Link to home
Start Free TrialLog in
Avatar of huffmana
huffmanaFlag for United States of America

asked on

Can't reach enclave switch on the MNGT network.

Created an enclave ( on our office network using a Cisco 2921 and overload NAT to the ISP Firewall (  The enclave NAT works OK but I can't get the management network ( out to the switch in the enclave.  I can't ping even from the CORE switch.

See the attached diagram.  MNGT  OFFICE  ENCLAVE

  User generated image
Avatar of Soulja
Flag of United States of America image

When you ping from the enclave router to, are you sourcing the ping from the enclave mgmt interface?
Avatar of Andy Bartkiewicz
Andy Bartkiewicz

I believe you are having issues because of a Native vlan mismatch on 7 and 8. You've got vlan 200 as the native on 8 and vlan 1 as the native on 7.
Avatar of huffmana


$ ssh user@
You must have explicit, authorized permission to access or configure this device.
Unauthorized attempts and actions to access or use this system may result in civil and/or criminal penalties.
All activities performed on this device are logged and monitored.

guestrtr1#ping source
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Packet sent with a source address of
Success rate is 0 percent (0/5)
Also you've got interface 9 setup as a trunk when I think it's supposed to be access
What is the result of a trace route from the core switch to
Tried the trunks with native 200 on both sides and with native 1 on both sides.... And it still doesn't ping....  How can the broadcast domain get interrupted between two switches connected by a trunk?  Maybe the vlans aren't allocated....
Int 9 is working as a trunk.  I thought that it would be more secure than a mode access....  I think that the Firewall is tagging it's port as vlan 200.  I don't have access to the Meraki router :-(  I'm afraid to change it....
Avatar of Soulja
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Got it, there was a port monitoring I forgot about!!!! All I had to do was look at UP/DOWN.

How stupid can I be - ignoring the obvious....

Thank you everyone....
Well your not tagging vlan 200 to the router, its native. That's probably why its working. I don't think thats more secure however. Are the vlans defined on both the core and etherswitch?
It is so much appreciated to have these professional help me out.  They are invaluable.