Re: Can SSH to one stack but not to the other.

mlord · ‎08-07-2023

Hello,

I've been trying to understand why I suddenly can't SSH to a second switch stack. We have two separate buildings; an Admin building and a News building. We have an Admin stack and a News stack of 9300-48T's. These two stacks are connected via port-channel with trunk and VLAN access to multiple vlans, including a management vlan of 254. We have the interface gigabitethernet0/0 configured as the management interface for bothdsf. Currently, when in the Admin building, I can SSH into the Admin stack fine on our Default VLAN 1 192.168.0.1 but not the News stack. When I'm on the News side however, I can SSH into the News stack, but not the Admin stack. Also, I used to be able to SSH into the News stack from the Admin side as long as I was connected to Wi-Fi which resides on a 10.1.40.1 VLAN but no longer can. I typically SSH to the Admin stack with 10.1.254.1, and the News stack with 10.1.254.2.

I've attached a running config from each stack, as well as a show interface for gigabitethernet0/0. I welcome and appreciate an thoughts on this. Thank you.

Reza Sharifi · ‎08-07-2023

Hi,

Looking at the show commands for interface gi0/0, they are both down and it appears that there is no cable connected to these ports. Are you managing the stacks via the out-of-band ports (gi0/0)? or all inband? If you are manging the stack via out-of-band, that port usually is part of mgmt-vrf.

HTH

mlord · ‎08-07-2023

Hello @Reza Sharifi

Thank you for your reply. I apologize but I'm not sure what you mean by "out-of-band" and "inband". I typically manage the stacks using Tera Term with the hosts 10.1.254.1 for the Admin stack, and 10.1.254.2 for the News stack. I did notice that it says down/down for the gigabitethernet0/0 on each stack; though I wasn't sure if that was normal. It does look as if it's a part of mgmt-vrf, though I don't understand the specifics of that either. All I know is I used to be able to SSH to both stacks, whether I was in one building, or the other. My workstation resides on default VLAN 1 and can SSH to the Admin stack, while in the Admin building. I cannot SSH into the News stack from the Admin building. I also don't believe a cable has ever been connected to gi0/0. I suppose I want to be able to SSH into either stack over the network.

Reza Sharifi · ‎08-07-2023

See the below info.

10.1.254.2 is assigned to interface gi0/0, which is the out-of-band interface to manage the switch, but as you can see in the show interface command you posted, that interface is down. So, someone disconnects the cable from the switches, so you can't access the switch from one location to another. Can you clarify?

10.1.254.2

interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 ip address 10.1.254.2 255.255.255.0
 speed 1000
 negotiation auto

NewsStack#show interface gigabitEthernet0/0
GigabitEthernet0/0 is down, line protocol is down
  Hardware is RP management port, address is 00d6.fe7d.5600 (bia 00d6.fe7d.5600)
  Internet address is 10.1.254.2/24

mlord · ‎08-07-2023

Thank you @Reza Sharifi

Okay, so perhaps I'm coming at this from the wrong angle. Perhaps Gi0/0 isn't a part of my issue at all. Disregarding Gi0/0, what then would prevent me from using SSH from my network in one building, to access the stack in the other building?

Reza Sharifi · ‎08-07-2023

Ok, if interface gi0/0 is not part of the issue, then you are managing the switch inband, meaning using a vlan. If you are able to access one site and not the other, usually something has changed in the routing between subnets from one location to another. For example, make sure both stacks have the below command. I see it on one of the stacks but not sure if the other one has it or not.

ip default-gateway 192.168.0.150

.

ip route 0.0.0.0 0.0.0.0 192.168.0.150

You usually need one or the other. If the switch is doing layer-3 routing keep

ip route 0.0.0.0 0.0.0.0 192.168.0.150 and delete ip default-gateway 192.168.0.150

But again make sure both stacks have this command.

mlord · ‎08-08-2023

@Reza Sharifi

So, on the Admin Stack, it's our main stack and is what routes traffic to our Sonicwall (192.168.0.1) to the internet using ip route 192.168.0.1. I was told that the ip default-gateway is superceded when an ip route is configured. Our default vlan 1 uses 192.168.0.150 as the default gateway for clients pulling DHCP. We have a Vlan 254 as "SW_MGMT", and the port-channel has access to all VLANS, with a "vlan add 254".

interface TenGigabitEthernet1/1/1
description ToNewsBuilding_1
switchport trunk allowed vlan 1,11,30,40,52,60,70,80,90,100,110,120,130,150
switchport trunk allowed vlan add 254
switchport mode trunk
channel-group 1 mode active
!
interface TenGigabitEthernet1/1/2
description ToNewsBuilding_2
switchport trunk allowed vlan 1,11,30,40,52,60,70,80,90,100,110,120,130,150
switchport trunk allowed vlan add 254
switchport mode trunk
channel-group 1 mode active

Admin Stack

ip default-gateway 192.168.0.150
no ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip ftp username mlord
ip ftp password 7 040F5857590C437C0E380B
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route 10.10.51.0 255.255.255.0 10.10.52.1
ip route 10.10.53.0 255.255.255.0 10.10.52.1
ip route 10.154.0.0 255.255.0.0 63.246.204.157
ip route 192.168.80.0 255.255.255.0 10.10.21.10

News Stack

ip default-gateway 192.168.0.150
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.0.150

Reza Sharifi · ‎08-08-2023

So, on your admin stack, all you need is a default route to the firewall which is "ip route 0.0.0.0 0.0.0.0 192.168.0.1"

There is no need for the command "ip default-gateway 192.168.0.150" as they are redundant and can cause a loop in your network because each points to a different IP (.0.1 and 0.150). And so since you have other static routes configured, it makes sense to keep the ip route command and delete the ip default command. On the news stack you also need either ip route or ip default gateway and not both pointing to the admin's stack IP address which is 150. So, in summary, the news stack's default route should be pointing to the admin stack and the admin stack's default route should be pointing to the firewall.

no ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip ftp username mlord
ip ftp password 7 040F5857590C437C0E380B
ip route 0.0.0.0 0.0.0.0 192.168.0.1
ip route 10.10.51.0 255.255.255.0 10.10.52.1
ip route 10.10.53.0 255.255.255.0 10.10.52.1
ip route 10.154.0.0 255.255.0.0 63.246.204.157
ip route 192.168.80.0 255.255.255.0 10.10.21.10

News Stack

ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.0.150

mlord · ‎08-08-2023

@Reza Sharifi

Alright, I made the changes and copied the running-config to startup. I enabled Wi-Fi on my workstation which gave me an IP from the VLAN 40 range. I'm able to SSH into the News stack as long as I'm on the Wi-Fi VLAN. The interface VLAN 40 shows the IP of 10.1.40.2 and I use that IP to start an SSH connection. I'm curious though, why I can't SSH using the interface VLAN 254 ip of 10.1.254.2.