Not able to ping DMZ port on Firewall from the switch.
On firewall, the DMZ2 port connects to ColoC3750X switch on Gi2/0/21 while the LAN port to Winston-3750sw switch Gi1/0/1, as shown on the attached diagram and the config files. There is a trunking connection between the two switches.
The big big issue is, from the ColoC3750X switch, we are NOT able to ping the DMZ2 port IP 10.10.2.1. (But from Winton-3750sw, we are able to ping both 10.10.2.1 and 10.10.2.2.)
As earlier mentioned, the other switch (Winston-3750sw) is able to ping the DMZ interface without a problem.
Here is the result for sh ip arp: (10.10.2.1 is the DMZ interface ip. Is everything ok?)
ColoC3750X#sh ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.2.2 - 4403.a749.b345 ARPA Vlan102
Internet 10.2.6.14 - 4403.a749.b343 ARPA Vlan60
Internet 10.2.4.14 - 4403.a749.b341 ARPA Vlan40
Internet 10.10.2.1 36 001e.c9b2.788b ARPA Vlan102
Internet 10.2.5.14 - 4403.a749.b342 ARPA Vlan50
Internet 10.2.0.1 73 0022.91b8.5bc8 ARPA Vlan100
Internet 10.2.5.20 184 0cc4.7a53.9ec9 ARPA Vlan50
Internet 10.2.5.18 1 0cc4.7a1f.30ec ARPA Vlan50
Internet 10.0.6.57 2 0022.91b8.5bc8 ARPA Vlan100
Internet 10.10.2.141 138 0015.5d02.f609 ARPA Vlan102
Internet 10.2.0.199 - 4403.a749.b344 ARPA Vlan100
I do not see an arp for 10.10.2.1 when you do the ping did you try sourcing it from VLAN102 you shouldn't have too, but worth a try.
As for why the other switch can ping the IP Address by the diagram it is going through the firewall to do so, not via the other switch since 102 is not carried on the trunk and it doesn't have an interface in that vlan.
on the ColoC3750X
can you also do a show VLAN
and sho arp dyn int g2/0/21
Thanks
Castlewood
ASKER
"I do not see an arp for 10.10.2.1" ? Didn't you see it listed? The fourth from the top. Isn't it for 10.10.2.1?
How to ping with sourcing from VLAN102?
Here is the result of sh vlan:
ColoC3750X#sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
10 VLAN0010 active
20 VLAN0020 active
30 VLAN0030 active Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi2/0/20, Gi2/0/22
40 VLAN0040 active Gi1/0/15, Gi1/0/16, Gi1/0/17, Gi1/0/18, Gi1/0/19, Gi2/0/15, Gi2/0/16, Gi2/0/17, Gi2/0/18, Gi2/0/19
50 VLAN0050 active Gi1/0/1, Gi1/0/2, Gi2/0/1, Gi2/0/2
60 VLAN0060 active Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi2/0/5, Gi2/0/6, Gi2/0/7, Gi2/0/8, Gi2/0/9, Gi2/0/10, Gi2/0/11
Gi2/0/12, Gi2/0/13, Gi2/0/14
100 VLAN0100 active
101 VLAN0101 active
102 Vlan102 active Gi1/0/3, Gi1/0/4, Gi2/0/3, Gi2/0/4, Gi2/0/21
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
!
interface Vlan40
ip address 10.2.4.14 255.255.255.0
!
interface Vlan50
ip address 10.2.5.14 255.255.255.0
!
interface Vlan60
ip address 10.2.6.14 255.255.255.0
!
interface Vlan100
ip address 10.2.0.199 255.255.255.0
hostname Winston-3750sw
!
interface Vlan40
ip address 10.2.4.1 255.255.255.0
!
interface Vlan50
ip address 10.2.5.1 255.255.255.0
!
interface Vlan60
ip address 10.2.6.1 255.255.255.0
!
interface Vlan100
ip address 10.2.0.1 255.255.255.0
I mean, except wasting few IP addresses?
If hosts are not configured to use both SVIs as default gateway (distribute traffic load between switches or whatever) it just creates confusion.
Castlewood
ASKER
The DMZ2 interface on firewall was newly created so no rules at all. As the result, no incoming traffic allowed. That is why.
Thanks you guys.
Maybe you didn't create the vlan in the vlan-database and the interface is down?