Switch L3 routing

MarkoAnastasov45813 · ‎02-09-2020

Hello guys!

I have trouble to connect my L3 switch outside internet and I can not understand where is my wrong.

Please see my config for switch L3 and router.

Thank you in advance .

L3

Gateway of last resort is 172.16.2.0 to network 0.0.0.0

C 192.168.10.0/24 is directly connected, Vlan10
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.2.0 is directly connected, FastEthernet0/24
C 192.168.20.0/24 is directly connected, Vlan20
S 192.168.0.0/24 [1/0] via 172.16.2.1
S* 0.0.0.0/0 [1/0] via 172.16.2.0

sw3550n1#show run
Building configuration...

Current configuration : 4445 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname sw3550n1
!
enable secret 5 $1$VIC4$U0HG10TFVT1daFvvWuQM21
enable password cisco
!
no aaa new-model
ip subnet-zero
ip routing
ip dhcp excluded-address 192.168.20.1 192.168.20.20
ip dhcp excluded-address 192.168.10.1 192.168.10.20
!
ip dhcp pool 10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
!
ip dhcp pool 20
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
!
!
!
crypto pki trustpoint TP-self-signed-2417349888
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2417349888
revocation-check none
rsakeypair TP-self-signed-2417349888
!
!
crypto pki certificate chain TP-self-signed-2417349888
certificate self-signed 01
30820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32343137 33343938 3838301E 170D3933 30333031 30303031
30345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 34313733
34393838 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B13B 5005F6C8 51554B3F BAB1032B 2A8BB5C1 102CFBEB A1B3B024 A063B2AD
B5DED03C E3175904 246C4E40 567F225A 5AE55F32 9D700DE9 F93C1E56 DEFBA519
14534460 E097FBB8 A0584B1B 128BD602 5BA710EF D9B8761A F58B75F2 2D225238
CCEE3758 625AECCA 4C9514FF F3C90E87 8E808DB0 14C77790 A0E87343 D07B0183
4F810203 010001A3 69306730 0F060355 1D130101 FF040530 030101FF 30140603
551D1104 0D300B82 09737733 3535306E 312E301F 0603551D 23041830 1680144B
FC3FBF1A 800CAC4D 329BF730 9B0F4CAF 9D76C430 1D060355 1D0E0416 04144BFC
3FBF1A80 0CAC4D32 9BF7309B 0F4CAF9D 76C4300D 06092A86 4886F70D 01010405
00038181 0084FD9D 9AD9492A E8AB586B 857B4AA2 912BD897 CFFDAEA2 DFD7560D
D06F3E59 DC01172D A701492F CA46923A 831C1174 6EE5B76B C65024E4 7B06679B
867160F7 00CA0A86 990F952D E7D44536 4A84A7C5 48647123 AE878D39 CC0F2C24
6DAB3EE9 64E0EAFB E854932E 1EA55950 B08B44F8 DA68A32D 54B7D5D9 5466E831
C6183E6D 5F
quit
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0/1
switchport mode access
!
interface FastEthernet0/2
switchport mode dynamic desirable
!
interface FastEthernet0/3
switchport mode dynamic desirable
!
interface FastEthernet0/4
switchport mode dynamic desirable
!
interface FastEthernet0/5
switchport mode access
!
interface FastEthernet0/6
switchport mode dynamic desirable
!
interface FastEthernet0/7
switchport mode dynamic desirable
!
interface FastEthernet0/8
switchport mode dynamic desirable
!
interface FastEthernet0/9
switchport mode dynamic desirable
!
interface FastEthernet0/10
switchport access vlan 10
switchport mode access
!
interface FastEthernet0/11
switchport mode dynamic desirable
!
interface FastEthernet0/12
switchport mode dynamic desirable
!
interface FastEthernet0/13
switchport mode dynamic desirable
!
interface FastEthernet0/14
switchport mode dynamic desirable
!
interface FastEthernet0/15
switchport mode dynamic desirable
!
interface FastEthernet0/16
switchport mode dynamic desirable
!
interface FastEthernet0/17
switchport mode dynamic desirable
!
interface FastEthernet0/18
switchport mode dynamic desirable
!
interface FastEthernet0/19
switchport mode dynamic desirable
!
interface FastEthernet0/20
switchport access vlan 20
switchport mode access
!
interface FastEthernet0/21
switchport mode dynamic desirable
!
interface FastEthernet0/22
switchport mode dynamic desirable
!
interface FastEthernet0/23
switchport mode dynamic desirable
!
interface FastEthernet0/24
no switchport
ip address 172.16.2.21 255.255.255.0
!
interface GigabitEthernet0/1
switchport mode dynamic desirable
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
!
interface Vlan1
no ip address
!
interface Vlan10
ip address 192.168.10.1 255.255.255.0
!
interface Vlan20
ip address 192.168.20.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.2.0
ip route 192.168.0.0 255.255.255.0 172.16.2.1
ip http server
ip http secure-server
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
line vty 0 4
password cisco
login
line vty 5 15
password cisco
login
!
end

Router config:

Router#show run
Building configuration...

Current configuration : 1112 bytes
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Router
!
!
ip subnet-zero
!
!
ip dhcp excluded-address 172.16.2.1 172.16.2.20
!
ip dhcp pool soho
network 172.16.2.0 255.255.255.0
default-router 172.16.2.1
dns-server 8.8.8.8
!
call rsvp-sync
!
!
!
!
!
!
!
!
interface FastEthernet0/0
ip address dhcp
ip access-group 1 out
ip nat outside
duplex auto
speed auto
!
interface Serial0/0
no ip address
shutdown
no fair-queue
!
interface BRI0/0
no ip address
encapsulation hdlc
shutdown
!
interface FastEthernet0/1
ip address 172.16.2.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
ip nat inside source list 1 interface FastEthernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
ip route 192.168.10.0 255.255.255.0 172.16.2.21
ip route 192.168.20.0 255.255.255.0 172.16.2.21
ip http server
!
access-list 1 permit 172.16.2.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
!
dial-peer cor custom
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
end

Router#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S 192.168.10.0/24 [1/0] via 172.16.2.21
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.2.0 is directly connected, FastEthernet0/1
S 192.168.20.0/24 [1/0] via 172.16.2.21
C 192.168.0.0/24 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 is directly connected, FastEthernet0/0

Router#show access-lists
Standard IP access list 1
permit 172.16.2.0, wildcard bits 0.0.0.255
permit 192.168.10.0, wildcard bits 0.0.0.255
permit 192.168.20.0, wildcard bits 0.0.0.255
Router#

balaji.bandi · ‎02-09-2020

You like from externally connecting to your Local Switch.

1, you need to enable SSH

ip domain-name bb.com  <<- change this as per requirement
crypto key generate rsa

 line vty 0 4
(config-line)# transport input ssh
(config-line)# login local

(config)#line VTY 0 15
(config-line)#Transport preferred ssh

create a username and password
enable secret
service password encryption

Test Locally you able to connect with Switch IP address - Once this confirme

You need to make NAT Rule to allow from router to back to Switch IP address ( based on your Public IP address)

example guide : (this is for IP, and you can do port translation also along)

https://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13773-2.html

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

paul driver · ‎02-09-2020

Hello

make the following changes and test again

switch

no ip route 0.0.0.0 0.0.0.0 172.16.2.0

no ip route 192.168.0.0 255.255.255.0 172.16.2.21

ip route 0.0.0.0 0.0.0.0 fa0/24 172.16.2.1

router

remove access-list from fa0/0 interface then

no ip route 0.0.0.0 0.0.0.0 FastEthernet0/0

ip route 0.0.0.0 0.0.0.0 fa0/0 dhcp

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Jaderson Pessoa · ‎02-09-2020

@MarkoAnastasov45813 Hello friend,

I think that your problem it is only this: ip route 0.0.0.0 0.0.0.0 172.16.2.0 <<< change to >> ip route 0.0.0.0 0.0.0.0 172.16.2.1

Jaderson Pessoa
*** Rate All Helpful Responses ***

MarkoAnastasov45813 · ‎02-09-2020

Thank you very much!

MarkoAnastasov45813 · ‎02-09-2020

Thank you so much to everyone. I appreciate your help!

Unfortunately still not work. I believe that all ip route is ok and the problem coming from NAT config no idea ho to fix it.

Please help

I have Access list 1 and point to Fa 0/0.

access-list 1 permit 172.16.2.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 1 permit 192.168.0.0 0.0.0.255

I have this.

interface FastEthernet0/0
ip address dhcp
ip nat outside

interface FastEthernet0/1
ip address 172.16.2.1 255.255.255.0
ip nat inside
duplex auto
speed auto
!
ip nat inside source list 1 interface FastEthernet0/0 overload

Ip route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S 192.168.10.0/24 [1/0] via 172.16.2.21
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.2.0 is directly connected, FastEthernet0/1
S 192.168.20.0/24 [1/0] via 172.16.2.21
C 192.168.0.0/24 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 is directly connected, FastEthernet0/0

Jaderson Pessoa · ‎02-09-2020

@MarkoAnastasov45813 Ok, let's try together.

try it:

on your L3 switche, remove it:

no ip route 0.0.0.0 0.0.0.0 172.16.2.0
and add it

no ip route 0.0.0.0 0.0.0.0 172.16.2.1

on your ROUTER, remove it:

interface FastEthernet0/0
ip address dhcp
no ip access-group 1 out

and test again.

Jaderson Pessoa
*** Rate All Helpful Responses ***