Link to home
Start Free TrialLog in
Avatar of Brian
BrianFlag for United States of America

asked on

Unable to reach an IP located on a Dell switch from an HP switch

So we have an HP 8212zl core switch and we are transitioning to a Dell N4000 series switch.  The Dell switch is in vlan 1000 and I can reach it from devices connected to the HP switch.  On the Dell switch, I have a vlan 109 and the config for the vlans looks like this on the Dell...

interface vlan 109
ip address 10.0.109.1 255.255.255.0
ip helper-address 10.16.10.22
exit
interface vlan 1000
ip address 10.0.0.2 255.255.254.0
exit

On the HP, I do not have vlan 109, but I have this static route...

 Destination        Gateway         VLAN    Type      Metric     Dist.
  ------------------ ---------------              ----    ---------    ---------- ----------
  0.0.0.0/0          10.16.10.3               1    static               1          1
  10.0.109.0/24      10.0.0.2        1000    static               1          1

If I do a traceroute from the HP to 10.0.109.1, it fails immediately... doesn't even make the hop to 10.0.0.2.  If I do a traceroute from the HP to 10.0.0.2 (which is the Dell switch where vlan 109 resides and is connected directly to the HP), that works fine.  What am I doing wrong?
Avatar of Brian
Brian
Flag of United States of America image

ASKER

I ran a "show ip route" to see both static and connected routes.  After doing this, I am now able to ping 10.0.109.1 from the HP switch.  The vlan did once reside on the HP switch and I did delete it today.  Maybe I needed to clear arp cache on the HP?  I still cannot ping 10.0.109.1 from a workstation connect to the HP.  I tried clearing arp on the workstation (Windows 7), but a ping fails and a tracert stops at the HP switch.  Maybe I still need to clear arp on the HP switch?
Avatar of Brian

ASKER

Now it is back to NOT working when I ping 10.0.109.1 from the HP.  I did "clear arp" on the HP, but if anything, I would think that would have been helpful.
SOLUTION
Avatar of hypercube
hypercube
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Brian

ASKER

Both the HP 8212zl switch and the Dell N4000 are layer 3.  Eventually the HP will be replaced by the Dell.  Here is a diagram that I hope helps.
HP---Dell-switches.jpg
You have 10.0.0.1 set as the default route. usually, the 10.0.0.1 in a VLAN will reside on the router/firewall, but in your case it seems to be on the HP switch you will be replacing.
Do you have ACLs setup on the switches that deals with how inter-vlan flow will occur?
Quickly

On the Dell VLAN 109 10.0.190.1 or should it be 10.0.109.1???  Is that a typo or is that the actual setting?  Seems wrong.

On the HP the default route and gateway is     0.0.0.0/0          10.16.10.3               1    static               1          1
But you say on the HP diagram that the default route is to 172.16.10.3 (firewall)
These seem to conflict.
Avatar of Brian

ASKER

Arnold, once we are off the HP switch, the default route on the Dell N4000 switch will be our firewall to the internet (10.16.10.3) and no longer the 10.0.0.1.  We do not have ACLs, but we are able to get to all of our edge switches (in vlan 1000), which some are connected to the HP and some to the Dell N4000.  This is the reason I have the static route on the HP switch for vlan 109... so traffic bound for vlan 109 will be sent to the Dell N4000.  Traffic returning should find it's way because the default route is 10.0.0.1 (the HP switch).

Fred,
Sorry, those were typos.  I will upload again with corrections.
HP---Dell-switches.jpg
What routing rules do you have on the hp that deals with crossing vlan boundaries/passing ACL.

Do the vlans you have on the switches exist on the firewall?

Seems unnecessary to chain switches in such a way.
Connecting each switch to the firewall as well as between them would provide network resiliency ......

please post the hp's config and dells.
I don't see a route from the Dell to the HP.  Where is it?
The traceroute that fails has to have a return path....
They are on the same segment 10.0.0.0/23 vlan 1000.
Avatar of Brian

ASKER

From now on I will refer to the 8212 and the N4000 as the HP core and Dell core.

Arnold, there are no ACL's on the HP or Dell core.  There are ACL's on the firewall and we have static routes on the firewall for each vlan; however, the firewall is irrelevant in this case.  The firewall is only dealing with traffic to and from the outside world (the internet).  To keep this on the right path and to avoid overcomplicating the issue, let's assume there is no firewall and the network is internal with no access to the outside world.

Fred, as Arnold stated, both the HP and Dell are in vlan 1000.  Here's my line of thinking.  The ICMP request for IP 10.0.109.1 reaches the HP core.  Because it has a static route of 10.0.109.0/24 10.0.0.2, it sends the request to the Dell core (10.0.0.2).  10.0.109.1 is on the Dell core, so the Dell replies back using the default gateway (10.0.0.1, which is the HP core) because the request came from vlan 80, which is not on the Dell core.   It all seems to make sense to me, but my thinking must be flawed.

I'm wondering if the issue might be due to vlan 1000 residing on both switches, but I don't think it would work without the two switches sharing a vlan.
without routing rulers/acl 10.0.0.0/23 will flow, but traffic to 10.109.0/24 ight flow, but the response will not be able to reach since 10.0.0.1/24 is not an available path on 10.0.109.0/24
Avatar of Brian

ASKER

Just to clarify, it's 10.0.0.1/23.  How would I give 10.0.109.0/24 an available path to 10.0.0.1/23?  I thought that path would be available to vlan 109 given that the default gateway on the Dell core is 10.0.0.1.
A default path must be on a segment that the device has access to. 10.0.109.0/24 has no path to 10.0.0.1/23
I.e. The 10.0.109.1 is an ip on the vlan 109 on the hp 4000 switch since it has a trunk connection it needs an ip on the vlan 1000 or at least a routing table handling the inter vlan transition.
so that it could route 10.0.109.0/24 via an ip it has on vlan 1000 at which point it can route out.
Avatar of Brian

ASKER

Do you mean the Dell 4000?  vlan 109 is on the Dell, not the HP.  I think I understand now.  The Dell will try to send it with a tag for vlan 109 and the HP doesn't know what to do with it because vlan 109 doesn't exist on the HP, correct?
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Brian

ASKER

All of our edge switches (which are stacked in the wiring closets) are connected to the HP core (each wiring closet has a direct fiber run back to the core).  The core switch is the only switch connected to the firewall.  I find it odd that you would see this as strange given that I have seen it done this way often in different organizations over the years.  Also, whenever I see firewall diagrams, it is often this scenario that is illustrated (like in the diagrams below).
Diagram1
Diagram2
Diagram3

I went with your first suggestion of adding vlan 109 back to the HP.  From now on, I will keep the vlans on the HP until all vlans have been brought over to the new core, then I will decommission the HP core.  Thanks for your help!
It is fine when you have a single switch to connect all clients connected to the one switch.
Older firewalls often only had two ports, Untrust/trusts such. Where core switch ...while there are more ports on new firewall those ports are still voluble.
Depending on your environment building in redundancy to avoid having exposure to failure should an issue arise with the switch or trunk feed port failure....