Catalyst IP Segmentation

[MaraVarma]

Hi,

I am trying to segment a class C ip addresses into a /25 segment and a few /29 segment.

I attached the diagram.

The equipment connected to layer 2 switch does not getting internet access.

What am i missing.

Router Config

interface GigabitEthernet0/0
ip address N.N.N.53 255.255.255.254
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address X.X.X.1 255.255.255.248
duplex auto
speed auto
!
ip route 0.0.0.0 0.0.0.0 N.N.N.52
ip route X.X.X.8 255.255.255.248 X.X.X.2
ip route X.X.X.128 255.255.255.128 X.X.X.2
!

Layer 3 Switch Config

interface GigabitEthernet1/0/1
no switchport
ip address X.X.X.2 255.255.255.248
!
interface GigabitEthernet1/0/2
switchport access vlan 20
switchport mode access
!
interface GigabitEthernet1/0/3
switchport access vlan 30
switchport mode access
!
interface Vlan20
ip address X.X.X.129 255.255.255.128
!
interface Vlan30
ip address X.X.X.9 255.255.255.248
!
ip route 0.0.0.0 0.0.0.0 X.X.X.1

Layer 2 Switch Config

interface GigabitEthernet1/0/1
switchport access vlan 20
switchport mode access
!
interface GigabitEthernet1/0/2
switchport access vlan 20
switchport mode access
!
interface GigabitEthernet1/0/3
switchport access vlan 20
switchport mode access
!
interface Vlan20
ip address X.X.X.130 255.255.255.128

[Mark Elsen]

   - @MaraVarma             Enable ip routing on the 3850  and execute the command show ip route

  M.

[M02@rt37]

Hello @MaraVarma 

The configuration look correct, but first thing add ip routing commàdon the Layer 3 switch. Without it, the switch will not route trafic between VLAN 20/VLAN 30 and the router...

Also verify that the VLAN interfaces are up with show ip interface brief command, hosts in VLAN 20 use X.X.X.129 as their default gateway, and the Layer 2 switch has ip default-gatzway x.x.x.129 configured for management.

Pleasr share the output of show ip route command from the L3 switch.

[Joseph W. Doherty]

As the others ( M02@rt37 and @Mark Elsen ) have already noted, you need to insure routing is enabled on the L3 switch.  (Smaller Cisco L3 switches default for routing is usually disabled.  Converse for their large L3 switches

For the L2 switch (for the switch, as a host, management), you should add a default gateway (as also noted by M02@rt37 ).

For routing between the router and L3 switches, you can use either static or dynamic routing.  Although, you have only two L3 devices, I would still use dynamic routing, but that's more of a personal preference, as I believe it's a better choice, but not all would agree.

The static route statements, you have now, should do the job.  As an alternative (for the subnetted /24), on the router, you, I believe, could also use a single static route statement:

Ip route X.X.X.0 255.255.255.255 X.X.X.2

(Student excersize why this would work.)

[Giuseppe Larosa]

Hello @MaraVarma ,

in addition to the notes about enabling ip routing on the L3 switch made by other colleagues.

for public Internet access from vlan 20,30 behind the L3 switch you need also appropriate NAT statements on the router.

you will need 

int gi0/0

! interface to the ISP

ip nat outside

int gi0/1

ip nat inside

exit

!

in global config

! access-list that defines the source IP addresses to be NATTed all the subnets within the /24

access-list 10 permit X.X.X.0 0.0.0.255

! global command that enable source NAT from inside to outside

ip nat inside source list 10 interface gi0/0 overload

Hope to help

Giuseppe

[Joseph W. Doherty]

for public Internet access from vlan 20,30 behind the L3 switch you need also appropriate NAT statements on the router.

@Giuseppe Larosa good catch!  Working off my phone I had not downloaded the PNG attachment, so I had not, until now, saw the router had a direct Internet connection.  (My bad.)

The OP text, including config info, doesn't actually describe what the router connects to, and as presented, configs don't show whether public and/or private IP addresses are being used (either or both would have better documented the router as having an Internet connection - BTW, an interface description, can have very useful information, like the ISP contact info, and ISP link identification).

Also BTW, I assumed you could ping the Internet from the router, but being unable to ping the Internet from your VLAN hosts can have other causes, besides the missing routing on the L3 switch.  For example, possibly you might see you can ping the Internet from N.N.N.53 and even (specifically) from X.X.X.1, but no other X.X.X.X/24 IPs.