Help with Traffic Routes

metuckness · ‎08-31-2015

I need some help. I have a site that is attached to our enterprise network and at that site I have a Cisco 3750X switch stack with two VLAN's and a Cisco 2911 that passes traffic to the rest of our lan. My problem is that all the traffic that is on the 113 & 116 VLAN's is traveling to the router, out the router to our remote main location and then back instead of just passing it from one VLAN to the other. It is causing saturation issues with the main connection as you can well imagine.

I need help on the proper solution to fix this. Here is the current config for the switch stack. Anyone have the fix to get it to route local VLAN traffic within the switch stack itself and send the rest of the traffic over the router like it should?

I can include the router's config if needed.

Here is the switch's current config:

LCCA-3750X#sh run
Building configuration...

Current configuration : 19270 bytes
!
! Last configuration change at 16:31:21 UTC Fri Mar 10 1995
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service sequence-numbers
!
hostname LCCA-3750X
!
boot-start-marker
boot-end-marker
!
!
enable secret
enable password
!
no aaa new-model
stacks scan-lite
switch 1 provision ws-c3750x-48
switch 2 provision ws-c3750x-48
switch 3 provision ws-c3750x-48
system mtu routing 1500
ip routing
!
!
!
!
password encryption aes
!
!
!
crypto pki certificate chain TP-self-signed-728
certificate self-signed 01
30820240 308201A9 A0030201 300D0609 2A864886 F70D0101 04050030
30312E30 2C060355 04031325 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 38393837 36313732 38301E17 0D393330 33303130 30303134
315A170D 32303031 30313030 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3839 38373631
37323830 819F300D 4886F70D 01010105 0003818D 00308189 02818100
BACE805B E6B82C1B F7072567 C936B474 881B6BB1 4AC923A5 7AF5E99D 14539FFF
0C6711CE 8DC28E95 35FF9DDF F8DED1F4 1B115DD6 3EF03B99 5778DB4C 46A2BEC5
6769EFE2 8EF9304C F8031AB8 2F70F866 9B31EF72 62F98F68 A31357E9 940CD155
F2859881 8762F453 EBC7B5C5 63B76356 FF6E51FE 7FA0B62F CB902C08 6A170A6B
02030100 01A36A30 68300F06 03551D13 0101FF04 05300301 01FF3015 0603551D
11040E30 0C820A4C 4343412D 33373530 58301F06 03551D23 04183016 80147118
B0BD1EDF DA3FF65D 15F82100 A309C8CD 8991301D 0603551D 0E041604 147118B0
BD1EDFDA 3FF65D15 F82100A3 09C8CD89 91300D06 092A8648 86F70D01 01040500
03818100 49FD920A DD7CA5B9 91B8F77A 6849D9D7 1389E262 D17ED455 5FED15B4
38F8832A 11460F3A 86304806 B7523FFF 91BB0D76 C1437BE5 5FC830B9 F462A694
6AA7850D 7774D5A5 CF693FCC 2CD0713B B5BED6D6 E3B2A687 9DF4754C 16A42FC3 7A687049 9D3D9541 47F066B7 DEDB9D00
quit
!
spanning-tree mode pvst
spanning-tree extend system-id
no spanning-tree vlan 112
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
interface FastEthernet0
no ip address
no ip route-cache cef
no ip route-cache
!
interface GigabitEthernet1/0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 113,116
switchport mode trunk
spanning-tree portfast
!
interface GigabitEthernet1/0/2
switchport access vlan 113
switchport mode access
shutdown
spanning-tree portfast
!
interface GigabitEthernet1/0/3
switchport access vlan 113
switchport mode access
spanning-tree portfast

!
interface GigabitEthernet3/0/37
switchport access vlan 116
switchport mode access
!
interface GigabitEthernet3/0/38
switchport access vlan 116
switchport mode access
!
interface GigabitEthernet3/1/1
!
!
interface TenGigabitEthernet3/1/2
!
interface Vlan1
no ip address
shutdown
!
interface Vlan113
description Dispatch-LCCA
ip address 192.168.113.253 255.255.255.0
ip helper-address 192.168.100.1
!
interface Vlan116
description Admin-LCCA
ip address 192.168.116.253 255.255.255.0
ip helper-address 192.168.100.1
!
!
router eigrp 100
network 10.0.0.0 0.0.0.3
network 192.168.113.0
network 192.168.116.0
!
ip default-gateway 10.0.0.42
!
ip http server
ip http secure-server
!
!
ip sla responder udp-echo ipaddress 192.168.116.240 port 5000
logging esm config
!
!
!
line con 0
line vty 0 4
password
login
length 0
line vty 5 15
password
login
!
end

Jon Marshall · ‎08-31-2015

Traffic between those two vlans with SVIs should be routed locally.

How do you know it is going across the main connection ?

Does a "sh ip route" show them as directly connected ?

Jon

metuckness · ‎08-31-2015

Well I know it is being routed across the main connection because whenever I initiate a large data transfer between devices on the same subnet / VLAN or the other VLAN it saturates the link across the main connection and pings across the point to point connection jump to over 2000 with almost 100% packet loss.

IP ROUTING is enabled.

Here is the output of the show ip route:

LCCA-3750X# sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      192.168.113.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.113.0/24 is directly connected, Vlan113
L        192.168.113.253/32 is directly connected, Vlan113
      192.168.116.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.116.0/24 is directly connected, Vlan116
L        192.168.116.253/32 is directly connected, Vlan116

Jon Marshall · ‎08-31-2015

Can you do a traceroute between two devices in the different vlans on the switch ?

Jon

metuckness · ‎08-31-2015

Yeah here it is below:

The server's IP I did it from is 192.168.116.2.

So it sent the packet to 192.168.116.1 which is the 2911 router and then back to the switch to the 113 device.

192.168.116.2 (switch stack) → 192.168.116.1 (router) → 192.168.113.175 (switch stack)

C:\Users\administrator.domain>tracert 192.168.113.175

Tracing route to lcca-mwb.domain.local [192.168.113.175]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.116.1
2 <1 ms <1 ms <1 ms lcca-mwb.domain.local [192.168.113.175]

Trace complete.

Jon Marshall · ‎08-31-2015

Okay so that is not going to the main site, it is just going via the router as far as I can see.

If you want the switch itself to do the routing then you need to have the default gateways of the devices to be the SVI IPs on the switch instead of the current default gateways which are the router subinterfaces.

However rather than change the default gateways of all devices what you can do is (and you will need downtime) -

1) move the IPs on the router subinterfaces to the corresponding SVI on the switch

2) instead of a trunk link make the connection between the switch and router a L3 P2P link using a new IP subnet and add that subnet to your EIGRP configuration on both the router and the switch.

then you would need to clear the arp caches on the clients or you could do the changes in the evening and the arp caches should have timed out in the morning.

That said your traceroute does not suggest the link to main site is being used.

Edit - if you did move the routing to the switch you don't need the "ip default-gateway .." command.

You may need to replace it with a default route or you may be getting all the routes you need from EIGRP.

Jon

metuckness · ‎08-31-2015

If it is not sending it over the main link, then why does that link become saturated and traffic stops?

Here is the routers config:

ROUTER1#sh run
Building configuration...

Current configuration : 4153 bytes
!
! Last configuration change at 15:13:17 UTC Mon Aug 31 2015 by admin
! NVRAM config last updated at 15:13:19 UTC Mon Aug 31 2015 by admin
! NVRAM config last updated at 15:13:19 UTC Mon Aug 31 2015 by admin
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
!
hostname ROUTER1
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
!
no ipv6 cef
ip source-route
ip cef
!
!
!
!
!
ip domain name
multilink bundle-name authenticated
!
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-
revocation-check none
rsakeypair TP-self-signed
!
!
crypto pki certificate chain TP-self-signed-
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
838A460A 8F31D401 2F6DF3E7 4D069AC9 6E8C2333 EC007C8F 20A02E1D D469BCF7
1F36BFE5 32C9CC38 2FE7CAC1 A2A1061C 03846CCC EFAB7FE1 93F25B7D C0F67C9E
8D05BDCA 4E90A235 0E4DF373 F03233A4 83F62D6E DE787BA7 50576620 D3A91B0C
A996B043 EC4CD37D 43B36500 3CCEA1A3 FA85B7CA 903D9E40 8EE2FEBB 462F1132
69C59F35 B567B6CF DDEE86B7 635EDD
quit

!
!

!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 172.16.0.1 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.113
encapsulation dot1Q 113
ip address 192.168.113.6 255.255.255.0
ip helper-address 192.168.100.1
!
interface GigabitEthernet0/1.116
encapsulation dot1Q 116
ip address 192.168.116.1 255.255.255.0
ip helper-address 192.168.100.1
!
interface GigabitEthernet0/2
description Uplink to Windstream$ES_LAN$
ip address 10.0.0.42 255.255.255.252
ip helper-address 192.168.100.1
duplex auto
speed auto
!
!
router eigrp 100
network 10.0.0.0 0.0.0.3
network 192.168.113.0
network 192.168.116.0
!
ip forward-protocol nd
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip route 0.0.0.0 0.0.0.0 10.0.0.41
ip route 10.231.2.0 255.255.255.0 192.168.116.3
ip route 10.231.5.0 255.255.255.0 192.168.116.3
ip route 192.168.2.0 255.255.255.0 192.168.113.1
ip route 192.168.3.0 255.255.255.0 192.168.113.1
ip route 192.168.6.0 255.255.255.0 192.168.113.1
!
!
!
control-plane
!
!
!
line con 0
login local
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
privilege level 15
login local
transport input ssh
line vty 5 15
access-class 23 in
privilege level 15
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end

Jon Marshall · ‎08-31-2015

Between those two vlans it shouldn't be and in fact I can't see how it is as the traffic is terminated on the router.

You are going to need to capture some of the traffic because if the source and destination is within those two vlans the traffic cannot go further than the router.

Perhaps there is a dependency between other servers in the main site.

Jon

metuckness · ‎08-31-2015

So the changes I need to make are (switch):

interface Vlan113
description Dispatch-LCCA
ip address 192.168.113.6 255.255.255.0
ip helper-address 192.168.100.1
!
interface Vlan116
description Admin-LCCA
ip address 192.168.116.1 255.255.255.0
ip helper-address 192.168.100.1

To setup the link to the router I can configure port 0/0 on the router:

interface GigabitEthernet0/0
ip address 172.16.0.1 255.255.255.252
duplex auto
speed auto

Then port gi 1/0/2 on the switch:

no switchport

ip address 172.16.0.2 255.255.255.252

no shutdown

On the router:

router eigrp 100
network 10.0.0.0 0.0.0.3
network 192.168.113.0
network 192.168.116.0

network 172.16.0.0

On the switch:

router eigrp 100
network 10.0.0.0 0.0.0.3
network 192.168.113.0
network 192.168.116.0

network 172.16.0.0

Is that it or did I miss something? I can then run a cable from port 0/0 on the router to 1/0/2 on the switch and unplug the one from 0/1 on the switch?

Jon Marshall · ‎08-31-2015

Yes that would do it.

Your network statement under EIGRP could be 172.16.0.0 0.0.0.3 if you wanted to be specific.

There are some statics and a default route on the router so you should add a default route to the switch pointing to the router end of the P2P link.

And you should remove the vlan IP subnets from the router EIGRP configuration.

All that said traffic between those vlans should not be going to the main site as it is so you may not see an improvement.

Jon