cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
195
Views
15
Helpful
10
Replies
Beginner

Router can ping 8.8.8.8 but vlan clients can't

Hi

 

We have got a setup with a Pfsense box as the firewall between LAN and WAN.

 

Quick example overview:

      Firewall

            ^

            l

            l

fa1----R1---fa0

    l                 l

    l  fa0/21     l fa0/21

   S1             S2

 

 

Our problem is that our VLAN clients on the L2 switches (5, 10, 20, 30 and 99) aren't able to ping the firewall (192.168.2.2)

 

Router: Cisco 1811

Switches: 2960

 

All clients can ping the router and the router can ping 8.8.8.8.

 

R1#show running-config
Building configuration...

Current configuration : 2208 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable password cisco
!
no aaa new-model
!
!
dot11 syslog
ip source-route
!
!
!
!
ip cef
ip domain name cybercenter.local
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
username cisco password 0 cisco
!
!
!
archive
log config
hidekeys
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
interface FastEthernet0
no ip address
duplex auto
speed auto
!
interface FastEthernet0.5
encapsulation dot1Q 5
ip address 192.168.5.1 255.255.255.0
ip ospf 1 area 0
!
interface FastEthernet0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
ip ospf 1 area 0
!
interface FastEthernet0.99
encapsulation dot1Q 99
ip address 192.168.99.1 255.255.255.0
ip ospf 1 area 0
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet1.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
ip ospf 1 area 0
!
interface FastEthernet1.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip ospf 1 area 0
!
interface FastEthernet2
switchport access vlan 2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface FastEthernet9
!
interface Vlan1
no ip address
shutdown
!
interface Vlan2
ip address 192.168.2.1 255.255.255.0
ip ospf 1 area 0
!
interface Async1
no ip address
encapsulation slip
!
router ospf 1
log-adjacency-changes
network 192.168.0.0 0.0.0.255 area 0
network 192.168.2.0 0.0.0.255 area 0
network 192.168.10.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
network 192.168.30.0 0.0.0.255 area 0
network 192.168.99.0 0.0.0.255 area 0
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.2.2
ip route 0.0.0.0 0.0.0.0 FastEthernet2
no ip http server
no ip http secure-server
!
!
!
!
!
!
!
!
!
control-plane
!
!
line con 0
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
login local
transport input ssh
!
end

 

 

And we have set the the interface which goes to the router as "switchport mode trunk"

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Guru

Re: Router can ping 8.8.8.8 but vlan clients can't

 

If you are not allowed to use any routing (dynamic or static routes) then what you need to do is setup NAT on your router so all the LAN subnet IPs are translated to the 192.168.2.1 IP address which the pfSense does not need a route for as it is directly connected. 

 

Jon

10 REPLIES 10
Hall of Fame Guru

Re: Router can ping 8.8.8.8 but vlan clients can't

 

Does the pfSense have routes to the LAN subnets ? 

 

Jon

Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

Route.jpg

I can also add static routes to the LAN through Pfsense but I think it's supposed to be like this

Hall of Fame Guru

Re: Router can ping 8.8.8.8 but vlan clients can't

 

I don't think those routes are right. 

 

Firstly they have a /32 subnet mask which is incorrect and secondly if I understand your topology correctly the routes should use the LAN interface on the pfSense. 

 

Jon

Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

Ah! You are right. Testing it out now

Also setting them to LAN now
Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

You are a life saviour but I just found out that we aren't allowed to use routing on the Pfsense by our teacher...

 

Guess I will try some workarounds on the router

Hall of Fame Guru

Re: Router can ping 8.8.8.8 but vlan clients can't

 

If you are not allowed to use any routing (dynamic or static routes) then what you need to do is setup NAT on your router so all the LAN subnet IPs are translated to the 192.168.2.1 IP address which the pfSense does not need a route for as it is directly connected. 

 

Jon

Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

Thank you!

Now we have access to the firewall from the clients and we can also ping 8.8.8.8. We just can't get proper internet access yet

Perhaps we need to fiddle with the firewall settings on Pfsense.

Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

We have found out it's a DNS problem from our server.

 

My group and I will find out the issue. Thanks for you help again

VIP Advisor

Re: Router can ping 8.8.8.8 but vlan clients can't

Hi there,

Since you are not NATing the traffic sources from your local subnets which are routed by the 1811, you will need to configure the pfsense box with the correct static routes (or configure OSPF and establish an adjacency), something like:

 

!
ip route 192.168.5.0 255.255.255.0 192.168.2.1
ip route 192.168.10.0 255.255.255.0 192.168.2.1
ip route 192.168.20.0 255.255.255.0 192.168.2.1
ip route 192.168.30.0 255.255.255.0 192.168.2.1
ip route 192.168.99.0 255.255.255.0 192.168.2.1
!

cheers,

Seb.

Highlighted
Beginner

Re: Router can ping 8.8.8.8 but vlan clients can't

Hi! I'm getting this error

%Invalid next hop address (it's this router)
CreatePlease to create content
Content for Community-Ad