computer on the 4507
0
 
vburshteynAuthor Commented:
ok sorry about that.

on 4507
vlan 1 (172.17.20.0) is general vlan and goes out via 172.17.20.1  -- this is where the computer in question is in.

vlan 2  (172.17.30.0) is voice and goes out via 172.17.20.1

subnets 10.59.1.0 and 10.60.1.0 will go to the router via vlan 40.

0
 
602650528Commented:
from your submission above, the computer would have an ip address in subnet 172.17.20.0 with a gateway
of 172.17.20.1. You are trying to ping an device  10.60.1.10. Now please confirm the follow;

1. The computer must be plugged into a port in vlan 1.
2. Default gateway on the computer must be 172.17.20.1
3. Device 10.60.1.10 must be plugged into a port in vlan 40
4. Device 10.60.1.10 must be configured with a default gateway 10.60.1.1 or if it is a network device , it must have a static route point to 172.17.20.0 using 10.60.1.1 as the gateway.
0
 
vburshteynAuthor Commented:
1. yes
2. no its 172.17.20.2  which is the ip of the 4507.
3. 10.60.1.10 is the ip on the eth0/1 interface on the router of the second network i am conectecting too.
10.
4. yes


here is the thing. when i am in the 4507 i can ping all the subnets and devices connected to them.  Yet, the pc on 4507 with the ip of 172.17.20.125 cant ping the 10.x.x.x subnets.
0
 
602650528Commented:
Hi, Haven gone through your config now, this is a layer 3 switch and it looks like you have not enable routing on the switch. On the global config, can you add the command ;

ip routing

0
 
vburshteynAuthor Commented:
its enabled.
0
 
602650528Commented:
Can i see the config on this router where you have the 10.60.1.10  and pls specify what the connection between the 4507 and the router is . trunk ?
0
 
JoshuaJECommented:
Sir, if you would please post ALL of your configuration
0
 
arasmyCommented:
Hi vburshteyn,

Sorry man but this is a total mess.

what are these routes?
ip route 10.59.1.0 255.255.255.0 Vlan40
ip route 10.60.1.0 255.255.255.0 Vlan40
ip route 10.234.1.0 255.255.255.0 Vlan40

first of all the second route does not make sense because it's vlan 40 already
the others are also pretty strange, you don't point a static route to a vlan unless you weren't directly connected to a layer 3 port, because this will cause all traffic to flow throw all ports assigned to vlan 40 witch will cause 2 problems, First the processing of unneeded traffic and Second is that anyone with a network sniffer can see the whole network traffic since it's all directed to vlan 40.

Best Regards

So here is my advice to get this working :
1- Remove all static routes(except the default GW route) and assign them to the routers int IP 10.60.1.10
2- Assign the port connected to the router to vlan 40 as an access port (remove the trunk and native vlan)
3- What I get about the topology is that your Internet GW is connected to the 4507 and that the networks behind the router are going to use this link, if this is correct you should assign a default route on the router pointing to the vlan 40 interfaces IP address
0
 
vburshteynAuthor Commented:
Arasmy, where were you a week ago :)

You could have saved me lots of trouble.  I inherited that.  Wound up doing is wiping out the whole thing and going from scratch, using the same approach.
0
 
arasmyCommented:
vburshteyn,
:)
You don't have to wipe out the whole thing just the routes

Regards,

0
 
vburshteynAuthor Commented:
ya i know.  Problem is there was so much crap in there, and i was starting over it with no knowledge transfer of any kind.

Easiest way to do it that way.
0
 
arasmyCommented:
vburshteyn,

By the way you are going to make a sub interface on the router with dot1q encapsulation to vlan 40 and the same IP address you are using now on the main interface

Regards
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

  • 8
  • 5
  • 4
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now