Can I use 9200 as an edge router?

[chueymtz]

I'm trying to use this cisco 9200cx-8g as an edge router with a wan ip to my ISP, I can't seem to get it to work when i configure a static ip to the ports, any suggestions?

9200CX_HQ_ASA_GATEWAY#show run
y
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet1/0/1
!
interface GigabitEthernet1/0/2
!
interface GigabitEthernet1/0/3
!
interface GigabitEthernet1/0/4
!
interface TenGigabitEthernet1/0/5
no switchport
no ip address
!
interface TenGigabitEthernet1/0/6
!
interface TenGigabitEthernet1/0/7
!
interface TenGigabitEthernet1/0/8
!
interface TenGigabitEthernet1/1/1
description Lumen

no switchport
ip address 4.x.x.142 255.255.255.252
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
ip address 4.x.x.169 255.255.255.248
!
ip http server
ip http authentication local
ip http secure-server
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 4.x.x.141 track 1
ip ssh bulk-mode 131072
!
!
!
!
!
!
!!
end

[M02@rt37]

Hello @chueymtz 

Do you ping 4.x.x.141 ?

I see track command at the end of the ip route ; where is the track 1 configuration ? 

Also, which license c9200 has got ?

[chueymtz]

Hello, the track I have to remove I mirrored it from our other switch that we are replacing. How would I see what license I have?

[balaji.bandi]

You need to understand this is switch, can only do certain routing part

it does not do any NAT.

nterface TenGigabitEthernet1/1/1
description Lumen

no switchport
ip address 4.x.x.142 255.255.255.252
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
ip address 4.x.x.169 255.255.255.248

Looking at the configuration you have One interface connected to ISP side and VLAN 1 also have Public - is this IP given by ISP provider ?

Lets start with basic config and change as below you do not need tracking since you have only 1 connection.

no 

ip route 0.0.0.0 0.0.0.0 4.x.x.141 track 1

ip route 0.0.0.0 0.0.0.0 4.x.x.141 

Then try to ping ISP IP  4.x.x.141  (thinking that interface up and running )

check below command and post the output here for some verifications : (is the ports come up ?)

show ip interface brief

show interface status

show ip route

ping 4.x.x.141 

[chueymtz]

Ok, I made those changes here's what I got: and yes the ip's i have were all provided by my ISP. the 169 is a public static ip, from that there's another static ip on a port on the firewall ex 170 and so on we have 5 statics.

9200CX_HQ_ASA_GATEWAY#show ip int brief
Interface IP-Address OK? Method Status Protocol
Vlan1 4.x.x.169 YES NVRAM up down
GigabitEthernet1/0/1 unassigned YES unset down down
GigabitEthernet1/0/2 unassigned YES unset down down
GigabitEthernet1/0/3 unassigned YES unset down down
GigabitEthernet1/0/4 unassigned YES unset down down
Te1/0/5 unassigned YES unset down down
Te1/0/6 unassigned YES unset down down
Te1/0/7 unassigned YES unset down down
Te1/0/8 unassigned YES unset down down
Te1/1/1 4.x.x.142 YES NVRAM up up
Te1/1/2 unassigned YES unset down down
9200CX_HQ_ASA_GATEWAY#show interface status

Port Name Status Vlan Duplex Speed Type
Gi1/0/1 notconnect 1 auto auto 10/100/1000BaseTX
Gi1/0/2 notconnect 1 auto auto 10/100/1000BaseTX
Gi1/0/3 notconnect 1 auto auto 10/100/1000BaseTX
Gi1/0/4 notconnect 1 auto auto 10/100/1000BaseTX
Te1/0/5 notconnect routed auto auto 10/100/1000/2.5G/5G/10GBaseTX
Te1/0/6 notconnect 1 auto auto 10/100/1000/2.5G/5G/10GBaseTX
Te1/0/7 notconnect 1 auto auto 10/100/1000/2.5G/5G/10GBaseTX
Te1/0/8 notconnect 1 auto auto 10/100/1000/2.5G/5G/10GBaseTX
Te1/1/1 Lumen Circuit ID 3 connected routed full 10G SFP-10GBase-LR
Te1/1/2 notconnect 1 full 10G SFP-10GBase-LRM
9200CX_HQ_ASA_GATEWAY#sho ip route
Extended Host Mode is enabled
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, m - OMP
n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
H - NHRP, G - NHRP registered, g - NHRP registration summary
o - ODR, P - periodic downloaded static route, l - LISP
a - application route
+ - replicated route, % - next hop override, p - overrides from PfR
& - replicated local route overrides by connected

Gateway of last resort is 4.x.x.141 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 4.x.x.141
4.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 4.36.97.140/30 is directly connected, TenGigabitEthernet1/1/1
L 4.36.97.142/32 is directly connected, TenGigabitEthernet1/1/1
9200CX_HQ_ASA_GATEWAY#ping 4.x.x.141
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.x.x.141, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
9200CX_HQ_ASA_GATEWAY#

[balaji.bandi]

9200CX_HQ_ASA_GATEWAY#ping 4.x.x.141
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.x.x.141, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms
9200CX_HQ_ASA_GATEWAY#

This looks ok as per Internet p2p link related connectivity 

Now your VLAN1 is down, since there is no device connected in VLAN 1

Configure one of the PC 4.x.x.X  and put thegateway - 4.x.x.169 

and ping to ISP 4.x.x.141 and ping 8.8.8.8 what is the outcome ?

Note : what is the issue you encountering, not able to get internet to devices ?

[Leo Laohoo]

How big is the WAN link?

Who is doing the routing?

Who is doing the traffic shapping?

[chueymtz]

How big is the WAN link? 2gb circuit

Who is doing the routing? I have a separate 9300 that handles routing.

Who is doing the traffic shapping? not sure what this is

[chueymtz · Accepted solution]

Ok so I think the issue is with the switch itself. I figured out that I don't need to enable nat outside but I copied basically the entire config to a 9300 and the internet and everything started working properly. Therefore I have come to the conclusion that it is the 9200 that doesn't work the way I need it to in this setup, thank you all for your input.