Configure the management port on a WS-C3650-12X48UR switch

[l33noob]

Hi All,

I am having issues with setting up the Out-Band-Management port of a WS-C3650-12X48UR to connect to my laptop, so I can TFTP an image to the switch.   The management port and related vrf configurations are as follows:

KMC-PWR_PLT-1#sh run vrf
Building configuration...

Current configuration : 290 bytes
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
ip address 192.168.10.10 255.255.255.0
negotiation auto
!
ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 192.168.10.1

The PC is configured with a static IP 192.168.10.1 and a default gateway of 192.168.10.10, which is the IP assigned to the management port on the WS-C3650-12X48UR.  From the PC, I can ping WS-C3650-12X48UR's management port IP 192.168.10.10.

From the WS-C3650-12X48UR switch,  I can ping management port IP, 192.168.10.10.  However, I am not able to ping my PC's IP, 192.168.10.1.

WS-C3650-12X48UR #ping vrf Mgmt-vrf 192.168.10.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

WS-C3650-12X48UR #ping vrf Mgmt-vrf 192.168.10.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

The traceroute from the switch is not showing the traffic to 192.168.10.1 is reaching the switch's management IP 192.168.10.10.

WS-C3650-12X48UR#traceroute vrf Mgmt-vrf 192.168.10.10
Type escape sequence to abort.
Tracing the route to 192.168.10.10
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.10.10 1 msec * 1 msec

WS-C3650-12X48UR#traceroute vrf Mgmt-vrf 192.168.10.1
Type escape sequence to abort.
Tracing the route to 192.168.10.1
VRF info: (vrf in name/id, vrf out name/id)
1 * * *
2 * * *

The sh ip route vrf Mgmt-vrf has the following routes in place.  Please let me know which steps are missing.

Thanks,

L33noob

[balaji.bandi]

Firstly i will ask what PC Operating System ? if it is windows 7 or windows 10.

check the built in  Firewall in windows 7 / 10, disable FW and try again and advise.

[Reza Sharifi]

Hi,

Make sure the PC does not have the firewall software turn on to block ICMP.

Also, since the switch and the PC are on the same subnet, you don't need a default route.

no ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 192.168.10.1

HTH

[l33noob]

Hi All,

Thanks for the help!

The firewall on the PC is turned off, and it is responding to ping from a production network.

@ Reza

If the default route for the VRF instance is not needed, then it should have worked anyway.  Based on the traceroute, the VRF traffic for 192.168.10.1 is not even getting to the Management Port's IP 192.168.10.10.

WS-C3650-12X48UR#traceroute vrf Mgmt-vrf 192.168.10.10
Type escape sequence to abort.
Tracing the route to 192.168.10.10
VRF info: (vrf in name/id, vrf out name/id)
1 192.168.10.10 1 msec * 1 msec

WS-C3650-12X48UR#traceroute vrf Mgmt-vrf 192.168.10.1
Type escape sequence to abort.
Tracing the route to 192.168.10.1
VRF info: (vrf in name/id, vrf out name/id)
1 * * *
2 * * *

Regards,

l33noob

[vandermate]

FYI for future reference not only could the Windows Firewall be blocking your ICMP returns but I have also found out that Symantec Endpoint protection Firewall must also be turned off.  So make sure if you turn off your windows firewall and it still doesn't work to check your Virus Protection and disable its firewall as well.

[Reza Sharifi]

Hi,

@ Reza

If the default route for the VRF instance is not needed, then it should have worked anyway.  Based on the traceroute, the VRF traffic for 192.168.10.1 is not even getting to the Management Port's IP 192.168.10.10.

I am not saying the default route is part of the issue here. All I am saying is that the host and switch are in the same IP segment (/24 according to your first post) and so, in this case, no default route is needed.  The default route is used for remote hosts/device to access the switch from a different subnet.

HTH

[Alan Ng'ethe]

I would agree with the others here that its probably some sort of filtering happening at the PC. Your ability to ping from the PC to the switch confirms that.

[amikat]

Hi,

Will you please make sure ip routing is enabled.

Best regards,

Antonin