Can't ping IP of IP Phone outside of directly connected switch or gateway

[BrettWelch55227]

I have a 3850 acting as a layer 2 switch with a brand new IP phone connected to it. The L2 3850 is connected via ethernet to another 3850 which is acting as our layer 3 gateway. Both of these devices can ping the phone and the DCHP server does see the phone but the call manager and other devices not directly connected or acting as the gateway cannot reach the phone. We are running EIGRP and all the directly connected next hops can ping the layer 3 switch gateway and the layer 2 switch management IP but not the phone.

Any ideas?

[Richard Burts]

We do not have much detail to work with about this issue. Can you provide some information about the configuration of the switch port on which the phone is connected? Also information about configuration of the vlan to which the phone is connected. Am I correct in understanding that the phone does successfully get an IP address from the DHCP server? Can you provide some information from the layer 3 switch, including the configuration of its interface connecting to the layer 2 switch, its configuration of its vlan interfaces, the output of the command show ip route.

Based on the little bit of information that we have at this point my first guess is that there is some issue about the IP address, subnet mask, and gateway of the phone. Can you provide the details of these from the phone?

[BrettWelch55227]

Hi Rick,

Sorry about the lack of detail.

The phone is getting an IP address from our server, I haven't been able to check if it is getting the proper network settings but when it was tested in office it worked fine but now that it's deployed to the field it is not.

The L2 switch hands off vlan 10 for data and vlan 20 for voice, the uplink to the L3 switch is a trunk that specifically allows vlans 10 and 20.

The L3 switch hands off to the L2 switch as a trunk also allowing vlans 10 and 20. There are vlan interfaces for both 10 and 20 that are the gateways for them. IP Helper is enabled on both virtual interfaces. The uplinks from the L3 switch to the rest of the network are all /30 subnets with specific vlans for those connections.

We use EIGRP and redistribute connected routes via our L3 switches so everything in the chain knows how to get to the subnet but cannot ping this phone.

This is the relevant subnets from the L3 switch and truncated ip route info from upstream L3 switches:

On site L3:

C 172.23.38.0/24 is directly connected, Vlan10
L 172.23.38.1/32 is directly connected, Vlan10
C 172.23.39.0/24 is directly connected, Vlan20
L 172.23.39.1/32 is directly connected, Vlan20

Next hop:

#show ip route | in 172.23.39
D 172.23.39.0/24 [90/3072] via 172.23.255.178, 4w0d, Vlan204

So the network knows about this subnet and a device residing on the data network at this site does respond to ICMP so it seems to be limited to this phone?

[Nithin Eluvathingal]

The L3 switch hands off to the L2 switch as a trunk also allowing vlans 10 and 20. There are vlan interfaces for both 10 and 20 that are the gateways for them. IP Helper is enabled on both virtual interfaces. The uplinks from the L3 switch to the rest of the network are all /30 subnets with specific vlans for those connections.:--  The default gateway interface, why do you configured on a L2 switch. it should be on L3. 

Phone will not stop ICMP by default. And you have mentioned that you haven't tested if the phone gets right network setting or not.  without checking this information how do you ping ? to which IP you are trying to reach ?

[BrettWelch55227]

The gateway is on a L3 switch.

The phone gets IP 172.23.39.165 from the DHCP server, that is the IP I try to ping from outside of the directly connected devices. It responds to ICMP from both the L2 and L3 switches on site.

[Richard Burts]

Thanks for the additional information. It is nice to know what IP address the phone has. It would help if we also knew what mask and what default gateway it has.

You tell us that "when it was tested in office it worked fine but now that it's deployed to the field it is not." This certainly suggests that something in the field is configured differently that it was in the office. At this point my guess is that something in the DHCP server might be what is different. 

You tell us that the phone does respond to ping from the L3 switch. Am I correct in assuming that the phone is able to ping the L3 switch SVI for the vlan that the phone is in? If so I would suggest that you try on the phone to ping the address of a different SVI on the L3 switch. If that fails then it certainly does suggest that the issue is the default gateway that the phone is using.

[Richard Burts]

I am puzzled at this part of your post

C 172.23.39.0/24 is directly connected, Vlan20
L 172.23.39.1/32 is directly connected, Vlan20

Next hop:

#show ip route | in 172.23.39
D 172.23.39.0/24 [90/3072] via 172.23.255.178, 4w0d, Vlan204

If 172.23.39.0 is a directly connected subnet then why does show ip route show it as reached via a next hop in vlan 204?

[Nithin Eluvathingal]

Run utils network traceroute from CUCM and find out where it  gets dropped. and check the routing.