Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Not able to ping DMZ port on Firewall from the switch.

Posted on 2016-07-15
Medium Priority
Last Modified: 2016-07-17
On firewall, the DMZ2 port connects to ColoC3750X switch on Gi2/0/21 while the LAN port to Winston-3750sw switch Gi1/0/1, as shown on the attached diagram and the config files. There is a trunking connection between the two switches.

The big big issue is, from the ColoC3750X switch, we are NOT able to ping the DMZ2 port IP (But from Winton-3750sw, we are able to ping both and

Can you please figure what I missed out?
Question by:Castlewood
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
  • 2
  • +2

Expert Comment

ID: 41713164
What does "show interface vlan 102" show?
Maybe you didn't create the vlan in the vlan-database and the interface is down?

Author Comment

ID: 41713172
vlan102 should be up. See the result:

ColoC3750X#sh interface vlan 102
Vlan102 is up, line protocol is up
  Hardware is EtherSVI, address is 4403.a749.b345 (bia 4403.a749.b345)
  Internet address is
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not supported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:57, output 00:12:56, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     16993 packets input, 2604456 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     675 packets output, 45418 bytes, 0 underruns
     0 output errors, 1 interface resets
     0 output buffer failures, 0 output buffers swapped out

Assisted Solution

mrworta earned 500 total points
ID: 41713214
Does the firewall show up in the arp table of the colo switch? (sw ip arp)
Maybe the Firewall is set not to answer ping on the DMZ interface...?
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.


Author Comment

ID: 41713266
As earlier mentioned, the other switch (Winston-3750sw) is able to ping the DMZ interface without a problem.
Here is the result for sh ip arp: ( is the DMZ interface ip. Is everything ok?)

ColoC3750X#sh ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet               -   4403.a749.b345  ARPA   Vlan102
Internet               -   4403.a749.b343  ARPA   Vlan60
Internet               -   4403.a749.b341  ARPA   Vlan40
Internet              36   001e.c9b2.788b  ARPA   Vlan102
Internet               -   4403.a749.b342  ARPA   Vlan50
Internet               73   0022.91b8.5bc8  ARPA   Vlan100
Internet             184   0cc4.7a53.9ec9  ARPA   Vlan50
Internet               1   0cc4.7a1f.30ec  ARPA   Vlan50
Internet               2   0022.91b8.5bc8  ARPA   Vlan100
Internet           138   0015.5d02.f609  ARPA   Vlan102
Internet              -   4403.a749.b344  ARPA   Vlan100

Expert Comment

ID: 41713315
I do not see an arp for when you do the ping did you try sourcing it from VLAN102 you shouldn't have too, but worth a try.  

As for why the other switch can ping the IP Address by the diagram it is going through the firewall to do so, not via the other switch since 102 is not carried on the trunk and it doesn't have an interface in that vlan.

on the ColoC3750X

can you also do a show VLAN
and sho arp dyn int g2/0/21


Author Comment

ID: 41713352
"I do not see an arp for" ?  Didn't you see it listed? The fourth from the top. Isn't it for

How to ping with sourcing from VLAN102?

Here is the result of sh vlan:
ColoC3750X#sh vlan
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active
10   VLAN0010                         active
20   VLAN0020                         active
30   VLAN0030                         active    Gi1/0/20, Gi1/0/21, Gi1/0/22, Gi2/0/20, Gi2/0/22
40   VLAN0040                         active    Gi1/0/15, Gi1/0/16, Gi1/0/17, Gi1/0/18, Gi1/0/19, Gi2/0/15, Gi2/0/16, Gi2/0/17, Gi2/0/18, Gi2/0/19
50   VLAN0050                         active    Gi1/0/1, Gi1/0/2, Gi2/0/1, Gi2/0/2
60   VLAN0060                         active    Gi1/0/5, Gi1/0/6, Gi1/0/7, Gi1/0/8, Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi2/0/5, Gi2/0/6, Gi2/0/7, Gi2/0/8, Gi2/0/9, Gi2/0/10, Gi2/0/11
                                                Gi2/0/12, Gi2/0/13, Gi2/0/14
100  VLAN0100                         active
101  VLAN0101                         active
102  Vlan102                          active    Gi1/0/3, Gi1/0/4, Gi2/0/3, Gi2/0/4, Gi2/0/21
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1    enet  100001     1500  -      -      -        -    -        0      0
10   enet  100010     1500  -      -      -        -    -        0      0
20   enet  100020     1500  -      -      -        -    -        0      0
30   enet  100030     1500  -      -      -        -    -        0      0
40   enet  100040     1500  -      -      -        -    -        0      0
50   enet  100050     1500  -      -      -        -    -        0      0
60   enet  100060     1500  -      -      -        -    -        0      0
100  enet  100100     1500  -      -      -        -    -        0      0
101  enet  100101     1500  -      -      -        -    -        0      0
102  enet  100102     1500  -      -      -        -    -        0      0
1002 fddi  101002     1500  -      -      -        -    -        0      0
1003 tr    101003     1500  -      -      -        -    srb      0      0
1004 fdnet 101004     1500  -      -      -        ieee -        0      0
1005 trnet 101005     1500  -      -      -        ibm  -        0      0

"sho arp dyn int g2/0/21" is not a valid command.

Expert Comment

ID: 41713392
#1 you are correct I am blind
#2 ping x.x.x.x source vlan 102
#3 sorry again thinking to fast it is sho mac add dyna int g2/0/21
LVL 14

Assisted Solution

SIM50 earned 500 total points
ID: 41713405
Check your firewall logs if it is dropping your pings from the colo switch.
LVL 31

Accepted Solution

Predrag earned 1000 total points
ID: 41713423
Internet              36   001e.c9b2.788b  ARPA   Vlan102
If you are not able to ping it from the ColoC3750X that simply means that Firewall is set not to respond to pings as Sim50 already wrote. You have basic connectivity (what is security level on firewall set on that interface?).
If you are trying to ping DMZ from devices that are placed in other VLANs and you are using ColoC3750X  as default gateway - you do not have routing enabled. Since it is directly connected interface from switch ColoC3750X you should be able to ping ip address, especially since you have mac address in CAM table.
LVL 31

Expert Comment

ID: 41713454
Also, any particular reason for this?
hostname ColoC3750X

interface Vlan40
 ip address
interface Vlan50
 ip address
interface Vlan60
 ip address
interface Vlan100
 ip address

hostname Winston-3750sw

interface Vlan40
 ip address
interface Vlan50
 ip address
interface Vlan60
 ip address
interface Vlan100
 ip address
I mean, except wasting few IP addresses?
If hosts are not configured to use both SVIs as default gateway (distribute traffic load between switches or whatever) it just creates confusion.

Author Closing Comment

ID: 41716179
The DMZ2 interface on firewall was newly created so no rules at all. As the result, no incoming traffic allowed. That is why.
Thanks you guys.

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question