Hosts can't reach each other in the same VLAN in 3560G
We have recently started as Internet service provider in an open metropolitan.
We use a Cisco 3560G Layer 3 switch, where we have all our vlan where we have konfiguerat ex. Switch (config) # interface vlan 150, an interface for each VLAN capabilities such as int vlan 1 - 10/10 int vlan 2 to 30/10, int vlan 3 100/10 and so on.
Our int vlan is configured as follows:
dhcp relay information trusted
ip address <x.x.x.x> <x.x.x.x>
ip helper-address <x.x.x.x>
Ports (ex. int Gigabit Ethernet 0/1) are configured as follows:
switchport access vlan x
spanning-tree bpdufilter enable
The interface where we trunks to the energy company looks as follows:
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1, 2, 3
switchport mode trunk
spanning-tree port the trunk
spanning-tree bpdufilter enablement
Other configuration in our 3560G:
vtp transparent mode
spanning-tree mode rapid-pvst
no spanning tree bpdu optimize transmission
spanning-tree extend system id
no spanning-tree vlan 1-1000
vlan internal allocation policy ascending
vlan 1, 2, 3
Now the problem; we have a customer in ex. vlan 3 who needs to access a server provided by another customer in the same vlan (vlan 3), and access to each other in the same vlan is not possible. You can access the server from any other vlan, but when it comes to access to another host in the same vlan, you will not reach it.
We suspect that the energy company has configured with pvlan isolated. If we use the command ip local-proxy-arp on each vlan, it works to reach each other, but it seems that our 3560 becomes overloaded when ip local-proxy-arp is enabled and it streaming and use IP telephony it doesn't work. The response time at ping is longer and the loss of packets increase with ip local-proxy-arp enabled. The other operators in the metropolitan also uses Cisco 3560G so the hardware should be sufficient.
We have also tried to add no split-horizon, but it made no difference.
How do we get around this without negative consequences? Probably need something that makes you allow to send out the same interface that it came from, because it works as long as you are in another vlan. Can anyone have a solution for this problem or can post a example config to solve this problem?
If the server is located on an isolated private vlan, by doing proxy-arp, you are negating the security in place. If the server need to be accessed by other host in the same vlan, configuring a isolated private vlan might no be the best idea. You chould use a share private vlan instead.
Listen: https://smarturl.it/CCRS9E25 Follow us: twitter.com/ciscochampions
With applications and users everywhere, the networks are now, more than ever, being tasked with delivering consistent protection while providing an exceptional user exper...