Avatar of huffmana
huffmana
Flag for United States of America asked on

Can't reach enclave switch on the MNGT network.

Created an enclave (192.168.170.0/24) on our office network using a Cisco 2921 and overload NAT to the ISP Firewall (192.168.168.1).  The enclave NAT works OK but I can't get the management network (10.10.10.0/27) out to the switch in the enclave.  I can't ping 10.10.10.11 even from the CORE switch.

See the attached diagram.  MNGT 10.10.10.0/27  OFFICE 192.168.168.0/24  ENCLAVE 192.168.170.0/24

  Network_Diagram.jpg
CiscoNetworking

Avatar of undefined
Last Comment
huffmana

8/22/2022 - Mon
Soulja

When you ping from the enclave router to 10.10.10.11, are you sourcing the ping from the enclave mgmt interface?
Andy Bartkiewicz

I believe you are having issues because of a Native vlan mismatch on 7 and 8. You've got vlan 200 as the native on 8 and vlan 1 as the native on 7.
huffmana

ASKER
$ ssh user@10.10.10.10
C
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit, authorized permission to access or configure this device.
Unauthorized attempts and actions to access or use this system may result in civil and/or criminal penalties.
All activities performed on this device are logged and monitored.
Password:

guestrtr1>en
Password:
guestrtr1#ping 10.10.10.11 source 10.10.10.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.11, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.10
.....
Success rate is 0 percent (0/5)
guestrtr1#
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Andy Bartkiewicz

Also you've got interface 9 setup as a trunk when I think it's supposed to be access
Steven Carnahan

What is the result of a trace route from the core switch to 10.10.10.11?
huffmana

ASKER
Tried the trunks with native 200 on both sides and with native 1 on both sides.... And it still doesn't ping....  How can the broadcast domain get interrupted between two switches connected by a trunk?  Maybe the vlans aren't allocated....
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
huffmana

ASKER
Int 9 is working as a trunk.  I thought that it would be more secure than a mode access....  I think that the Firewall is tagging it's port as vlan 200.  I don't have access to the Meraki router :-(  I'm afraid to change it....
ASKER CERTIFIED SOLUTION
Soulja

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
huffmana

ASKER
Got it, there was a port monitoring I forgot about!!!! All I had to do was look at UP/DOWN.

How stupid can I be - ignoring the obvious....

Thank you everyone....
Andy Bartkiewicz

Well your not tagging vlan 200 to the router, its native. That's probably why its working. I don't think thats more secure however. Are the vlans defined on both the core and etherswitch?
Your help has saved me hundreds of hours of internet surfing.
fblack61
huffmana

ASKER
It is so much appreciated to have these professional help me out.  They are invaluable.