SSH to another VLAN

[danielsffs]

Hello everyone,

I'm setting up a lab with inter-vlan routing. I have a host in VLAN 50 (192.168.50.0/24) and 3 SG220 switches in the Management-VLAN Vlan 30 (192.168.30.0/24). A Cisco 1941 Router is doing the routing between the VLAN's. Everything is working accordingly except I'm not able to SSH into the management subnet with my host in VLAN 50. My switches have a management-vlan ip-addresses and an administrative default-gateway. However SSH is working when I put my host in an access port in vlan 30 and give it an IP-address in the 192.168.30.0/24 range. Is there some extra step to take when your using SSH into another VLAN?

Thanks in advance.

Daniel

[balaji.bandi]

If the Switches are Layer 2 only we need to look the Router config,. can you please post the configuration.,

[balaji.bandi]

thank you for the configuration,. what is the Device Default gateway configured?

from router are you able to ping those all devices IP address ?

[Giuseppe Larosa]

Hello @danielsffs ,

L2 switches must have default gateway = IP address of router in vlan 30 . 192.168.30.1 = gi0/0.30 's IP address

if they point to another device it will not work.

Also you need to take care of access-lists on C1941 if any is applied it has to allow connection to subnet 192.168.30.0 tcp eq 22

As suggested post C1941 configuration to get better help.

Edit:

I have seen your last post there is nothing on the router that can block SSH session starting from 192.168.50.X to 192.168.30.Y so check the default GW on the L2 switch it has to be 192.168.30.1 as noted above.

Hope to help

Giuseppe

[balaji.bandi]

Do you have any small network diagram of how these switches are connected back to a router, what port?

basic test from the router you should able to ping the switch management IP of the switch before we go to SSH,  - post the network diagram here.

[danielsffs]

This is the topology. But not everything is connected. The servers run on 1 laptop on a type 2 hypervisor. And I have 1 client attached now.

[danielsffs]

The Servers are connected to S1 GigabitEthernet 1. The clients trough the WAP.

[balaji.bandi]

Ok take SW1 is your exist point towards Router, So  the port-configuration of G26 should have Trunk port with the respected vlan Allowed.

S1 - S2 - S3 connected like traingle, because of the STP ( some ports are on blocking mode) - until you have only specfic VLAN allowed in the path.

on Switch 1

config t

!

no management vlan ip-address 192.168.30.101 mask 255.255.255.0

!

interface vlan 30

ip address 192.168.30.101 255.255.255.0

no shutdown

!

ping 192.168.30.1 < let us know the results.

also try ping from router 192.168.30.101  <- let us know the results.

[danielsffs]

The command interface vlan doesn't exist on these switches. They replaced it with the management vlan IP-address command. I can't ping to or from the default gateway but I can ping the other switches. Thanks for your reply btw

[balaji.bandi]

i was in the impression it was SG35X above and configured as Layer3, if this is only Layer 2

by default management vlan is VLAN1

change that to vlan 30 as per the IP and test please

management-vlan vlan 30

ping 192.168.30.1 < let us know the results.

also try ping from router 192.168.30.101  <- let us know the results.

[danielsffs]

Thanks for all your effort, it's much appreciated! I'll try to be a little bit more clear in the future.

[Georg Pauwen · Accepted solution]

Hello,

since you have set the default Vlan on the SG220 switches to Vlan 30, that means that Vlan 30 is the untagged Vlan.

On the router, try and add the keyword 'native' to the Vlan 30 subinterface:

interface GigabitEthernet0/0.30
encapsulation dot1Q 30 native
ip address 192.168.30.1 255.255.255.0

[danielsffs]

This was it! Thanks for the reply. I could ping the sub-interface and ssh into my switch.