3560 switch and internet DNS error

[joel75941]

Hi all,

In reference to the following link:Configure InterVLAN Routing on Layer 3 Switches - Cisco

After setting up ip routing on the switch, the router I connected it to was a non-cisco device.  The router definitely has no problem connecting to the internet, and as far as I know the configuration for the switch is correct.  I can:

1) ping other host devices between vlans

2) ping the router's gateway

3) ping out to the internet (yahoo's ip address for example, 46.228.47.115). 

However, I get an error telling me that the DNS server isn't responding, and as such I do not have an internet connection on any of my host devices.  The DNS server used in my static IPv4 config is a basic google DNS 8.8.8.8.  Can anyone help me?  I'm not sure what the problem here could be...thanks.

[Philip D'Ath]

To be clear; the workstation can ping the DNS server IP address?

[joel75941]

Yes I can, my apologies I should have mentioned that. I can ping 8.8.8.8 from the host without any issue.

The DNS error is displayed by my host's network adapter telling me I have no internet access and the trouble shooter says the DNS server isn't responding.

[Richard Burts]

If a host connected to the switch is successful in ping to 8.8.8.8 then it demonstrates basic IP connectivity and also address translation is working from the host IP. So there must be some other issue. Here are a some thoughts and suggestions:

- is there any proxy device in the network which would pass the ping packet but intercept the DNS request?

- are there any access policies/access lists configured on the switch that might be impacting the DNS traffic.

- are there any access policies/access lists configured on the router which might be impacting the DNS traffic?

- it is good to know that you can ping 8.8.8.8. Have you attempted to ping to other destinations in the Internet using their IP address?

- if you attempt to ping from the host to some resource in the Internet does the ping resolve the name to an IP address?

HTH

Rick

[joel75941]

Thanks for the quick reply.  Unfortunately I made a mistake...I responded above, and I appreciate any feedback you can provide.

[Philip D'Ath]

As rburts  says, this proves the routing is correct.  it must be an access rule somewhere blocking the DNS traffic.  I would start by checking the router.

[joel75941]

Sorry I'm still pretty new to this and trying to figure things out.  I misspoke.  Since my workstation is connected to the switch via both the ethernet cable and console cable, I was running the pings from the console.  =/

It looks like the switch is okay in that sense...pings work there, but when I try to run ping from the cmd window of the workstation:

1) I can successfully ping the local vlan gateway.

2) I can ping the other workstation connected to a separate vlan.

3) I cannot ping the router gateway. 

4) I cannot ping the DNS server (ip 8.8.8.8).

[Philip D'Ath]

Have you added a route for your vlan to the router via the switch?

[joel75941]

Forgive my ignorance, but isn't that what "ip route 0.0.0.0 0.0.0.0 192.168.1.1" is for? (192.168.1.1 being the router gateway ip)

[Richard Burts]

Either you did not quite understand the suggestion about a route or I did not quite understand your response. So let me try from a slightly different perspective. I believe that you are saying that your switch has a default route which points to the router (0.0.0.0 0.0.0.0 192.168.1.1). This tells the switch that to get to any unknown destination it should forward traffic to the router. This is appropriate and should work. The real question is whether the router has a route to your subnets on the switch? Not having a route on the router for your subnets on the switch would produce exactly the symptoms that you are experiencing.

HTH

Rick

[joel75941]

Ah okay.  Yes, the routes from my router to the various vlans exist.  If I have a workstation on the router, I can ping a workstation sitting on any of my vlans.

But from my PC sitting inside the vlan, I still cannot ping the router ip/gateway (192.168.1.1).

Not sure if this helps, but here is a sample IPv4 config of a workstation in vlan2 (network 192.168.2.0):

ip: 192.168.2.2

mask: 255.255.255.0

gateway: 192.168.2.1

DNS:  I've tried leaving this empty, and I've tried setting it to 8.8.8.8.

[Philip D'Ath]

That fact than one workstation can ping another workstation on another vlan only proves the switch and workstations are configured correctly, not your router.

Please show us the configured routes on your router to verify it is correct.  And what is the IP address of the switch in the VLAN that the router plugs into.

[joel75941]

When you put it that way, it makes perfect sense.  I actually made one step of progress!  Router ip is 192.168.1.1.  Switch ip connected to the router is 192.168.1.2.  Here is the routing table:

Dest lan ip / subnet mask / gateway / interface

default / 0.0.0.0 / 74.68.56.1 / WAN <-- cannot change
74.68.56.0 / 255.255.248.0 / * / WAN <-- cannot change
169.254.0.0 / 255.255.0.0 / * / LAN & WLAN <-- cannot change
192.168.1.0 / 255.255.255.0 / 192.168.1.1 / LAN & WLAN <-- added just now
192.168.1.0 / 255.255.255.0 / * / LAN & WLAN <-- cannot change
192.168.2.0 / 255.255.255.0 / 192.168.1.2 / LAN & WLAN
192.168.3.0 / 255.255.255.0 / 192.168.1.2 / LAN & WLAN

Previously, since the 192.168.1.0 was already there I left it alone.  The "*" was the issue, so now that I've added the new route for 192.168.1.0 I can ping the router from my workstation on the switch.  I can also now ping from any workstation to any other workstation across different networks.

But, internet is still down.  I'm not able to ping 8.8.8.8 or any thing else external from this workstation.  The workstation plugged directly into the router however has no problems.

[Philip D'Ath]

You do not need a route for the directly connect network of 192.168.1.0 via 192.168.1.1 - so delete that.

You do need the other two (assuming your VLANs are 192.168.2.0/24 and 192.168.3.0/24).

Now has your router got rules to NAT traffic for 192.168.2.0/24 and 192.168.3.0/24?  Has it got rules to allow these subnets to the Internet?

What kind of router is this?

[joel75941]

I mean, technically it's a cisco product, but it's a simple linksys e1200 router.  I do plan to change that, but for now I really just want to get this off the ground.

Other than changing the routing table and upgrading the firmware I've pretty much left it at factory defaults.