No connection to VLAN IP Interface from outside of Subnet

[tgt]

Hello,

we have a couple of CBS350, and after Updating them to Version 3.3.x we where no longer able to access the VLAN IP Interface from outside of the subnet.

I have tried back and forth with:
- default route
- ip routing
- VLAN Allow lists
- No Access-Lists are configured

I have no clue on why that is.

I can ping other Switches in the same Subnet 10.20.1.1 -> 10.20.1.50 but not the Default Gateway (10.20.1.254) 

Packet Capture in the Firewall (Default Gateway) shows that the ICMP Reply is send to the correct Interface with the correct VLAN Tag.

Anybody any Idea?

[Richard Burts]

I do not have experience with CBS350 so am not clear how to get the information I want to see. On Catalyst switches I would ask for the output of show ip interface brief to verify that interface vlan 201 is in the up state. Can you provide that output from your switch?

Also on Catalyst switches I would ask for the output of show interface trunk to verify that vlan 201 is included in the active trunks. Can you provide that output from your switch?

[tgt]

Hi, 

I had attached the running config of the switch in the Original Post. There you can find that the Port-Channel have all vlans allowed. 

And yes, the Interfaces are "up".

[Flavio Miranda]

Hi

 When problems arise after software upgrade I suspect of bug and not misconfiguration.

 I went through the release notes  of 3.3.x but failed to find a known bug with similar behavior but it can be a new one.

 I would downgrade at least one device just to make sure.

[Richard Burts]

I am wondering about this in the original post "Packet Capture in the Firewall (Default Gateway) shows that the ICMP Reply is send to the correct Interface with the correct VLAN Tag." Am I correct in understanding that packet capture on the firewall shows the ping request received and a response sent, but not received at the originating device? What was the originating device? It is good that the reply had the correct vlan tag. Did it have the correct destination mac address?

[tgt]

Hi,

Destination and Source MAC Addresses do match.

The Source of the Request is the Destination of the reply.

[tgt]

Hi,

I have tried downgrading one switch to the last known good. But I was not able to get the configuration back up running.

[paul driver]

Hello

---

@tgt wrote:

Hello,

we have a couple of CBS350, and after Updating them to Version 3.3.x we where no longer able to access the VLAN IP Interface from outside of the subnet.

Anybody any Idea?

---

From your L3 routing switch/rtr ( 10.20.1.254) if vlan 201 isn’t being advertised to the other subnets then that would be the reason
So from 10.20.1.254 can you ping 10.20.1.1 sourced from another active L3 interface

[tgt]

Hi, 

the router is our firewall that is aware of the vlan and the traffic is allowed. It has worked before.

We see in the firewall log that other traffic is routed to the switch (snmp requests and other ping requests).

But it seams that switch is dropping all requests to the vlan ip interface. 

[Richard Burts]

Thank you for the additional information. It is interesting that the ping request does reach the firewall. And interesting that the source mac and destination mac match up. Am I correct in assuming that the ping is from the switch and not from some connected device? In the packet capture is the destination mac the mac of the switch?

Can you tell us how the firewall connects to the switch (which interface of the switch)?

[tgt]

Hi,

yes, the destination mac is the mac of the switch. And yes, the ping is from the switch itself (via ssh to the oob interface)

The Firewall is connected to Port-Channel 1 (Switchport 1/0/11 and 2/0/11)

[Richard Burts]

Thank you for the additional information. Am I correct in understanding that the problem is only about ping from the switch to the firewall? Ping from the switch to other devices in the network work? Other traffic from the switch to the firewall works?

I am wondering about the oob interface. What happens if you remove the IP address from that interface?

What kind of firewall is this? Are you sure that ping from the switch to the firewall used to work? Some of the firewalls that I have worked with have a security policy that suppresses response to ping request to firewall interfaces. I wonder if that might be the situation here?

[tgt]

No, the problem is about reaching the VLAN IP Interface (ping, ssh or https)

That is why I do not want to remove the IP from the OOB Interface, because that is right now my only way to access the switch.

[tgt]

Update:

It seams that the switch was not able to register the ARP Reply.

After adding the ARP Entry for the Gateway the communication works mostly. Still not 100%.