topic Re: Inter vlan routing issue in Network Security

Inter vlan routing issue

vijayarampm — Fri, 21 Feb 2020 14:50:35 GMT

Hi,

I have created new VLAN for DVR's and it is connected with my core switch 3750G. I am able to ping DVR IP's from my core switch but the same was not able from my access switch from another vlan.

interface Vlan250
description """DVR"""
ip address 10.110.110.1 255.255.255.0

ip route 10.110.110.0 255.255.255.0 10.24.1.1(Vlan segment pointing to router).

Please confirm the cause for the inter valn routing issue.

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 09:33:25 GMT

Hi there,

Is the 3750G routing VLAN250? Is that where you have configured the static route? If so, the 3750G will already have a connected route for that subnet, you do not want to be routing traffic destined to that subnet to the router.

I suggest you remove that static route.

cheers,

Seb.

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 10:09:48 GMT

Hi,

3750G is a core switch and DVR are connected in that switch. Created VLAN in core switch and static route configured pointing to router in core switch for accessing the DVR via MPLS cloud from other location.

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 10:23:32 GMT

So the static route is installed on a second switch connected via MPLS. For both switches is the MPLS the default route?

Can you share the routing table for both switches?

What is the source IP you are using when pinging from the other switch?

cheers,

Seb.

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 10:29:58 GMT

Hi,

three switches are connected with stack in core switch. Static route configured in global mode. Switches default gateway is router. Before we need to test the DVR access via mpls cloud we need to check from another vlan. for example from default vlan it should ping the device IP from any other access switches.

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 10:37:36 GMT

So, you are trying to ping a device on VLAN 250 form another device which is routed on the same 3750G? What is the VLAN ID?

Can you share the config of the 3750G?

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 11:05:24 GMT

Hi,

VLAN configured in core switch 3750G and now DVR connected in another switch. In core switch gi1/0/13 is the uplink for DVR connected switch.

I am unable to ping DVR IP's from connected switch itself, but able to ping VLAN gateway.

Core Switch config:

aaa new-model
aaa authentication login default group radius local
aaa authentication enable default group radius enable
aaa authorization exec default group radius if-authenticated
aaa accounting exec default start-stop group radius
!
aaa session-id common
clock timezone UTC 2
clock summer-time UTC recurring last Sun Mar 3:00 last Sun Oct 4:00
switch 1 provision ws-c3750g-24ts
switch 2 provision ws-c3750g-24ts
switch 3 provision ws-c3750g-12s
switch 4 provision ws-c3750g-12s
system mtu routing 1500
ip subnet-zero
no ip source-route
ip routing
ip tcp synwait-time 10
ip domain-name Sanmar.com
!
!
!
crypto pki trustpoint TP-self-signed-2638608256
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2638608256
revocation-check none
rsakeypair TP-self-signed-2638608256
!
!
crypto pki certificate chain TP-self-signed-2638608256
certificate self-signed 01
308202AE 30820217 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
5E312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32363338 36303832 3536312B 30290609 2A864886 F70D0109
02161C43 6F726531 2D333735 302D3234 2D506F45 2E53616E 6D61722E 636F6D30
1E170D39 33303330 31303030 3135355A 170D3230 30313031 30303030 30305A30
5E312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32363338 36303832 3536312B 30290609 2A864886 F70D0109
02161C43 6F726531 2D333735 302D3234 2D506F45 2E53616E 6D61722E 636F6D30
819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100 92B8819B
6084B1E8 A2FA64DD 76BB0647 551F9357 C4C6FAED B0A1875E A9A96421 8DDB3399
F16418F5 CC2E4310 35836211 32314E6D 7AD6CA52 A64F342E 936C6F5F A4AC9CD1
05E87A1F ABE809FA 0AF72F8F AE8EBB55 B94A8655 1C76EF60 3C1F9401 D41A8933
1C88ACF1 732C6732 315B25EE 3D664E12 A4A0D91A 34F4278A 340F1E9F 02030100
01A37C30 7A300F06 03551D13 0101FF04 05300301 01FF3027 0603551D 11042030
1E821C43 6F726531 2D333735 302D3234 2D506F45 2E53616E 6D61722E 636F6D30
1F060355 1D230418 30168014 5946B6EA 8AD8D027 46E550BD EF80C111 C3FD2509
301D0603 551D0E04 16041459 46B6EA8A D8D02746 E550BDEF 80C111C3 FD250930
0D06092A 864886F7 0D010104 05000381 81004A14 DF8D8515 CEABBF80 FCE3766E
28B88940 CCF49AD3 3932B9DC 61B80142 5FF3798D 0741731F 8B88B54E 5748C00A
53002933 1379B44C C29A3FA5 9D4124DA 593E7DBB D1456934 D9E57864 8ABA06A2
2B56F4FA 99A9DB76 79723581 8324EEF6 81DFDB77 97398453 D24F0109 4B6A33C3
48DB0573 20F9708E 9C7A0080 2D75CFC7 1CCE
quit
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface GigabitEthernet1/0/1
switchport access vlan 250
switchport mode access
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
switchport access vlan 250
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
switchport access vlan 250
switchport mode access
!
interface GigabitEthernet1/0/11
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/14
switchport access vlan 250
switchport mode access

!
interface GigabitEthernet1/0/15
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
switchport access vlan 200
!
interface GigabitEthernet1/0/20
switchport voice vlan 200
spanning-tree portfast
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
speed 100
duplex full
!
interface GigabitEthernet1/0/23
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/0/25
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/26
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/27
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet1/0/28
switchport trunk encapsulation dot1q
switchport mode trunk
load-interval 30
!
interface GigabitEthernet2/0/1
!
interface GigabitEthernet2/0/2
!
interface GigabitEthernet2/0/3
!
interface GigabitEthernet2/0/4
!
interface GigabitEthernet2/0/5
!
interface GigabitEthernet2/0/6
!
interface GigabitEthernet2/0/7
!
interface GigabitEthernet2/0/8
!
interface GigabitEthernet2/0/9
!
interface GigabitEthernet2/0/10
!
interface GigabitEthernet2/0/11
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/0/12
!
interface GigabitEthernet2/0/13
!
interface GigabitEthernet2/0/14
!
interface GigabitEthernet2/0/15
switchport voice vlan 200
spanning-tree portfast
!
interface GigabitEthernet2/0/16
!
interface GigabitEthernet2/0/17
!
interface GigabitEthernet2/0/18
!
interface GigabitEthernet2/0/19
!
interface GigabitEthernet2/0/20

!
interface GigabitEthernet2/0/21
switchport voice vlan 200
spanning-tree portfast
!
interface GigabitEthernet2/0/22
!
interface GigabitEthernet2/0/23
!
interface GigabitEthernet2/0/24
switchport voice vlan 200
spanning-tree portfast
!
interface GigabitEthernet2/0/25
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/0/26
!
interface GigabitEthernet2/0/27
!
interface GigabitEthernet2/0/28
!
interface GigabitEthernet3/0/1
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/0/2
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/0/3
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/0/4
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/0/5
!
interface GigabitEthernet3/0/6
!
interface GigabitEthernet3/0/7
!
interface GigabitEthernet3/0/8
!
interface GigabitEthernet3/0/9
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/0/10
!
interface GigabitEthernet3/0/11
!
interface GigabitEthernet3/0/12
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet4/0/1
switchport autostate exclude
!
interface GigabitEthernet4/0/2
!
interface GigabitEthernet4/0/3
!
interface GigabitEthernet4/0/4
!
interface GigabitEthernet4/0/5
!
interface GigabitEthernet4/0/6
!
interface GigabitEthernet4/0/7
!
interface GigabitEthernet4/0/8
!
interface GigabitEthernet4/0/9
!
interface GigabitEthernet4/0/10
!
interface GigabitEthernet4/0/11
!
interface GigabitEthernet4/0/12
!
interface Vlan1
description User & Server VLAN
ip address 10.24.5.100 255.255.0.0
!

!
interface Vlan200
description VOICE _VLAN
ip address 10.11.0.1 255.255.255.0
!
interface Vlan250
description """DVR"""
ip address 10.110.110.1 255.255.255.0
!
ip default-gateway 10.24.1.1
ip classless
ip route 0.0.0.0 0.0.0.0 10.24.1.1
ip route 10.110.110.0 255.255.255.0 10.24.1.1
no ip http server
ip http secure-server
!
ip tacacs source-interface Vlan1
ip radius source-interface Vlan1

DVR connected switch:

aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local
aaa authorization commands 1 default group tacacs+ none
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 7 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
!
!
!
aaa session-id common
system mtu routing 1500
vtp mode transparent
!
!
!
!
crypto pki trustpoint TP-self-signed-2558465920
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2558465920
revocation-check none
rsakeypair TP-self-signed-2558465920
!
!
crypto pki certificate chain TP-self-signed-2558465920
certificate self-signed 01
30820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32353538 34363539 3230301E 170D3933 30333031 30303031
35355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 35353834
36353932 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E016 5FD299EB AD3D9238 6C9BD18F 85CB8223 596840F9 A9C9FADF C380E9BE
09330B26 4512E592 1ED8ADAD BA1476E4 55DD5DBD 422C3716 75F4752E 7554BAC9
83BD906D 5D300E82 0BFB93A7 2A1C3907 925E7E92 F039F28B A8F25A98 61628BBC
F1DFA126 313F7974 03FA651C 2F6EA1CF B8EC1F99 5BE693CB EFD68F3C 676897FD
41AB0203 010001A3 69306730 0F060355 1D130101 FF040530 030101FF 30140603
551D1104 0D300B82 09495431 30303532 392E301F 0603551D 23041830 168014A6
8CD22CAA F8122B10 A1CF68D3 CC3E2A0E D63BBB30 1D060355 1D0E0416 0414A68C
D22CAAF8 122B10A1 CF68D3CC 3E2A0ED6 3BBB300D 06092A86 4886F70D 01010405
00038181 007C26D7 7BABF7D6 74C3F1B1 4B638F47 3E275EA1 BC349635 471896EE
FF564969 7AE5C0DE 7BB57AA7 BF4E5E02 20CF50C0 40F66AF1 6AB94697 2541B927
B56DF280 94AF2763 18B24844 BE6A405C 18E9CF04 5A319488 DC7293EE 9B84059F
5FF73BB5 BF46986C 50A81EDA C941338C 5E434A6D AB24DD6D 44272B76 BF6C462C
4EC4C75C 74
quit
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 200
name VOICE
!
vlan 250
name DVR
!
!
!
interface FastEthernet0/1
switchport access vlan 250
switchport mode access
!
interface FastEthernet0/2
switchport access vlan 250
switchport mode access
!
interface FastEthernet0/3
!
interface FastEthernet0/4
switchport access vlan 250
switchport mode access
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
!
interface GigabitEthernet0/1
switchport mode trunk
!
interface GigabitEthernet0/2
switchport mode trunk
!
interface Vlan1
ip address 10.24.5.131 255.255.0.0
!
ip default-gateway 10.24.1.1

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 11:20:45 GMT

Thanks. On both switches, what it the output of:

sh spanning-tree vlan 250

sh mac add dyn vlan 250

And just on the 3750:

sh ip arp vlan 250

How are the DVR devices getting their IP addresses? Static, DHCP?

cheers,

Seb.

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 11:34:23 GMT

Hi,

Static IP addresses configured in DVR. Please find the below required output.

IT100529#sh spanning-tree vlan 250

VLAN0250
Spanning tree enabled protocol ieee
Root ID Priority 32769
Address 0008.3032.4e00
Cost 46
Port 25 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 33018 (priority 32768 sys-id-ext 250)
Address 0024.987f.1780
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Fa0/1 Desg FWD 19 128.1 P2p
Fa0/2 Desg FWD 19 128.2 P2p
Fa0/4 Desg FWD 19 128.4 P2p
Fa0/10 Desg FWD 19 128.10 P2p
Gi0/1 Root FWD 4 128.25 P2p

IT100529#sh mac add dy
IT100529#sh mac add dynamic vlan
IT100529#sh mac add dynamic vlan 250
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
250 0000.0c07.ac64 DYNAMIC Gi0/1
250 0007.e9a5.3cb1 DYNAMIC Gi0/1
250 0007.e9a5.3fc0 DYNAMIC Gi0/1
250 000f.fec8.188b DYNAMIC Gi0/1
250 000f.fec8.3e2e DYNAMIC Gi0/1
250 001b.53fa.109b DYNAMIC Gi0/1
250 001b.78f5.8d8b DYNAMIC Gi0/1
250 001e.0b66.f863 DYNAMIC Gi0/1
250 001e.1368.3f83 DYNAMIC Gi0/1
250 001f.9d45.f78d DYNAMIC Gi0/1
250 0020.4ad8.4682 DYNAMIC Gi0/1
250 0020.4ad8.4e32 DYNAMIC Gi0/1
250 0050.5660.328a DYNAMIC Gi0/1
250 0050.569b.28fe DYNAMIC Gi0/1
250 0050.569b.2d99 DYNAMIC Gi0/1
250 0050.569b.3cd9 DYNAMIC Gi0/1
250 0050.569b.60ac DYNAMIC Gi0/1
250 0050.569b.8b73 DYNAMIC Gi0/1
250 0050.569b.de99 DYNAMIC Gi0/1
250 0050.569b.e128 DYNAMIC Gi0/1
250 00c0.ff27.58c5 DYNAMIC Gi0/1
250 0800.37de.f813 DYNAMIC Gi0/1
250 0800.37de.f9a1 DYNAMIC Gi0/1
250 0800.37de.faed DYNAMIC Gi0/1

Core1-3750-24-PoE#sh ip arp vlan 250
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.110.110.14 30 2857.be97.3da4 ARPA Vlan250
Internet 10.110.110.12 30 bcad.289c.63de ARPA Vlan250
Internet 10.110.110.13 30 bcad.289c.63e2 ARPA Vlan250
Internet 10.110.110.1 - 001f.9d45.f7c2 ARPA Vlan250
Internet 10.110.110.31 28 3c52.824d.27ef ARPA Vlan250
Core1-3750-24-PoE#sh spa
Core1-3750-24-PoE#sh spanning-tree vl
Core1-3750-24-PoE#sh spanning-tree vlan 250

VLAN0250
Spanning tree enabled protocol ieee
Root ID Priority 32769
Address 0008.3032.4e00
Cost 42
Port 14 (GigabitEthernet1/0/14)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 33018 (priority 32768 sys-id-ext 250)
Address 001f.9d45.f780
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 15

Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/1 Desg FWD 19 128.1 P2p
Gi1/0/11 Desg FWD 19 128.11 P2p
Gi1/0/13 Desg FWD 4 128.13 P2p
Gi1/0/14 Root FWD 19 128.14 P2p
Gi3/0/1 Desg FWD 4 128.109 P2p
Gi3/0/2 Desg FWD 4 128.110 P2p
Gi3/0/3 Desg FWD 4 128.111 P2p
Gi3/0/4 Desg FWD 4 128.112 P2p
Gi3/0/7 Desg FWD 4 128.115 P2p
Gi3/0/8 Desg FWD 4 128.116 P2p
Gi3/0/10 Desg FWD 4 128.118 P2p
Gi4/0/9 Desg FWD 4 128.171 P2p
Gi4/0/10 Desg FWD 4 128.172 P2p
Gi4/0/11 Desg FWD 4 128.173 P2p
Gi4/0/12 Desg FWD 4 128.174 P2p

Core1-3750-24-PoE#sh mac
Core1-3750-24-PoE#sh mac add
Core1-3750-24-PoE#sh mac add dy
Core1-3750-24-PoE#sh mac add dynamic vlan 250
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
250 0000.0c07.ac64 DYNAMIC Gi1/0/14
250 0007.e9a5.3cb1 DYNAMIC Gi1/0/14
250 0007.e9a5.3fc0 DYNAMIC Gi1/0/14
250 000f.fec8.188b DYNAMIC Gi1/0/14
250 000f.fec8.3e2e DYNAMIC Gi1/0/14
250 001b.53fa.109b DYNAMIC Gi1/0/14
250 001e.1368.3f83 DYNAMIC Gi1/0/14
250 001f.9d53.d38a DYNAMIC Gi1/0/14
250 0020.4ad8.466d DYNAMIC Gi1/0/14
250 0020.4ad8.4a4d DYNAMIC Gi1/0/14
250 0050.5660.328a DYNAMIC Gi1/0/14
250 0050.5699.576e DYNAMIC Gi1/0/14
250 0050.569b.28fe DYNAMIC Gi1/0/14
250 0050.569b.2a95 DYNAMIC Gi1/0/14
250 0050.569b.3cd9 DYNAMIC Gi1/0/14
250 0050.569b.60ac DYNAMIC Gi1/0/14
250 0050.569b.8b73 DYNAMIC Gi1/0/14
250 0050.569b.de99 DYNAMIC Gi1/0/14
250 0050.569b.e128 DYNAMIC Gi1/0/14
250 0800.27f1.3034 DYNAMIC Gi1/0/14
250 0800.37de.f813 DYNAMIC Gi1/0/14
250 101f.7403.aea4 DYNAMIC Gi1/0/14
250 1060.4b5f.65c9 DYNAMIC Gi1/0/14
250 1060.4b60.2592 DYNAMIC Gi1/0/14

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 11:57:41 GMT

What device is connected to Core1-3750-24-PoE Gi1/0/14 ? Whatever it is, it is the root bridge for VLAN 250. Since Core1-3750-24-PoE is routing that VLAN you should make it the root bridge:

!
spanning-tree vlan 250 root primary
!

As for IT100529, you have a few switchports in a forwarding state, but there are no MAC address listed against them. I would expect the devices to be ARP'ing. What are the IPs of the devices connected to Fa0/1, Fa0/2, Fa0/4 ? If you ping those IPs from Core1-3750-24-PoE, does the MAC address table on IT100529 show them?

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 12:05:37 GMT

Hi,

In Cisco 3750 core switch port no14 is uplink connected to another access switch. Please find the below logs for your reference of mac address.

Core1-3750-24-PoE#sh arp | i 10.110.110.
Internet 10.110.110.14 1 2857.be97.3da4 ARPA Vlan250
Internet 10.110.110.12 1 bcad.289c.63de ARPA Vlan250
Internet 10.110.110.13 1 bcad.289c.63e2 ARPA Vlan250
Internet 10.110.110.1 - 001f.9d45.f7c2 ARPA Vlan250
Internet 10.110.110.31 60 3c52.824d.27ef ARPA Vlan250

IT100529#sh mac address-table | i bcad.289c.63e2
IT100529#sh mac address-table | i bcad.
1 bcad.2862.0af5 DYNAMIC Gi0/1
1 bcad.2862.0b0d DYNAMIC Gi0/1
1 bcad.2862.0b13 DYNAMIC Gi0/1
1 bcad.2862.0b16 DYNAMIC Gi0/1
1 bcad.2862.0b1d DYNAMIC Gi0/1
1 bcad.2862.0b2e DYNAMIC Gi0/1
1 bcad.289c.63dd DYNAMIC Gi0/1
1 bcad.289c.63e1 DYNAMIC Gi0/1
250 bcad.2862.0af5 DYNAMIC Gi0/1
250 bcad.2862.0b0d DYNAMIC Gi0/1
250 bcad.2862.0b13 DYNAMIC Gi0/1
250 bcad.2862.0b16 DYNAMIC Gi0/1
250 bcad.2862.0b1d DYNAMIC Gi0/1
250 bcad.2862.0b2e DYNAMIC Gi0/1
250 bcad.289c.63dd DYNAMIC Gi0/1
250 bcad.289c.63e1 DYNAMIC Gi0/1
IT100529#sh mac address-table | i 2857.be97.
1 2857.be97.3da3 DYNAMIC Gi0/1
250 2857.be97.3da3 DYNAMIC Gi0/1

Re: Inter vlan routing issue

Seb Rupik — Tue, 28 Nov 2017 12:20:31 GMT

The MAC addresses listed in the Core1-3750-24-PoE arp table do not appear in any of the MAC address tables. I suggest you clear the ARP cache and see if they reappear:

clear arp-cache interface vlan 250

You still need to remove the static route on Core1-3750-24-PoE :

!
no ip route 10.110.110.0 255.255.255.0 10.24.1.1
!

Re: Inter vlan routing issue

vijayarampm — Tue, 28 Nov 2017 12:32:47 GMT

Hi,

Same has been done. Also configured spanning-tree vlan 250 root primary.

Re: Inter vlan routing issue

vijayarampm — Wed, 29 Nov 2017 06:02:15 GMT

Hi,

Post changes also unable to ping the DVR IP's in DVR connected switch but able to ping DVR VLAN gateway ip. Also I am able to ping DVR IP's in Core Switch 3750. Please find the below output for your reference. Please guide me what needs to be done further.

Core1-3750-24-PoE#sh spanning-tree vlan 250

VLAN0250
Spanning tree enabled protocol ieee
Root ID Priority 24826
Address 001f.9d45.f780
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 24826 (priority 24576 sys-id-ext 250)
Address 001f.9d45.f780
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300

Interface Role Sts Cost Prio.Nbr Type
---------------- ---- --- --------- -------- --------------------------------
Gi1/0/11 Desg FWD 19 128.11 P2p
Gi1/0/13 Desg FWD 4 128.13 P2p
Gi3/0/1 Desg FWD 4 128.109 P2p
Gi3/0/2 Desg FWD 4 128.110 P2p
Gi3/0/3 Desg FWD 4 128.111 P2p
Gi3/0/4 Desg FWD 4 128.112 P2p
Gi3/0/7 Desg FWD 4 128.115 P2p
Gi3/0/8 Desg FWD 4 128.116 P2p
Gi3/0/10 Desg FWD 4 128.118 P2p
Gi4/0/9 Desg FWD 4 128.171 P2p
Gi4/0/10 Desg FWD 4 128.172 P2p
Gi4/0/11 Desg FWD 4 128.173 P2p
Gi4/0/12 Desg FWD 4 128.174 P2p

Core1-3750-24-PoE#sh mac add dyn vlan 250
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
250 2857.be97.3da4 DYNAMIC Gi1/0/13
250 bcad.289c.63de DYNAMIC Gi1/0/13
250 bcad.289c.63e2 DYNAMIC Gi1/0/13
Total Mac Addresses for this criterion: 3
Core1-3750-24-PoE#sh ip arp vlan 250
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.110.110.14 87 2857.be97.3da4 ARPA Vlan250
Internet 10.110.110.12 87 bcad.289c.63de ARPA Vlan250
Internet 10.110.110.13 87 bcad.289c.63e2 ARPA Vlan250
Internet 10.110.110.1 - 001f.9d45.f7c2 ARPA Vlan250
Internet 10.110.110.31 0 Incomplete ARPA
Core1-3750-24-PoE#ping 10.110.110.12

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.12, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
Core1-3750-24-PoE#ping 10.110.110.13

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.13, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Core1-3750-24-PoE#ping 10.110.110.14

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.14, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

IT100529#sh spanning-tree vlan 250

VLAN0250
Spanning tree enabled protocol ieee
Root ID Priority 24826
Address 001f.9d45.f780
Cost 4
Port 25 (GigabitEthernet0/1)
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 33018 (priority 32768 sys-id-ext 250)
Address 0024.987f.1780
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec

IT100529#sh mac add dyn vlan 250
Mac Address Table
-------------------------------------------

Vlan Mac Address Type Ports
---- ----------- -------- -----
250 001f.9d45.f78d DYNAMIC Gi0/1
250 001f.9d45.f7c2 DYNAMIC Gi0/1
250 2857.be97.3da4 DYNAMIC Fa0/2
250 bcad.289c.63de DYNAMIC Fa0/1
250 bcad.289c.63e2 DYNAMIC Fa0/4
Total Mac Addresses for this criterion: 5

IT100529#ping 10.110.110.12

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.12, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
IT100529#ping 10.110.110.13

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.13, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
IT100529#ping 10.110.110.14

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.14, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
IT100529#ping 10.110.110.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.110.110.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms

Re: Inter vlan routing issue

Seb Rupik — Wed, 29 Nov 2017 08:22:57 GMT

Hi there,

The routing & switching output on the switches looks correct, and packets sourced from the the VLAN1 SVI on IT100529, should be making it to DVR devices on VLAN250 connected to the same switch.

I suspect that perhaps the DVRs have either a misconfigured gateway or netmask and are not able to correctly forward packets off the local subnet.

cheers,

Seb.

Re: Inter vlan routing issue

vijayarampm — Fri, 08 Dec 2017 06:51:07 GMT

Hi,

Observed the misconfiguration of gateway IP in DVR and same has been corrected now. It is working from LAN and same needs to be tested through VPN.

What needs to be done to check via VPN ? Is static route of DVR VLAN segment in core switch pointing to Router will work ?

Re: Inter vlan routing issue

Seb Rupik — Sat, 09 Dec 2017 20:15:44 GMT

Hi there,

Yes you are correct, but you will also need a static route on Core1-3750-24-PoE directing traffic destined to the remote site subnets via the VPN.

It would be much easier to configure dynamic routing between your sites.

cheers,

Seb.

Re: Inter vlan routing issue

vijayarampm — Mon, 11 Dec 2017 09:08:41 GMT

I have pointed one static route in my core switch to core router and now it is working. Thanks for your support.