4500 Not routing a subnet after Reboot -

The issue we're having is that the 4506 doesn't route traffic to one specific subnet properly. Traffic coming from subnet 172.30.30.0/24 on the 4506 side to 10.0.10.0/24 on the Nexus side should be routed through the port channel. We have a static ip route entry defining that. What is actually happening is the 4506 is routing traffic to 10.0.10.0/24 to the gateway of last resort. We can't figure out why.
Attached is the Config from the Nexus and 4506, and also a quick pdf of the topology.
Cisco-4506.txt
topo.jpg
Cisco-Nexus-5000.txt
LVL 1
Support EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Don JohnstonInstructorCommented:
I love it when the OP puts up relevant information!!!  Thank you!

First thing that jumps out at me is a discrepancy in the channel (not saying this is the cause, but it's definitely not right).  On the 4506, the allowed VLANs for port channel 50 include VLAN 11. On the N5K, it does not.

To the matter at hand, why do you say that the 4506 is forwarding them to 172.16.1.4?  According to your output, traffic is going to 10.0.9.2 and then dying there.

Are you having any of these problems with any other destinations behind the N5K?
0
Support EngineerAuthor Commented:
Currently there are not any issues with other destinations just this one. what would your recommendation be?
0
Don JohnstonInstructorCommented:
I don't see the issue you're describing.

Why do you say that the 4506 is forwarding them to 172.16.1.4?  According to your output, traffic is going to 10.0.9.2 and then dying there.
0
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

Support EngineerAuthor Commented:
We're thinking that the problem is on the 4506 because traceroutes go from the 4506 to the gateway of last resort. They're not hitting the Nexus. But if you see something that suggests the issue is with the Nexus, we have that on a Cisco maintenance contact and we can contact Cisco.


here is a trace route from each of the two systems

Tracing route to 10.0.10.103 over a maximum of 30 hops

  1     1 ms     2 ms     1 ms  172.30.30.1
  2     1 ms     1 ms     1 ms  66-193-133-129.static.tw [66.193.133.129]
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.
 13     *        *        *     Request timed out.
 14     *        *        *     Request timed out.
 15     *        *        *     Request timed out.
 16     *        *    

Tracing route to ads02.nu.com [172.30.35.23]
over a maximum of 30 hops:

  1     1 ms     1 ms     1 ms  172.30.30.1
  2    <1 ms    <1 ms    <1 ms  ads02.nwfcu.com [172.30.35.23]

Trace complete.
0
Don JohnstonInstructorCommented:
My confusion comes from your 4506 config post where on the bottom you have:

4506-01#traceroute 10.0.10.103

Type escape sequence to abort.
Tracing the route to 10.0.10.103

  1 10.0.9.2 12 msec 8 msec 4 msec
  2  *  *  * 
  3  *  *  * 
  4  *  *  * 
  5 
4506-01#
4506-01#ping 10.0.10.103

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.10.103, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
4506-01#

Open in new window


This shows that it was forwarded to the N5K

So I'm guessing that this latest traceroute was done from a workstation.

To your latest post, it shows a first hop of 172.30.30.1 which is the Virtual IP of an HSRP group.  

interface Vlan30
 ip address 172.30.30.3 255.255.255.0
 ip helper-address 172.30.35.22
 standby 0 ip 172.30.30.1

Open in new window


But I don't see any other switch that could be on that HSRP group. In fact, there are a bunch of SVI's with HSRP configurations.  So I'm guessing that there's another routing device that is an HSRP peer and maybe that device is misrouting the traffic?

All of this would indicate that pings from the 4506 work connectly but from a workstation they do not.  Which would lead me to think that this has something to do with HSRP.

Please post the output of a "show standby brief" from the 4506.
0
Support EngineerAuthor Commented:
4506-01#sh standby brief
                     P indicates configured to preempt.
                     |
Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl3         0    100   Active  local           unknown         172.30.3.1
Vl5         0    100   Standby 172.30.5.2      local           172.30.5.1
Vl10        0    90    Standby 172.30.10.2     local           172.30.10.1
Vl15        0    100   Active  local           172.30.15.2     172.30.15.1
Vl16        0    100   Standby 172.16.16.2     local           172.16.16.1
Vl20        0    90    Standby 172.30.20.2     local           172.30.20.1
Vl25        0    100   Active  local           172.30.25.2     172.30.25.1
Vl29        0    100   Init    unknown         unknown         172.29.30.1
Vl30        0    100   Standby 172.30.30.2     local           172.30.30.1
Vl35        0    100   Active  local           172.30.35.2     172.30.35.1
Vl40        0    90    Active  local           172.30.40.2     172.30.40.1
Vl45        0    100   Active  local           172.30.45.2     172.30.45.1
Vl50        0    90    Active  local           unknown         172.30.50.1
Vl70        0    100   Active  local           172.30.70.2     172.30.70.1
Vl95        0    100   Active  local           unknown         172.30.95.1
Vl100       0    100   Active  local           172.18.100.2    172.18.100.1
Vl102       0    100   Active  local           172.16.1.2      172.16.1.1
Vl139       0    100   Active  local           unknown         192.139.1.200
Vl192       0    100   Active  local           192.149.115.10  192.149.115.248
Vl200       0    100   Active  local           unknown         172.30.200.1
Vl900       0    100   Active  local           172.30.0.2      172.30.0.1
Vl901       0    100   Active  local           10.1.1.2        10.1.1.1
Vl902       0    100   Active  local           172.30.2.2      172.30.2.1
4506-01#
0
Don JohnstonInstructorCommented:
Yep, there's your problem... at least a clue as to the problem.

Interface   Grp  Pri P State   Active          Standby         Virtual IP
Vl30        0    100   Standby 172.30.30.2     local           172.30.30.1

Open in new window


Traffic from the 172.30.30.0 network is being forwarded by the 172.30.30.2 device.  Whatever that is.

Check the routing table, route maps, PBR, etc. on that device to why it's forwarding the traffic to the internet.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.