ā02-22-2024 01:38 AM - edited ā02-22-2024 02:57 AM
Hi,
I have a core switch 6509 on core. It has many SVI for intervlan routing. we have defined a vlan on it for guest (vlan id 202) with no svi defined on it. A port in access mode in vlan202 is connected to a separate ISP ONT for internet connectivity. this guest vlan is transported from core switch to other switches and then broadcasted via APs.
I have a client subnet whose svi is defined on above core switch and clients from that subnet (e.g. vl50) are able to ping a client on guest vlan 202.
There is no SVI for vl 202 on core, i.e. gatway for guest vlan is defined on isp ont.
However i cannot ping the client ip from core switch sourcing the traffic from the gateway ip of vlan50 while a client from this subnet can ping the guest ip.
When I checked checked in Wireshark from client on vlan 50, the mac address for ip from guest vlan id is showing as a mac on core switch. that mac as per below results belongs to all vlans but not for vlan 202.
sh mac address-table | i 000f.3501.1800
* 11 000f.3501.1800 static No - Router
* 9 000f.3501.1800 static No - Router
* 15 000f.3501.1800 static No - Router
* 13 000f.3501.1800 static No - Router
* 26 000f.3501.1800 static No - Router
* 27 000f.3501.1800 static No - Router
* 24 000f.3501.1800 static No - Router
* 25 000f.3501.1800 static No - Router
* 30 000f.3501.1800 static No - Router
* 31 000f.3501.1800 static No - Router
* 28 000f.3501.1800 static No - Router
* 29 000f.3501.1800 static No - Router
* 18 000f.3501.1800 static No - Router
* 17 000f.3501.1800 static No - Router
* 20 000f.3501.1800 static No - Router
* 21 000f.3501.1800 static No - Router
* 40 000f.3501.1800 static No - Router
* 42 000f.3501.1800 static No - Router
* 45 000f.3501.1800 static No - Router
* 46 000f.3501.1800 static No - Router
* 33 000f.3501.1800 static No - Router
* 35 000f.3501.1800 static No - Router
* 34 000f.3501.1800 static No - Router
* 37 000f.3501.1800 static No - Router
* 36 000f.3501.1800 static No - Router
* 39 000f.3501.1800 static No - Router
* 38 000f.3501.1800 static No - Router
* 58 000f.3501.1800 static No - Router
* 48 000f.3501.1800 static No - Router
* 49 000f.3501.1800 static No - Router
* 50 000f.3501.1800 static No - Router
* 102 000f.3501.1800 static No - Router
* 101 000f.3501.1800 static No - Router
* 203 000f.3501.1800 static No - Router
* 200 000f.3501.1800 static No - Router
* 206 000f.3501.1800 static No - Router
* 207 000f.3501.1800 static No - Router
* 204 000f.3501.1800 static No - Router
* 205 000f.3501.1800 static No - Router
* 210 000f.3501.1800 static No - Router
* 215 000f.3501.1800 static No - Router
* 254 000f.3501.1800 static No - Router
I have added null 0 route for that client subnet and till communication is possible.
sh ip route 192.168.18.0 255.255.255.0
Routing entry for 192.168.18.0/24
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
Any idea what's happening here ?
ā02-22-2024 06:15 AM - edited ā02-22-2024 06:41 AM
There should be some where these routes are learning able to reach each other,
try traceroute and find out what hops they going to complete the reachability.
ā02-22-2024 09:45 PM - edited ā02-22-2024 10:00 PM
Here is the trace result. i am tracing from a subnet whose svi is defined on core switch.(vl50,ip 10.11.15.x/24). Note i am getting timeouts for first hop. but when i trace any other ip from my pc on vl50 e.g i get the first hop ip that is svi on core sw.
tracert -d 192.168.18.75
Tracing route to 192.168.18.75 over a maximum of 30 hops
1 * * * Request timed out.
2 3 ms 29 ms 7 ms 192.168.18.75
ā02-24-2024 11:28 PM
Looks for me 1st hop aware that route - so you need to do Wireshark,
ā02-22-2024 06:25 AM
even if there is no SVI for guest VLAN if the SW use ISP router as default route then the inter-vlan happened in ISP router not in 6500 SW
MHM
ā02-22-2024 10:12 PM
the isp router/ont has two interfaces one wan side connected to their network for internet access and the other is lan side which is acting as gateway for vl 202 it has 192.168.18.1 ip assigned to it.
there is no svi for vl 202 on core swi.
no route to 192.168.18.0/24 or any ip for this subnet on core switch.
moreover the isp ont has no route for any 10.11.15.0/24 subnet back. its simple ont that is nating lan side to wan side .thats it.
ā02-25-2024 02:11 AM
host in VLAN 50 need to connect to guest in VLAN 202
the Path will be
the Host send to GW which is SVI in Core SW, the Core SW use default route toward ISP router the ISP router have prefix connect to Core and SVI of VLAN 202 so it can Inter-VLAN, and reply to host in VLAN50.
how can isolation this traffic ? you need to apply ACL in ISP router direction IN for any source from VLAN50 to VLAN202 the traffic will drop
MHM
ā02-26-2024 08:58 PM
host in VLAN 50 need to connect to guest in VLAN 202
the Path will be
the Host send to GW which is SVI in Core SW, the Core SW use default route toward ISP router the ISP router have prefix connect to Core and SVI of VLAN 202 so it can Inter-VLAN, and reply to host in VLAN50.
how can isolation this traffic ? you need to apply ACL in ISP router direction IN for any source from VLAN50 to VLAN202 the traffic will drop
the core is not using default route as i have below route defined
ip route 192.168.18.0 255.255.255.0 Null0
sh ip route 192.168.18.75
Routing entry for 192.168.18.0/24
Known via "static", distance 1, metric 0 (connected)
Routing Descriptor Blocks:
* directly connected, via Null0
Route metric is 0, traffic share count is 1
guest has only an interface in core switch in vlan 202 no svi defined on core . the isp route has 2 interfaces one physically connected to core switch which is in vlan 202. the other interface of isp router is connected via fiber optic to isp network directly. and default route on isp router will forward all traffic to isp network.
ā02-26-2024 09:17 PM
First inter-vlan can happened between
Vlan vlan' vlan direct connect ' vlan static route etc.
The null0 should be working if
The mask is correct
There is no pbr override rib
There is any NAT change IP
MHM
ā02-26-2024 08:49 PM
Intervlan cannot happen on isp router which is actually ONT.
one interface of isp router which is having the gateway ip of 192.168.18.1 and the other has a live ip which is physically isolated from our network. and it points to isp network. so no way for intervaln there.
ā02-24-2024 11:42 PM
Hello @Wonxie ,
the traffic sourced from VLAN 50 matches the following entry:
* 50 000f.3501.1800 static No - Router
because no SVI is defined on VLAN 202 the destination traffic will follow the default route.
Now, if you want to silently drop traffic to the guest subnet you need a static route to null0 on the C6509 for the guest subnet
>> I have added null 0 route for that client subnet and till communication is possible.
You need a static to null0 for the destination guest subnet not for the source address of VLAN 50.
Try to do this and you should be able to solve this.
Hope to help
Giuseppe
ā02-26-2024 09:00 PM
please see above reply .
i already have a null0 route and its matched for that subnet.
ā02-27-2024 04:08 AM - edited ā02-27-2024 04:23 AM
this is resolved it was one of aruba instant ap that had local routing enabled in it.
I disabled that and it worked.
Thanks a lot for your support
@MHM Cisco World @Giuseppe Larosa @balaji.bandi
ā02-27-2024 05:09 AM
Friend
You are so welcome
MHM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide