topic Re: Point to point connection in Routing and SD-WAN

Point to point connection

Tazio4436 — Wed, 11 Jan 2023 20:14:37 GMT

Hi,

I have 2 locations and they are connected to connected through VPN connection and it works fine but I am just adding a new point to point connection.

On both ends Fortinet Firewalls interface have been configured with ip address 172.16.30.1 and 172.16.30.2 respectively.

On both cisco SW we have int vlan 65 with ip address 172.16.0.5 on Cisco Sw site 1 and 172.16.30.6 on Cisco SW site 2.

Interface Connecting the 2 sites were configured as truck allowing vlan 65

Int GigabitEthernet1/0/22 and int GigabitEthernet 1/0/23 were configured as access allowing vlan 65.

Fortinet 1 cannot ping Fortinet 2

I tried putting an ip address on the interfaces connecting the 2 sites (

GigabitEthernet1/0/24 and Te2/1/1) and both sites can ping each other but still cannot get Fortinet 1 to ping Fortinet 2.

What will be the simplest setup to have Fortinet 1 ping Fortinet 2? i cannot change anything on Fortinet side

Thanks

Tazio

Re: Point to point connection

MHM Cisco World — Wed, 11 Jan 2023 20:23:50 GMT

the SW port connect to Fortinet must assign to vlan 65.

Re: Point to point connection

Tazio4436 — Wed, 11 Jan 2023 20:34:29 GMT

Thanks for your reply

Interface GigabitEthernet1/0/22 and GigabitEthernet1/0/23 have these configuration

Switchport mode access

Switchport access vlan 65

Thanks

Tazio

GigabitEthernet1/0/22

Re: Point to point connection

balaji.bandi — Wed, 11 Jan 2023 20:35:39 GMT

Couple of question and clarification

1. have you created VLAN 65 on both switches?

2. you mentioned the IP address here, does this not match in the same network? or is this typo error?

ip address 172.16.0.5 on Cisco Sw site 1 and 172.16.30.6 on Cisco SW site 2.

3. if this this just Layer 2 extended on both the switches, that should work as expected.

4. Firewall what is the gateway they are pointing ?

5. I am sure p2p connection I take as Layer 2 connection (not layer3 connection)

6. On switch you using interface vlan 65 and IP address ?

7. From switch to switch are you able to ping ?

8 from Switch on site 1 to Firewall IP are you able to ping ? same case Site 2 ?

Re: Point to point connection

MHM Cisco World — Wed, 11 Jan 2023 20:53:19 GMT

P2P VPN is it L2VPN or L3VPN ??

Re: Point to point connection

Tazio4436 — Thu, 12 Jan 2023 15:45:11 GMT

Hi ,

This is just a layer 2 Pt2Pt connection

Thanks

Tazio

Re: Point to point connection

MHM Cisco World — Thu, 12 Jan 2023 15:59:12 GMT

then check the policy in both FW it can drop the icmp packet.
also check arp in both FW, are the ARP show IP-MAC in both FW??

Re: Point to point connection

Tazio4436 — Thu, 12 Jan 2023 15:56:13 GMT

Hi,

Thanks for your reply.

There is a little progress as I spoke with the Fortinet guy and he had GW missing so he added the GW and now Fortinet can ping directly connected Cisco SW but the 2 Cisco SWs are still not talking.

To answer to your question

1. Yes Vlan 65 are on both Sw

2. Yes it is a typo in fact the ip are 172.16.30.3 and 172.16.30.6 and these has been added as GW on Fortinet.

3. unfortunately still not working

4. Firewall GW were missing and now it has been added as 172.16.30.3 and 172.16.30.6

5 Yes this is a layer 2 pt2pt connection

6 Yes I am using int vlan 65 with ip address .Please see show run attached

7 SW to Sw cannot ping

8. SW to Firewall is now pingable after GW have been added.

Thanks

Tazio

Re: Point to point connection

balaji.bandi — Thu, 12 Jan 2023 17:46:21 GMT

as per your diagram it was Gig 1/0/24

your config show as below : where is Gig 1/0/24 config

Cisco SW Site 1#sh run
!
interface GigabitEthernet1/0/22
switchport access vlan 65
switchport mode access
!
interface Vlan65
ip address 172.16.30.3 255.255.255.248
!
interface GigabitEthernet1/0/22
switchport trunk allowed vlan 65
switchport mode trunk

==========

can you also post show cdp neigh (from both the switches ?)

Re: Point to point connection

MHM Cisco World — Thu, 12 Jan 2023 17:48:32 GMT

SW to Sw cannot ping <<- this need more clarification? how it L2 VPN and can not ping each other?
please share spanning tree for interface

Re: Point to point connection

Tazio4436 — Thu, 12 Jan 2023 18:15:44 GMT

Sorry again typo when editing the file

Cisco SW Site 1#sh run
!
interface GigabitEthernet1/0/22
switchport access vlan 65
switchport mode access
!
interface Vlan65
ip address 172.16.30.3 255.255.255.248
!
interface GigabitEthernet1/0/24
switchport trunk allowed vlan 65
switchport mode trunk

Please see sh cdp nei attached. Can see neigh from one side only

Thanks

Tazio

Re: Point to point connection

balaji.bandi — Thu, 12 Jan 2023 19:18:47 GMT

we do not see the switches forming CDP, Maybe it was not enabled not sure.

post below output from bot the switches :

show vlan

show IP interface brief

show span vlan 65

show interface gig 1/0/24 (from switch site1)

show interface ten 2/1/1 (from switch site2)

show run | in hostname

Re: Point to point connection

Tazio4436 — Thu, 12 Jan 2023 19:38:13 GMT

Hi ,

Thanks for your prompt reply.

For ease of understanding I labelled the SW in site 1 as Cisco SW Site 1 but the hostname is BGP1

Same thing for site 2 I labelled it as Cisco SW Site 2 but the hostname is COLOSW_STACKED.

I am attaching 2 files for the output of the commands you requested.

Thanks

Tazio

Re: Point to point connection

MHM Cisco World — Thu, 12 Jan 2023 19:51:44 GMT

FW1-SW1-Router1-l2vpn-Router2-SW2-FW2

the l2vpn is mpls or l2tpv3 is vlan aware? check the router do the l2vpn I think the issue is there.

Re: Point to point connection

balaji.bandi — Thu, 12 Jan 2023 19:59:33 GMT

here is my observation :

show vlan (COLOSW_STACKED)

I do not see your Ten 2/1/1 part of the VLAN. 65

65 PT-2-PT active Gi1/0/23, Gi2/0/22, Gi2/0/23

other part :

BGP1 Gi 1/0/24 is Ethernet port

COLOSW_STACKED - Ten 2/1/1 have SFP port ? (1000BaseLX SFP)

So that is not possible to connect Ethernet to SFP (until you have any media converters between)

So as per I know you have some Physical connection issue here -

If you look at the spantree output ( both switch for VLAN 65 acting as root )

BGP1#sh span vlan 65

VLAN0065
Spanning tree enabled protocol rstp
Root ID Priority 32833
Address 084f.f984.d200
This bridge is the root

COLOSW_STACKED#sh span vlan 65

VLAN0065
Spanning tree enabled protocol rstp
Root ID Priority 32833
Address 10b3.d62f.de80
This bridge is the root

Suggestions :

check Ten 2/1/1 config, make sure configured correctly trunk and with VLAN 65

check - show interface trunk

shutdown Ten 2/1/1 see what ports going down.

by the way what model switches is this ? what IOS code running ? ( I am sure some where I see Cat 9300 please clarify)

Re: Point to point connection

Tazio4436 — Thu, 12 Jan 2023 20:38:28 GMT

Hi ,

Thanks for your reply and trying your best to help me.

Int Te2/1/1 is a trunk port and hence will not show up in sh vlan .

Yes there is a media converter on the BGP1 site. The ISP hands over the circuit to be in a media converter on an Ethernet port and I take over from that port to my Cisco Sw.

Seems correct configuration on int Te2/1/1

COLOSW_STACKED#sh run int te2/1/1
Building configuration...

Current configuration : 98 bytes
!
interface TenGigabitEthernet2/1/1
switchport trunk allowed vlan 65
switchport mode trunk
end

I did shut down int Te2/1/1 and it goes admin down which means this is the correct port.

Both Sw are 9300 Sw and IOS is CAT9K_IOSXE

Thanks

Tazio

Re: Point to point connection

MHM Cisco World — Thu, 12 Jan 2023 20:49:22 GMT

https://www.letsconfig.com/how-to-configure-q-in-q-tunneling-in-cisco/

I think this is your config, the SP need to know the VLAN you add to make Q-in-Q map.

Re: Point to point connection

Georg Pauwen — Thu, 12 Jan 2023 20:54:34 GMT

Hello,

I have not followed the entire thread, but can you post the full running configurations (sh run) of both switches ? Since this is a layer 2 network, make sure you don't have 'ip routing' enabled on any of the switches.

That said, the Fortinets do not need a default gateway, as both Fortinets and both switches are in the same subnet...

Re: Point to point connection

balaji.bandi — Thu, 12 Jan 2023 21:02:15 GMT

Yes there is a media converter on the BGP1 site. The ISP hands over the circuit to be in a media converter on an Ethernet port and I take over from that port to my Cisco Sw. - make sense I was expected this.

i mean when you shutdown Ten 2/1/1 (on BGP1 Gi 1/0/24 go down ?) - I think it will not go down due to media converter between.

can you post show IP route , show run | in routing , show IP arp (from both the switches)

Something looks not right in the connection I guess.

For testing - make it as access port - and vlan 65 - Ten 2/1/1

Connect Laptop on BGP1 side directly to laptop Ethernet and assisng IP address 172.16.30.3 and ping 172.16.30.6 (is this works ?)

So your connection will be like this :

Laptop (172.16.30.3)----Ethernet--Mediaconverter------ISP-------Te 2/1/1

Re: Point to point connection

Tazio4436 — Fri, 13 Jan 2023 14:58:46 GMT

Hi ,

Yes you are absolutely right. I did a shut on Te2/1/1 and int GigabitEthernet1/0/24 still stays up up.
Please see the output yopu requested
!!!!!!!!!!!!!!
COLOSW_STACKED#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 10.30.0.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.30.0.1
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.30.0.0/21 is directly connected, Vlan2
L 10.30.0.2/32 is directly connected, Vlan2
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.30.0/29 is directly connected, Vlan65
L 172.16.30.6/32 is directly connected, Vlan65
!!!!!!!!!!!!!!!!!!!!!!
BGP1#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.30.0/29 is directly connected, Vlan65
L 172.16.30.3/32 is directly connected, Vlan65
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1
COLOSW_STACKED#sh run | i routing
ip routing
class-map match-any system-cpp-police-routing-control
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
BGP1#sh run | i routing
ip routing
class-map match-any system-cpp-police-routing-control
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I did a ping to 10.16.30.6 with laptop connected to media converter and Ip set to 172.16.30.3 and int te2/1/1 set as access for vlan 65 and ping works

C:\Users\Tazio.SMIDOMAIN>ping 172.16.30.6

Pinging 172.16.30.6 with 32 bytes of data:
Reply from 172.16.30.6: bytes=32 time=6ms TTL=254
Reply from 172.16.30.6: bytes=32 time=4ms TTL=254
Reply from 172.16.30.6: bytes=32 time=5ms TTL=254
Reply from 172.16.30.6: bytes=32 time=5ms TTL=254

Ping statistics for 172.16.30.6:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 4ms, Maximum = 6ms, Average = 5ms

Thanks

Tazio