Simple but weird Cisco 9200 switch problem

[David0531]

I have a network setup where SW2 cannot communicate with the NMS (Network Management System), but other switches in similar positions, like SW3 and SW4, can communicate without any issues.  The VLANs are not configured directly on the switches using vlan xX commands; instead, the VLANs are defined on sub-interfaces on a firewall, which connects to the switches via a trunk link.

When I ping the NMS from SW2, I can see debug information on SW2, meaning the ping packets are reaching SW2. However, SW2 is unable to reply back to the NMS, even though other switches (SW3 and SW4) in the same setup can communicate without any issues. The trunk links between the switches and firewall carry the necessary VLANs, and the problem appears to be isolated to SW2.

SW3 and SW4 is configured with SVI of vlan 351, while SW2  is configured with SVI of vlan 350. 

SW2 can ping gateway, which is on the firewall subinterface.

This suggests the issue might be with the trunk configuration, SVI (Switch Virtual Interface) settings, or firewall routing and ACL policies related to SW2. However, the rest of the network with the same configuration works  as expected, making it a localized problem to SW2.

I want to figure out why SW2 is unable to communicate with the NMS, while other switches can.

[Pavel Tarakanov]

Can you take capture of the traffic on the firewall? On the port faced to SW2 in VLAN 350 ICMP replies from SW2 to NMS visible?

[David0531]

thanks for reply. please comment more. is this an ios issue?

[MHM Cisco World]

The VLANs are not configured directly on the switches using vlan xX commands <<- this is wrong and make issue here

When you allow vlan in trunk that not meaning add vlan auto so you need to add vlan to SW manually 

MHM

[David0531]

thanks to reply.

i started a ping from NMS, then i debug ip icmp from sw2, i can see icmp messages from NMS.

Also,i  used to be able to ping SW2 from SW1 and ssh from SW1 to Sw2, as they are have same vlan SVI. Now, i changed IP of SW2, i cannot ping SW2 from SW1 now.

[David0531]

There are many cisco 9200 switches in the environment. one thing i noticed is  many  of them are vtp domain servers.

i have changed sw2 to client. won't help still.

[MHM Cisco World]

Only do 

Show vlan in each SW in path to FW 

Check if you see vlan or not

Dont depend on vtp 

MHM