Can ping subnet from router but not from PC

[Brian Taylor]

I've just configured a new internal subnet which I can ping from the router but I can't ping devices on the subnet from my computer. I have other subnets configured and they work fine. For example:

WORKS - can ping from both router and PC:

interface GigabitEthernet0/1.4
 encapsulation dot1Q 4
 ip address 192.168.0.251 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security in-zone

DOESN'T WORK - can ping from router but not PC:

interface GigabitEthernet0/1.140
 encapsulation dot1Q 140
 ip address 10.0.4.2 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security in-zone

am I missing something?

[balaji.bandi]

Make sure the Router conencted to switch has VLAN allowed ( example VLAN 140)

make sure your device access connected port belong to VLAN 140

[Flavio Miranda · Accepted solution]

Is it packet tracer? zip the file and attach here. Is easier to help. If not packet tracer, share the show run from switch and rourter. 

Make sure default gateway is configured on PC.

[Georg Pauwen]

Hello,

what is the context of your question ? Post a diagram of your topology as well as the full configurations of all devices involved. You have a ZBF configured as well ?

[MHM Cisco World]

Pc dont have any ip

Pc gw is missing 

Pc subnet is not included in overload nat

Check above three points 

[Brian Taylor]

Basic topology (router is Cisco 2901):

• Local subnet: 192.168.2.* on router on 192.168.2.1 (config: spc-t1b1-core-gw3-confg11-p.txt)
• New subnet 10.0.4.* on router 10.0.4.2 (pings)
• Core switch (cisco 3750 stack) 192.168.2.2, 10.0.4.3 (pings) (config: spc-t1l1-core-sw1-confg1-p.txt)
• T1B1 switch (cisco 300) 192.168.2.14 (config: spc-t1b1-idf-sw1-p.txt)
• T1B1 switch – link to netgear switch on 10.0.4.* subnet

VLan 140 switch configuration:

Core switch 192.168.2.2 (cisco 3750 stack) – router connection:

interface GigabitEthernet1/0/11
 description Router 1
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 4,5,10,100,140
 switchport mode trunk

Core switch to T1B1 switch connection:

interface GigabitEthernet3/0/3
 description Tower 1 basement 1 new switch 192.168.2.14
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 20
 switchport trunk allowed vlan 20,30,60,140
 switchport mode trunk

T1B1 switch – core switch connection:

interface gigabitethernet27
 description "Core Connection"
 switchport trunk allowed vlan add 5,10,30,60,140
 switchport trunk native vlan 20

T1B1 switch – link to netgear switch on 10.0.4.* subnet:

interface gigabitethernet11
 description Residental
 switchport mode access
 switchport access vlan 140

To answer comments:

Context: New subnet 10.0.4.* added to network that contains a number of cameras

Network diagram: attached

Full configurations of switches and router attached (static routes and security information omitted)

ZBF: is configured but all subnets are declared “in-zone” so I assume it has no affect?

PC ip address: 192.168.2.176

PC GW: 192.168.2.1

Overload NAT applies to internet access? So not applicable as we are only talking inside NAT?

VLAN 140: configured on each device and port per configuration above

Packet tracing attached: from 10.0.4.99 pinging to 192.168.2.176 (failed) and 10.0.4.1 (success)

Conclusion: can ping from PC to router (10.0.4.2) and switch (10.0.4.3) but final subnet 10.0.4.1. Also can’t ping PC (192.168.2.176) from the new subnet (10.0.4.99 laptop). The Overload NAT question got me thinking that maybe my assumption that “ip nat inside” was enough to allow subnets to communicate in the router is incorrect. Perhaps the “ip route 0.0.0.0 0.0.0.0 Dialer6” has something to do with this (internet routing).

[Brian Taylor]

The configuration as posted worked fine. The issue was that the devices on the 10.0.4.* network (which I don't control) did not have the gateway configured. I tested the subnets with a computer on each end, correctly configured with a GW, and it worked fine.

[Flavio Miranda]

Hi

The only file I see is the PDF with topology. Did you add  more file?

[Brian Taylor]

I decided to delete them because they were not needed to locate the problem and the code I published is enough to see a working solution.