cisco switch can ping svi and one host but not another on same vlan

[ma4ctg]

I have a Cisco 3850 switch with IP services.

Inter-vlan routing in configured.

My computer is on the default vlan (1).

I have an SVI for vlan 192.

My Cisco ASA is connected to an access port on the 3850 on port 48 and is on vlan 192.

I added another host with an IP in the same vlan and connected to port 47 which is in vlan 192 and the mode is access.

From my computer I can ping the SVI and the ASA but not the new host on port 47.

When logged into the switch, I can ping the SVI, ASA and the new host on port 47.

What am I missing?

[MHM Cisco World]

Because we all confuse why you mention ASA in this issue.

you want to ping PC in VLAN1 to pfsense in VLAN192.

but as i know pfsense need some config to accept ping.

[ma4ctg]

Apologies for the confusion.

The thing is that the default IP address for the LAN interface on the pfSense is 192.168.1.1. I initially changed that to 10.1.1.70 and was able to ping it and connect to it. I am assuming it worked because that IP address was in the default VLAN.

I thought I should be able to change the IP again but this time to another VLAN (192) and move the physical connection to port 47 on the switch which is configured for VLAN 192.

If I am only changing the IP and VLAN and the inter-vlan routing is working, shouldn't I be able to ping/connect to the pfSense?

The inter-vlan routing appears to be working for the other devices on VLAN 192 (the ASA and the SVI). I also have other VLANs that have no issue.

[MHM Cisco World]

no need to apologize friend 
change the port you connect pfsense need to change the Default GW to be same subnet of VLAN of new port.
PC send packet 
Inter-VLAN forward it to pfsense, 
pfsense reply use Default GW "since the packet is different than pfsense IP"
here issue if you use old GW  

[Georg Pauwen]

Hello,

I am pretty sure the pfsense is the problem. Did you tag the respective pfsense interface with Vlan 192 ?

[Georg Pauwen]

Hello,

what interface is the pfsense using ? The WAN interface blocks ICMP by default. Check the firewall rules, and again, can the pfsense ping 10.1.1.1 and its own default gateway ?

[balaji.bandi]

Right as suggested, so of the information not vision in terms of config.

Lets examine the reachability :

From PC you trying to reach Pfsense, switch forwarding as per the diagram to pfsense.

did pfsense aware of PC subnet come back to switch IP ? what is route table in Pfsense ?

can you post output ping from Pfsense to Switch and PC ? try trace-route. to PC and post the output.

[MHM Cisco World]

if the two host in same vlan no need for SVI,
what is the mode of ASA ?

[ma4ctg]

My computer is in vlan 1 (default vlan). The ASA and the .253 (pfSense on protectli) are in vlan 192.

From my computer I can ping the SVI and the ASA but not the pfSense.

[naseromer]

I feel you are missing some config in the FW

[Richard Burts]

I agree that it is likely that the problem is something with pfsense. It has been an involved discussion and there are parts of it that are not clear to me. One thing that I think I do understand is that at one point pfsense used address 10.1.1.70 and with that address there was connectivity and the ability to ping etc to pfsense. Then the address was changed to vlan 192 and now access from remote subnet does not work. There are several possibilities that I would like to explore:

- is there perhaps some security policy on pfsense that did allow access based on the 10.1.1 address but does not allow access based on the 192 address?

- does pfsense perhaps need a route for the 10.1.1 network?

- can we get some clarification about what subnets in the network that pfsense is able to ping?

[amikat]

Hi,

You would need to configure the gateway & static route at your pfSense box to reach the Vlan 1 network:

1) configure gateway
System > Routing > Gateways
"plus" button for a new gateway
Interface: LAN, Gateway: 192.168.200.1
"Save"
2) static route
System > Routing > Routes
"plus" button for a new static route
Destination network: 10.1.1.0/24, Gateway 192.168.200.1
"Save"
"Apply changes"

In addition to this please do not forget to check/modify the firewall rules to enable the traffic from the Vlan 1 network to pass.

Best regards,

Antonin