cant get vlan routing to work on 2960x

[ino]

i have turned "ip routing" on

i can ping 172.16.110.10 vl10 from the switch

i can ping 172.16.115.10 vl15 from the switch

i can ping 172.16.110.1 from the pc10 (ip 172.16.110.10 255.255.255.0 gateway 172.16.110.1)

i can ping 172.16.115.1 from the pc10 (ip 172.16.110.10 255.255.255.0 gateway 172.16.110.1)

i can ping 172.16.115.1 from the pc15 (ip 172.16.115.10 255.255.255.0 gateway 172.16.115.1)

i can ping 172.16.110.1 from the pc10 (ip 172.16.115.10 255.255.255.0 gateway 172.16.110.1)

but i cant ping pc10 from pc15 or vice versa

ip routing

!

interface Vlan10
ip address 172.16.110.1 255.255.255.0
!
interface Vlan15
ip address 172.16.115.1 255.255.255.0
!

interface GigabitEthernet1/0/22
switchport access vlan 15
switchport mode access
!
interface GigabitEthernet1/0/23
switchport access vlan 10
switchport mode access
!

#sh sdm prefer
The current template is "lanbase-default" template.

what do i missing?

[Georg Pauwen]

Hello,

are these 'real' PCs ? Post the output of 'ipconfig /all' from both PC10 and PC15...

[ino]

they are VMs (hyper v) running on my server each has its own interface

i should also mention the the switch has a router connected to it

the vlans in question 10, 15 aren not on the router

but it also seams that i cant ping 172.16.110.1 from a physical computer on 10.0.0.11 as it tries to go trough the router

if i set its gateway to the switch (10.0.0.2) i still cant ping 172.16.110.1 it seams it still trying to go through the router 

-------------

forget my last remark about 10.0.0.11 cant ping 172.16.110.1 if the gateway is set to the switch

i had for some reason an old static route configured on the computer

still cant ping pc10 or pc15 

[Leo Laohoo]

Post the complete output to the following commands:

1. sh version
2. sh sdm prefer

[ino]

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(7)E4, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2021 by Cisco Systems, Inc.
Compiled Mon 08-Mar-21 11:26 by prod_rel_team

ROM: Bootstrap program is C2960X boot loader
BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(6r)E, RELEASE SOFTWARE (fc1)

2960x uptime is 1 hour, 45 minutes
System returned to ROM by power-on
System restarted at 01:04:31 xxxx Thu Sep 9 2021
System image file is "flash:c2960x-universalk9-mz.152-7.E4/c2960x-universalk9-mz.152-7.E4.bin"
Last reload reason: Reload command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C2960X-24TS-L (APM86XXX) processor (revision H0) with 524288K bytes of memory.
Processor board ID FOC1933S6HJ
Last reset from power-on
14 Virtual Ethernet interfaces
1 FastEthernet interface
28 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address : xxx
Motherboard assembly number : xxx
Power supply part number : xxx
Motherboard serial number : xxx
Power supply serial number : xxx
Model revision number : H0
Motherboard revision number : B0
Model number : WS-C2960X-24TS-L
Daughterboard assembly number : xxx
Daughterboard serial number : xxx
System serial number : xxx
Top Assembly Part Number : xxx
Top Assembly Revision Number : D0
Version ID : V03
CLEI Code Number : xxx
Daughterboard revision number : A0
Hardware Board Revision Number : 0x12

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 30 WS-C2960X-24TS-L 15.2(7)E4 C2960X-UNIVERSALK9-M

Configuration register is 0xF

#sh sdm prefer
The current template is "lanbase-default" template.
The selected template optimizes the resources in
the switch to support this level of features for
0 routed interfaces and 1024 VLANs.

number of unicast mac addresses: 32K
number of IPv4 IGMP groups + multicast routes: 1K
number of IPv4 unicast routes: 3K
number of directly-connected IPv4 hosts: 2K
number of indirect IPv4 routes: 1K
number of IPv6 multicast groups: 1K
number of IPv6 unicast routes: 3K
number of directly-connected IPv6 addresses: 2K
number of indirect IPv6 unicast routes: 1K
number of IPv4 policy based routing aces: 0.5K
number of IPv4/MAC qos aces: 0.5K
number of IPv4/MAC security aces: 0.625k
number of IPv6 policy based routing aces: 0
number of IPv6 qos aces: 0.5K
number of IPv6 security aces: 0.625k

remark:

i had netflow running which still seams to run whit this sdm prefer setting but i removed it for testing and rebooted

as i understand it should not be abele to run with this sdm but it does so i thought maybe it interferes in some way?

the term "prefer" indicates to me do it if you can??!

and by going through a bunch of sides on the topic i came some how to the conclusion that sdm prefer handling how 

memory is reserved for different tasks and its either netflow or ip routing (do i see this right???) 

[Leo Laohoo]

Change the SDM template, from LAN Base default, to LAN Base routing.

conf t
 sdm prefer lanbase-routing
end
wr
reload

Configuring SDM Templates

[ino]

not working

sdm prefer lanbase-routing isnt in the config but it told me to reboot and i did

#sh sdm prefer
The current template is "lanbase-routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
0 routed interfaces and 255 VLANs.

number of unicast mac addresses: 4K
number of IPv4 IGMP groups + multicast routes: 0.375k
number of IPv4 unicast routes: 0.875k
number of directly-connected IPv4 hosts: 0.875k
number of indirect IPv4 routes: 80
number of IPv6 multicast groups: 0.25K
number of IPv6 unicast routes: 0.875k
number of directly-connected IPv6 addresses: 0.75K
number of indirect IPv6 unicast routes: 32
number of IPv4 policy based routing aces: 0
number of IPv4/MAC qos aces: 0.375k
number of IPv4/MAC security aces: 0.375k
number of IPv6 policy based routing aces: 0
number of IPv6 qos aces: 0.125k
number of IPv6 security aces: 0.25K

sh run
!
! Last configuration change at 03:28:04 xxx Thu Sep 9 2021 by xxx
!
version 15.2
no service pad
service timestamps debug datetime msec localtime show-timezone year
service timestamps log datetime msec localtime show-timezone year
service password-encryption
service sequence-numbers
!
hostname 2960x
!
boot-start-marker
boot-end-marker
!
logging buffered 163840
logging persistent url flash:/logs/ size 819200 filesize 16384 batch 8192
enable secret 9 xxx
!
username xxx secret 9 xxx
username xxx privilege 15 secret 9 xxx
no aaa new-model
clock timezone xxx 2 0
switch 1 provision ws-c2960x-24ts-l
!
!
!
!
ip routing
!
!
no ip domain-lookup
ip domain-name xxx
ip name-server 10.0.0.1
ip name-server 10.0.0.6
login on-failure log
login on-success log
!
!
!
!
!
!
!
!
archive
path flash:/ConfBack/
maximum 13
write-memory
time-period 1440
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
no ip address
downshift disable
!
interface FastEthernet0
no ip address
no ip route-cache
!
interface GigabitEthernet1/0/1
description xxx
switchport trunk allowed vlan 20,160-168
switchport mode trunk
switchport port-security maximum 100
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/2
description xxx
switchport access vlan 7
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/3
description xxx
switchport access vlan 7
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/4
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/5
description xxx
switchport access vlan 7
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/6
description xxx
switchport access vlan 7
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/7
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/8
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/9
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/10
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/11
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/12
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/13
description xxx
switchport access vlan 7
switchport trunk native vlan 7
switchport mode trunk
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/14
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/15
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/16
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/17
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/18
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/19
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/20
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
shutdown
!
interface GigabitEthernet1/0/21
description xxx
switchport access vlan 160
switchport mode access
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/22
description xxx
switchport access vlan 15
switchport mode access
!
interface GigabitEthernet1/0/23
description xxx
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/24
description xxx
switchport access vlan 163
switchport trunk allowed vlan 163,164,168
switchport mode trunk
switchport port-security maximum 9
switchport port-security violation restrict
switchport port-security
!
interface GigabitEthernet1/0/25
shutdown
!
interface GigabitEthernet1/0/26
shutdown
!
interface GigabitEthernet1/0/27
shutdown
!
interface GigabitEthernet1/0/28
shutdown
!
interface Vlan1
no ip address
!
interface Vlan7
ip address 10.0.0.2 255.255.255.0
!
interface Vlan10
ip address 172.16.110.1 255.255.255.0
!
interface Vlan15
ip address 172.16.115.1 255.255.255.0
!
interface Vlan20
ip address 192.168.0.2 255.255.255.0
!
interface Vlan160
ip address 172.16.0.2 255.255.255.0
!
interface Vlan161
ip address 172.16.1.2 255.255.255.0
!
interface Vlan162
ip address 172.16.2.2 255.255.255.0
!
interface Vlan163
ip address 172.16.3.2 255.255.255.0
!
interface Vlan164
ip address 172.16.4.2 255.255.255.0
!
interface Vlan165
ip address 172.16.5.2 255.255.255.0
!
interface Vlan166
ip address 172.16.6.2 255.255.255.0
!
interface Vlan167
ip address 172.16.7.2 255.255.255.0
!
interface Vlan168
ip address 172.16.8.2 255.255.255.0
!
!
no ip ftp passive
ip ftp username xxx
ip ftp password 7 xxx
no ip http server
ip http banner
no ip http secure-server
!
ip access-list standard LogIn
permit xxx
permit xxx
permit xxx
!
!
!
snmp-server group GrpMonitoring v3 priv read ViewDefault
snmp-server view ViewDefault iso included
snmp mib flash cache
alias exec xwr copy run ftp://xxx/c2960x/
!
line con 0
exec-timeout 30 0
logging synchronous
login
length 50
stopbits 1
line vty 0 4
access-class LogIn in
exec-timeout 30 0
logging synchronous
login local
length 50
transport input ssh
line vty 5 15
login
transport input ssh
!
ntp server 10.1.1.1
event manager environment _email_to xxx
event manager environment _email_server xxx
event manager environment _email_from xxx
event manager applet ssh-login
event syslog pattern "SEC_LOGIN.*"
action 1.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "$_event_pub_time: Login via SSH" body "$_syslog_msg"
action 1.5 syslog priority notifications msg "SSH LOGIN - Mail Sent"
!
end

[balaji.bandi]

Looks for me some order of operation issue.

 - I can not remmeber how i was fixed Long back

i will remove  - no ip routing

i will enable sdm routing as suggested

conf t

sdm prefer lanbase-routing

exit

write config and reload

once switch come back

config t

ip routing

exit

wr and test it

still not working

can you post  below output -

show ip route

show ip route summary

[ino]

i have reset to factory defaults the switch disconnected everything except 2 physical pc

and setup anything from scratch

its working now

reconstructed my target setup and its still working 

no idea where the hiccup was  

i also tried out the 3 different settings available on the switch for "sdm prefer" all 3 working 

the difference in respect to my requirements seams to be the throughput

sdm prefer default   ~ 50mb/s

lanbase-default 700-800mb/s

lanbase-routing 800-900mb/s

thx for everyone's effort and time

P.S.

one more thing

is the switch routing L3 in hardware? or how comes that its faster then my router?

could i have some misconfiguration on my router

just for the sake of it i even tried 2 interfaces (router on a stick)

one for vl a (ingress) one for vl b (egress) from the router to the switch

and still the best i get is 450mb more or less exactly the half of the wire speed

(where by this are fullduplex 1gb links so one should by enough)

[balaji.bandi]

Glad to know all working as expected, then my memroy looks good. not sure behind technical what happends, so reset and sdm prefer, ip routing is the order of operation to work as expected.

Router need to buy a License to get trhoughput you expecting (general used for WAN connectivity)

This is switch so you get more trhougput switching - not sure about the results, is this connected device testing, the switch should give that capabilities.