Can't Ping/Remote to my Access Layer Switches

[Terence Lockette]

Hello all,

I have a weird issue.  We had an issue last night that wrecked havoc on our network that mainly affected our workstations.  Apparently, an MBAM definition file quarantined a certain DLL file that caused our PCs to crash.  I don't see how this would affect our switches or any infrastructure devices but now I can't ping or remotely access our access layer switches from my my laptop.  I'm connected through an SSL VPN connection.  I get a DHCP address from the secure gateway on subnet 192.168.65.0/26.  Routes are in place to the core of my network (10.1.0.0/16).  Both core and access layer switches are all part of the 10.1.0.0/16 network.  I can access the core switches while VPN'd in but not the access layer switches nor can I ping them.  Any ideas?

Terence

[Bilal Nawaz]

From the core switch's can you see your trunks as 'up' and do you see cdp info?

If you do a 'show cdp neigh detail' the ip address of the neighbor, if it has one will be in the output. Can you ping your access switches from your Core?

Please rate useful posts and remember to mark any solved questions as answered. Thank you.

[Terence Lockette]

Hello,

From the core switches, I can ping, telnet, and view CDP related info to all my other switches.

[Bilal Nawaz]

Okay, so your LAN is OK.

It might be a rule-set on the firewall where your VPN is terminating on that needs to be checked? Do you see any permit's / deny's on the FW logs for your IP when trying to telnet?

Also is the management SVIs for the access switches in the same network as your Core SVI that you are connecting to?

Please rate useful posts and remember to mark any solved questions as answered. Thank you.

[Terence Lockette]

Hello,

I don't have any FW rules set on this device because we have an ASA on the inside of our network that handles the FW rules.  The secure VPN gateway only terminates the SSL VPN connections.  It worked fine yesterday but now it's not working.

[Bilal Nawaz]

Also is the management SVIs for the access switches in the same network as your Core SVI that you are connecting to?

Please rate useful posts and remember to mark any solved questions as answered. Thank you.

[Terence Lockette]

Yes.  All switches (core and access layer) are all in the same subnet (10.1.0.0/16).

[Terence Lockette]

Does anyone have any possible causes and/or solution to this weird issue.  Just to reiterate, I'm connecting to my corporate network via an SSL VPN connection using the Cisco AnyConnect client.  The client terminates to the ISA570 secure gateway.  I'm sending routes through the VPN to the client on all major networks contained on our LAN.  The core and access layer switches are all on the 10.1.0.0/16 network.  I can ping my core switches as well as telnet to them.  However, I can't ping or telnet to my access layer switches.  When I do a tracert from my machine, it his my SSL VPN gateway then the core switch and then dies from there.  No ACLs are blocking and proper routing is in place.  I can even access other network devices across other VLANs.  I can't figure for the life of me why I can't access these devices while connected to my VPN.

[paul driver]

Hello

have a weird issue.  We had an issue last night that wrecked havoc on our network that mainly affected our workstations.  Apparently, an MBAM definition file quarantined a certain DLL file that caused our PCs to crash

maybe your looking at this from the wrong end?  Try turning your pc's Software FW and HostIPS( if applicable) off

res

Paul

Please don't forget to rate any posts that have been helpful.

Thanks.

[Terence Lockette]

I turned off all real-time protection software on my PC and its still not working.  I don't see how this could a problem anyway.  This was working before and my laptop isn't part of our domain so it didn't receive this MBAM update.  Even if it did, why would I be able to access my core switches but not my access layer switches when no config changes were made?

[paul driver]

Hello

"Even if it did, why would I be able to access my core switches but not my access layer switches when no config changes were made?"

Well It seems something has changed as now you cannot access the whole estate, so even trying the simpest things first is boxed ticked.

Have you tried another pc with vpn access

Can you restart/reload the ssl vpn box?

res

Paul

Please don't forget to rate any posts that have been helpful.

Thanks.

[Terence Lockette]

I've been in the IT industry long enough to know that you're right, haha.  The smallest thing can cause some of the strangest problems.  I do have another PC to try but I have not restarted the VPN gateway since this has occured.  I didn't think about it since my traceroute shows that I only go as far as my core switch and then times out after that.  As for trying it at another PC, I've just tried it from my personal home desktop and am getting the same thing.  I cleared the arp cache, flushed DNS and registered DNS, released/renewed my IP, and reconnected to the VPN.  Still same issue.  Also, I have compared our current running configuration with a backed up configuration of our core switches and nothing that would prevent access to any of the other switches have been configured.  Just weird!

Terence

[Terence Lockette]

Ok, here's a quick update on this issue.  I decided to see if I can ping/traceroute/telnet to another one of our access layer switches and I was successful in doing all three.  This switch is also on the same subnet as all our switches (core and access layer) which is 10.1.0.0/16.  I can't figure out right now why I can access some switches and not others while they're all on the same VLAN???

[Jeff Van Houten]

Is it possible the arp caches on the switches are corrupted?

Sent from Cisco Technical Support iPad App

[Terence Lockette]

Hello,

It's quite possible and wouldn't rule it out but I don't think so in this case.  The reason is because I can get to these switches from my PC in the office but not while I'm connected via VPN.  Here's another quick update.  We have both 4500 and 2900 series switches at the access layers and I'm able to reach the 2900 series switches from the VPN; it's only the 4500 switches I can't reach via VPN.  I did clear the arp cache and the mac address table.  The only thing I haven't done is reboot it because I want to be in the office when I do.