Can't access core switch with http

[mcgiga]

Hi,

the core switch has several VLANs. Let's say the subnet of the management VLAN where all switches are located is 192.168.100.0/24. All VLANs on the core are separated in VRFs.

Core switch is accessable by ssh and http from within the management VLAN. When I try to access the core with http via VPN I don't get a response. Switch is reachable by ping. All other switches in the management VLAN are accessable via VPN. Only the core switch which is the gateway of the management VLAN not.

For SSH there is VRF-ALSO needed to access the core switch from within the management VLAN. Is there some similar for http? Or maybe the reason is something different?

[MHM Cisco World]

Try check if http is vrf aware in your platform' which I dont think so'

Hence you can only access http via global not vrf 

MHM

[mcgiga]

ip http ? shows nothing vrf related.

But why can I ping the gateway on it's ip address but not access it with http? Is there some difference for http?

>Hence you can only access http via global not vrf 
So there is a different way to get access via global?

[MHM Cisco World]

ip http client source-interface Vlan123 <<- this vlan123 is in vrf or in global

This vlan decide in which rib ypu can access http 

If vlan123 in global then you can access via global 

If vlan123 in vrf then you can access via vrf 

MHM

[mcgiga]

vlan 123 is in vrf VLAN_123. Routes are working. Traffic can reach the vlan and the vlan can reach the firewall.

[MHM Cisco World · Accepted solution]

If the PC you use for gui have same subnet of vlan123 ?

If not SW use defualt gateway which global?

MHM

[mcgiga]

VPN client is located in it's own vpn-subnet, i. e. 192.168.150.0/240.

[MHM Cisco World]

The gateway of SW in global  and http not support vrf aware 

I think that why http not work

MHM

[mcgiga · Accepted solution]

When I add ip route 0.0.0.0 0.0.0.0 192.168.50.1 to the global routing table, it's working.

But why? For ssh it's not needed.

[Flavio Miranda]

@mcgiga 

 Can you share the core config here? Or can you check if there is an Access List applied that could be preventing the core to be accessed from management vlan on HTTP?

[mcgiga]

There is no access list, only for ssh access yet.

ip http server
ip http authentication local
ip http secure-server
ip http client source-interface Vlan123

[Flavio Miranda]

and this config is suppose to be like this?   "ip http client source-interface Vlan123"

You are telling the core to send the http traffic to vlan 123.  Does vlan 123 is the management vlan ?

[mcgiga]

vlan 123 is the management vlan.

ip http client source-interface Vlan123 was needed so the switches in that vlan can access cisco smart licensing via the firewall. Without that switches could not get to the backend of cisco smart licensing.

no ip http client source-interface Vlan123 doesn't change anything.

sw#sh ip route vrf VLAN_123

Routing Table: VLAN_123

Gateway of last resort is 192.168.50.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 192.168.50.1
192.168.130.0/24 is variably subnetted, 2 subnets, 2 masks

So when all traffic is send from VLAN 123 it should be routed via 0.0.0.0 to the transit network where the vpn client is reachable.
I am able to send a ping from the core switch to the vpn client. I can access the switch with ssh from vpn.

There must be something missing or wrong for http.

[mcgiga]

Small update. SSH access to the core switch via VPN is working too. Only http is not working.

[Flavio Miranda]

dont you have a firewall blocking somewhere? Cause does not make sense

if you run a capture packet on the core do you see any traffic?