10-05-2017 03:28 AM - edited 03-08-2019 12:16 PM
Good Day,
I have 1x 5548 nexus switch running as a core with layer 3 vlans running for the server farm, storage and other vlans, on this switch I have a trunk going to a 3850 switch where the servers are connected. The switches can see each other via cdp neighbors but cant ping each other.
from the core I can ping 10.10.50.2 which is the firewall interface, but cant ping anything else in this range, and this is the server farm range. On the nexus the layer 3 is configured as
ip vlan 50
ip address 10.10.50.1 255.255.255.0
on the serfer farm switch (3850) I cant ping, lease advise what I could be missing
10-05-2017 03:39 AM
10-05-2017 04:04 AM
Hi Mark ,
Thanks for your prompt response, see attched and below output
on the nexus 5548
DIR-CORE# sh int trunk
--------------------------------------------------------------------------------
Port Native Status Port
Vlan Channel
--------------------------------------------------------------------------------
Eth1/1 1 trnk-bndl Po2
Eth1/2 1 trnk-bndl Po2
Eth1/5 1 trunking --
Eth1/31 10 trunking --
Eth1/32 10 trnk-bndl Po1
Po1 10 trunking --
Po2 1 trunking --
--------------------------------------------------------------------------------
Port Vlans Allowed on Trunk
--------------------------------------------------------------------------------
Eth1/1 1-9,11-4094
Eth1/2 1-9,11-4094
Eth1/5 1-9,11-4094
Eth1/31 10,20,30,40,50
Eth1/32 10,20,30,40,50
Po1 10,20,30,40,50
Po2 1-9,11-4094
--------------------------------------------------------------------------------
Port Vlans Err-disabled on Trunk
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 none
Po2 none
--------------------------------------------------------------------------------
Port STP Forwarding
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 10,20,30,40,50
Po2 1,20,30,40,50,494,1494,2494,3494
--------------------------------------------------------------------------------
Port Vlans in spanning tree forwarding state and not pruned
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Port Vlans Forwarding on FabricPath
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 none
Po2 none
DIR-CORE#
DIR-CORE# sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Po2, Eth1/1, Eth1/2, Eth1/5
Eth1/6, Eth1/7, Eth1/8, Eth1/9
Eth1/10, Eth1/11, Eth1/12
Eth1/13, Eth1/14, Eth1/16
Eth1/17, Eth1/18, Eth1/19
Eth1/20, Eth1/21, Eth1/22
Eth1/23, Eth1/24, Eth1/25
Eth1/26, Eth1/27, Eth1/28
Eth1/29, Eth1/30
10 Management active Po1, Eth1/3, Eth1/4, Eth1/15
Eth1/31, Eth1/32
20 VM_Public active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
30 Ceph_PVT active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
40 Ceph_PUB active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
50 Svr_Farm active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
494 VLAN0494 active Po2, Eth1/1, Eth1/2, Eth1/5
1494 VLAN1494 active Po2, Eth1/1, Eth1/2, Eth1/5
2494 VLAN2494 active Po2, Eth1/1, Eth1/2, Eth1/5
3494 VLAN3494 active Po2, Eth1/1, Eth1/2, Eth1/5
VLAN Type Vlan-mode
---- ----- ----------
1 enet CE
10 enet CE
20 enet CE
30 enet CE
40 enet CE
50 enet CE
494 enet CE
1494 enet CE
2494 enet CE
3494 enet CE
Primary Secondary Type Ports
------- --------- --------------- -------------------------------------------
DIR-CORE#
DIR-CORE# sh ip arp | i 10.10.50
10.10.50.2 00:02:19 906c.acde.4a68 Vlan50
DIR-CORE#
DIR-CORE#
*******************************************************************
DIR-Access#sh vlan bri
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/4, Gi1/0/8, Gi1/0/12
Gi1/0/16, Gi1/0/20, Gi1/0/24
Gi1/0/28, Gi1/0/29, Gi1/0/30
Gi1/0/31, Gi1/0/32, Gi1/0/33
Gi1/0/34, Gi1/0/35, Gi1/0/36
Gi1/0/37, Gi1/0/38, Gi1/0/39
Gi1/0/40, Gi1/0/41, Gi1/0/42
Gi1/0/43, Gi1/0/44, Gi1/0/45
Gi1/0/46, Gi1/0/47, Gi1/0/48
Gi1/1/1, Gi1/1/2, Te1/1/3
10 Management active Gi1/0/1, Gi1/0/5, Gi1/0/9
Gi1/0/13, Gi1/0/17, Gi1/0/21
Gi1/0/25
50 SVR_Farm active Gi1/0/2, Gi1/0/3, Gi1/0/6
Gi1/0/7, Gi1/0/10, Gi1/0/11
Gi1/0/14, Gi1/0/15, Gi1/0/18
Gi1/0/19, Gi1/0/22, Gi1/0/23
Gi1/0/26, Gi1/0/27
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
DIR-Access#
DIR-Access#conf t
Enter configuration commands, one per line. End with CNTL/Z.
DIR-Access(config)#vlan 50
DIR-Access(config-vlan)#name Svr_Farm
DIR-Access(config-vlan)#
DIR-Access(config-vlan)#
DIR-Access(config-vlan)#exit
DIR-Access#sh int trunk
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 10
Port Vlans allowed on trunk
Po1 10,20,30,40,50
Port Vlans allowed and active in management domain
Po1 10,50
Port Vlans in spanning tree forwarding state and not pruned
Po1 none
DIR-Access#
DIR-Access#
10-05-2017 04:46 AM
Hiythis is just first glance but the trunk links dont match ,between core and access , one of them is specifiying vlan 10 as the native the other not , if your going to use a native use it both ends or not at all
second thing i see is on access switch the vlan is not being forwarded so theres no l2 for that vlan in STP on the access side hence why reachabilitys not worting , why is the vlan being blocked because the L2 name is incorrect between the switches in the L2 DB
Names are case sensitive , correct this and the trunk
50 Svr_Farm
50 SVR_Farm
Port Vlans in spanning tree forwarding state and not pruned
Po1 none
The core is forwarding it
Port STP Forwarding
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 10,20,30,40,50
10-05-2017 05:23 AM
Thanks I changed it, still same issue, tried to ping the next hop (3850) from the nexus and it says theres no route to host
DIR-CORE# sh cdp nei det
----------------------------------------
Device ID:DIR-Access
VTP Management Domain Name:
Interface address(es):
IPv4 Address: 146.64.74.4
Platform: WS-C3850-48T, Capabilities: Router Switch IGMP Filtering
Interface: Ethernet1/32, Port ID (outgoing port): TenGigabitEthernet1/1/4
Holdtime: 179 sec
Version:
Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Versi
on 15.2(2)E6, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Sat 17-Dec-16 00:22 by prod_rel_team
Advertisement Version: 2
Native VLAN: 10
Duplex: full
Mgmt address(es):
IPv4 Address: 146.64.74.4
DIR-CORE# ping 146.64.74.4
PING 146.64.74.4 (146.64.74.4): 56 data bytes
ping: sendto 146.64.74.4 64 chars, No route to host
Request 0 timed out
ping: sendto 146.64.74.4 64 chars, No route to host
Request 1 timed out
ping: sendto 146.64.74.4 64 chars, No route to host
Request 2 timed out
DIR-Access#sh int trunk
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 10
Port Vlans allowed on trunk
Po1 10,20,30,40,50
Port Vlans allowed and active in management domain
Po1 10,50
Port Vlans in spanning tree forwarding state and not pruned
Po1 10,50
DIR-Access#
IR-Access#sh int trunk
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 10
Port Vlans allowed on trunk
Po1 10,20,30,40,50
Port Vlans allowed and active in management domain
Po1 10,50
Port Vlans in spanning tree forwarding state and not pruned
Po1 10,50
DIR-Access#
interface TenGigabitEthernet1/1/4
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30,40,50
switchport mode trunk
channel-group 1 mode on
end
DIR-Access#sh run int po1
Building configuration...
Current configuration : 133 bytes
!
interface Port-channel1
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30,40,50
switchport mode trunk
**************************************************
DIR-CORE# sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Po2, Eth1/1, Eth1/2, Eth1/5
Eth1/6, Eth1/7, Eth1/8, Eth1/9
Eth1/10, Eth1/11, Eth1/12
Eth1/13, Eth1/14, Eth1/16
Eth1/17, Eth1/18, Eth1/19
Eth1/20, Eth1/21, Eth1/22
Eth1/23, Eth1/24, Eth1/25
Eth1/26, Eth1/27, Eth1/28
Eth1/29, Eth1/30
10 Management active Po1, Eth1/3, Eth1/4, Eth1/15
Eth1/31, Eth1/32
20 VM_Public active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
30 Ceph_PVT active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
40 Ceph_PUB active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
50 Svr_Farm active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
494 VLAN0494 active Po2, Eth1/1, Eth1/2, Eth1/5
1494 VLAN1494 active Po2, Eth1/1, Eth1/2, Eth1/5
2494 VLAN2494 active Po2, Eth1/1, Eth1/2, Eth1/5
3494 VLAN3494 active Po2, Eth1/1, Eth1/2, Eth1/5
10-05-2017 05:33 AM
I can see one of the servers on the arp tabke now, but still cant ping it
DIR-CORE# sh ip arp | i 10.10.50
10.10.50.2 00:02:54 906c.acde.4a68 Vlan50
10.10.50.5 00:02:53 246e.9647.983a Vlan50
DIR-CORE#
10-05-2017 05:24 AM
Thanks I changed it, still same issue, tried to ping the next hop (3850) from the nexus and it says theres no route to host
DIR-CORE# sh cdp nei det
----------------------------------------
Device ID:DIR-Access
VTP Management Domain Name:
Interface address(es):
IPv4 Address: 146.64.74.4
Platform: WS-C3850-48T, Capabilities: Router Switch IGMP Filtering
Interface: Ethernet1/32, Port ID (outgoing port): TenGigabitEthernet1/1/4
Holdtime: 179 sec
Version:
Cisco IOS Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Versi
on 15.2(2)E6, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Sat 17-Dec-16 00:22 by prod_rel_team
Advertisement Version: 2
Native VLAN: 10
Duplex: full
Mgmt address(es):
IPv4 Address: 146.64.74.4
DIR-CORE# ping 146.64.74.4
PING 146.64.74.4 (146.64.74.4): 56 data bytes
ping: sendto 146.64.74.4 64 chars, No route to host
Request 0 timed out
ping: sendto 146.64.74.4 64 chars, No route to host
Request 1 timed out
ping: sendto 146.64.74.4 64 chars, No route to host
Request 2 timed out
10-05-2017 05:33 AM
10-05-2017 05:49 AM
Hi ,
I have added it to the trunk, yes the serve vlan 50 remains a problem
10-05-2017 05:53 AM
Ok so where is this ip 10.10.50.5 and can you ping it from the core switch as its in the arp table now ?
10.10.50.2 00:02:54 906c.acde.4a68 Vlan50
10.10.50.5 00:02:53 246e.9647.983a Vlan50
Please post the updated config changes , show vlan , show int trunk from each switch
10-05-2017 06:02 AM
10.10.50.5 is one of the servers connected on the 3850 on port gi1/0/2, I still cant ping it on the core even though its on the arp table.
DIR-CORE#
DIR-CORE# sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/6, Eth1/7, Eth1/8
Eth1/9, Eth1/10, Eth1/11
Eth1/12, Eth1/13, Eth1/14
Eth1/16, Eth1/17, Eth1/18
Eth1/19, Eth1/20, Eth1/21
Eth1/22, Eth1/23, Eth1/24
Eth1/25, Eth1/26, Eth1/27
Eth1/28, Eth1/29, Eth1/30
Eth1/32
10 Management active Po1, Eth1/3, Eth1/4, Eth1/15
Eth1/31, Eth1/32
20 VM_Public active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
30 Ceph_PVT active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
40 Ceph_PUB active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
50 Svr_Farm active Po1, Po2, Eth1/1, Eth1/2
Eth1/5, Eth1/31, Eth1/32
494 VLAN0494 active Po2, Eth1/1, Eth1/2, Eth1/5
1494 VLAN1494 active Po2, Eth1/1, Eth1/2, Eth1/5
2494 VLAN2494 active Po2, Eth1/1, Eth1/2, Eth1/5
3494 VLAN3494 active Po2, Eth1/1, Eth1/2, Eth1/5
VLAN Type Vlan-mode
---- ----- ----------
1 enet CE
10 enet CE
20 enet CE
30 enet CE
40 enet CE
50 enet CE
DIR-CORE# sh int trunk
--------------------------------------------------------------------------------
Port Native Status Port
Vlan Channel
--------------------------------------------------------------------------------
Eth1/1 1 trnk-bndl Po2
Eth1/2 1 trnk-bndl Po2
Eth1/5 1 trunking --
Eth1/31 10 trunking --
Eth1/32 10 trnk-bndl Po1
Po1 10 trunking --
Po2 1 trunking --
--------------------------------------------------------------------------------
Port Vlans Allowed on Trunk
--------------------------------------------------------------------------------
Eth1/1 1-9,11-4094
Eth1/2 1-9,11-4094
Eth1/5 1-9,11-4094
Eth1/31 10,20,30,40,50
Eth1/32 1,10,20,30,40,50
Po1 1,10,20,30,40,50
Po2 1-9,11-4094
--------------------------------------------------------------------------------
Port Vlans Err-disabled on Trunk
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 none
Po2 none
--------------------------------------------------------------------------------
Port STP Forwarding
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 1,10,20,30,40,50
Po2 1,20,30,40,50,494,1494,2494,3494
--------------------------------------------------------------------------------
Port Vlans in spanning tree forwarding state and not pruned
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
Port Vlans Forwarding on FabricPath
--------------------------------------------------------------------------------
Eth1/1 none
Eth1/2 none
Eth1/5 none
Eth1/31 none
Eth1/32 none
Po1 none
Po2
DIR-Access#sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/4, Gi1/0/8, Gi1/0/12
Gi1/0/16, Gi1/0/20, Gi1/0/24
Gi1/0/28, Gi1/0/29, Gi1/0/30
Gi1/0/31, Gi1/0/32, Gi1/0/33
Gi1/0/34, Gi1/0/35, Gi1/0/36
Gi1/0/37, Gi1/0/38, Gi1/0/39
Gi1/0/40, Gi1/0/41, Gi1/0/42
Gi1/0/43, Gi1/0/44, Gi1/0/45
Gi1/0/46, Gi1/0/47, Gi1/0/48
Gi1/1/1, Gi1/1/2, Te1/1/3
10 Management active Gi1/0/1, Gi1/0/5, Gi1/0/9
Gi1/0/13, Gi1/0/17, Gi1/0/21
Gi1/0/25
50 Svr_Farm active Gi1/0/2, Gi1/0/3, Gi1/0/6
Gi1/0/7, Gi1/0/10, Gi1/0/11
Gi1/0/14, Gi1/0/15, Gi1/0/18
Gi1/0/19, Gi1/0/22, Gi1/0/23
Gi1/0/26, Gi1/0/27
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsup
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------
1 enet 100001 1500 - - - - - 0 0
10 enet 100010 1500 - - - - - 0 0
50 enet 100050 1500 - - - - - 0 0
1002 fddi 101002 1500 - - - - - 0 0
1003 tr 101003 1500 - - - - - 0 0
1004 fdnet 101004 1500 - - - ieee - 0 0
1005 trnet 101005 1500 - - - ibm - 0 0
Remote SPAN VLANs
------------------------------------------------------------------------------
Primary Secondary Type Ports
------- --------- ----------------- ------------------------------------------
DIR-Access#
DIR-Access#sh int trunk
Port Mode Encapsulation Status Native vlan
Po1 on 802.1q trunking 10
Port Vlans allowed on trunk
Po1 1,10,20,30,40,50
Port Vlans allowed and active in management domain
Po1 1,10,50
Port Vlans in spanning tree forwarding state and not pruned
Po1 1,10,50
DIR-Access#
DIR-Access#
10-05-2017 06:09 AM
Same vlans should be allowed on the trunk each side , they should match exactly , some of the vlans are not on the 3850 side at layer 2 but that should not stop vlan 50 as its there but you should fix it by adding other vlans to the 3850
something else is blocking you pinging it , the arp is there and its complete , is there any fw , anti virus etc on the server software
what i would do is put a laptop on the 3850 put an ip address on it for vlan 50 turn off the firewalls , make sure its in the correct access port with vlan 50 set and see if the arp is in the vcore then try and ping it
You also need to set a default gateway for return traffic on the 3850
10-05-2017 06:17 AM
I'll check if there is any anti virus etc on the server software, and also add the other layer 2 vlans on the 3850. For the default gateway I'm not sure which ip address to put beause its seeing the core on 2 different ip addresses
DIR-Access#sh cdp nei det
-------------------------
Device ID: DIR-CORE(SSI203604E1)
Entry address(es):
IP address: 10.10.20.1
Platform: N5K-C5548UP, Capabilities: Switch IGMP CVTA phone port
Interface: TenGigabitEthernet1/1/4, Port ID (outgoing port): Ethernet1/32
Holdtime : 156 sec
Version :
Cisco Nexus Operating System (NX-OS) Software, Version 7.0(4)N1(1)
advertisement version: 2
Native VLAN: 10
Duplex: full
Management address(es):
IP address: 146.64.74.3
Total cdp entries displayed : 1
DIR-Access#
10-05-2017 06:21 AM
10-05-2017 06:35 AM
the layer 3 vlans are on the nexus 5548, so I confoigured the default gateway to be 10.10.50.1 on the 3850, I'm still battling, I see a different server now on the arp table fixed its port setting to access vlan 50 but still
DIR-Access#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.50.12 7 246e.9647.9842 ARPA Vlan1
Internet 146.64.74.4 - 00c1.b13d.1cc7 ARPA Vlan1
DIR-Access#
DIR-Access#
DIR-Access#
DIR-Access#ping 10.10.50.12
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.50.12, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
DIR-Access#sh mac address-table address 246e.9647.9842
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
50 246e.9647.9842 DYNAMIC Gi1/0/30
Total Mac Addresses for this criterion: 1
DIR-Access#
DIR-Access#
DIR-Access#sh mac address-table address 246e.9647.9842
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
50 246e.9647.9842 DYNAMIC Gi1/0/30
Total Mac Addresses for this criterion: 1
DIR-Access#
DIR-Access#
DIR-Access#
DIR-Access#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 10.10.50.12 8 246e.9647.9842 ARPA Vlan1
DIR-Access#
DIR-Access#
DIR-Access#ping 10.10.50.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.50.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
DIR-Access#
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide