Inter vlan routting in 6500

[salel.munappil]

I have 6500 with redundant sup2/msfc

i have configured vlan in msfc

interface Vlan204

ip address 129.1.204.34 255.255.255.0 alt ip address 129.1.204.35 255.255.255.0

no ip redirects

no ip route-cache

no ip mroute-cache

standby ip 129.1.204.31

standby timers 1 5

!

interface Vlan205

ip address 129.1.205.34 255.255.255.0 alt ip address 129.1.205.35 255.255.255.0

no ip redirects

no ip route-cache cef

no ip mroute-cache

standby ip 129.1.205.31

standby timers 1 5

I connect client to vlan 204 with following ip address and gateway as example

ip 129.1.204.55/24 and gateway 129.1.205.50

From the client i can reach any where in the netwrok ..what is the reason for this...and how to stop this..Pls note i am using 205 network as my gateway which belong to 205 Vlan

Clients on a particlar Vlan should be able to do inter vlan routing only if they give the correct gateway..

[mark-obrien]

It sounds as though the MSFC is set for proxy-ARP. Your client ARPs for the default gateway, and the MSFC sends its MAC address as a response. The interface command "no ip proxy-arp" should stop this behavior if I am correct about the cause.

Let us know how it works.

Mark

[salel.munappil]

Hi Mark,

This was the first thing i thought of..i tried using no ip proxy arp....

I have this no ip proxy arp in the vlan interface..

[t.baranski]

A sniffer would give a good indication of what's going on here. Is the host running UNIX? If so, run tcpdump with the -e flag and post the output.

[salel.munappil]

Hi,

I simulated the same scenario in my office with another 6500 with msfc....

If u have 6500 and msfc ...and configure vlans in msfc...the gateway given in the clents can be any adress which has an entry in msfc...

regards

salel MD

[t.baranski]

Was proxy-ARP enabled? I don't see how your results could occur otherwise.

Again, a sniffer will tell the story here. What does a given host do when you give it a gateway that is outside it's subnet? Some UNIX variants won't accept such a command in the first place. But on a host that does let you do this, does it ARP for the gateway when sending a non-local packet or does it just ARP for the destination? Either way, something has to respond to the ARP request and I don't see why the 6500 would do so unless proxy-ARP is enabled.

[salel.munappil]

Hi,

Ip proxy arp is not enabled on any Vlans...

I am having 98,2000,95 OS in all the OS its the same.

When i dont give any gateway i will not be able to reach any PCsin any other Vlan. But if i give an ip adress belonging to any other vlan as gateway i can reach any where in the network...

I dont have any Unix machine...