We help IT Professionals succeed at work.

Can't reach enclave switch on the MNGT network.

huffmana
huffmana asked
on
101 Views
Last Modified: 2018-10-10
Created an enclave (192.168.170.0/24) on our office network using a Cisco 2921 and overload NAT to the ISP Firewall (192.168.168.1).  The enclave NAT works OK but I can't get the management network (10.10.10.0/27) out to the switch in the enclave.  I can't ping 10.10.10.11 even from the CORE switch.

See the attached diagram.  MNGT 10.10.10.0/27  OFFICE 192.168.168.0/24  ENCLAVE 192.168.170.0/24

  Network_Diagram.jpg
Comment
Watch Question

SouljaSr.Net.Eng
CERTIFIED EXPERT
Top Expert 2011

Commented:
When you ping from the enclave router to 10.10.10.11, are you sourcing the ping from the enclave mgmt interface?
Andy BartkiewiczNetwork Analyst

Commented:
I believe you are having issues because of a Native vlan mismatch on 7 and 8. You've got vlan 200 as the native on 8 and vlan 1 as the native on 7.
huffmanaSystem Admin and Network Engineer

Author

Commented:
$ ssh user@10.10.10.10
C
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit, authorized permission to access or configure this device.
Unauthorized attempts and actions to access or use this system may result in civil and/or criminal penalties.
All activities performed on this device are logged and monitored.
Password:

guestrtr1>en
Password:
guestrtr1#ping 10.10.10.11 source 10.10.10.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.11, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.10
.....
Success rate is 0 percent (0/5)
guestrtr1#
Andy BartkiewiczNetwork Analyst

Commented:
Also you've got interface 9 setup as a trunk when I think it's supposed to be access
Steven CarnahanAssistant Vice President\Network Manager
CERTIFIED EXPERT

Commented:
What is the result of a trace route from the core switch to 10.10.10.11?
huffmanaSystem Admin and Network Engineer

Author

Commented:
Tried the trunks with native 200 on both sides and with native 1 on both sides.... And it still doesn't ping....  How can the broadcast domain get interrupted between two switches connected by a trunk?  Maybe the vlans aren't allocated....
huffmanaSystem Admin and Network Engineer

Author

Commented:
Int 9 is working as a trunk.  I thought that it would be more secure than a mode access....  I think that the Firewall is tagging it's port as vlan 200.  I don't have access to the Meraki router :-(  I'm afraid to change it....
Sr.Net.Eng
CERTIFIED EXPERT
Top Expert 2011
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
huffmanaSystem Admin and Network Engineer

Author

Commented:
Got it, there was a port monitoring I forgot about!!!! All I had to do was look at UP/DOWN.

How stupid can I be - ignoring the obvious....

Thank you everyone....
Andy BartkiewiczNetwork Analyst

Commented:
Well your not tagging vlan 200 to the router, its native. That's probably why its working. I don't think thats more secure however. Are the vlans defined on both the core and etherswitch?
huffmanaSystem Admin and Network Engineer

Author

Commented:
It is so much appreciated to have these professional help me out.  They are invaluable.
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.