Solved: Hosts on VLAN unable to go on the internet - Page 2

OneNinja · ‎04-27-2021

I just bought a C3750 switch and trying to have the hosts connected to the switch get internet connection through my ASA5512. First, I created a point to point connection between inside interface (192.168.5.1/30) of my ASA and GigabitEthernet1/0/23 (192.168.5.2/30) interface of my switch. I have 4 subnets on 4 different VLANs (VLAN10 : 192.168.10.0 , VLAN20:192.168.20.0, VLAN30: 192.168.30.0 and VLAN40: 192.168.40.0). My issue is how to get the hosts on different VLAN talk each other and also go on internet. I used OSPF as a routing protocol on my Switch and my ASA.

I would appreciate your help. Below is my switch config :

!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname CISCOSWITCH
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$YXFk$b1lVZlsY72jh4JIa9zdft1
enable password
!
username admin password
!
!
no aaa new-model
switch 1 provision ws-c3750x-24
system mtu routing 1500
ip routing

ip dhcp excluded-address 192.168.10.1 192.168.10.5
ip dhcp excluded-address 192.168.20.1 192.168.20.5
ip dhcp excluded-address 192.168.30.1 192.168.30.5
ip dhcp excluded-address 192.168.40.1 192.168.40.5
!
ip dhcp pool Vlan10
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
!
ip dhcp pool vlan20
network 192.168.20.0 255.255.255.0
!
ip dhcp pool vlan30
network 192.168.30.0 255.255.255.0
!
ip dhcp pool vlan40
network 192.168.40.0 255.255.255.0
!
ip dhcp pool vlan10
default-router 192.168.5.1
!
ip dhcp pool Vlan20
dns-server 8.8.8.8
default-router 192.168.20.1
!
ip dhcp pool Vlan30
default-router 192.168.30.1
dns-server 8.8.8.8
!
ip dhcp pool Vlan40
dns-server 8.8.8.8
default-router 192.168.40.1
!
!
ip domain-name lab.local
ip name-server 8.8.8.8
!
!
crypto pki trustpoint TP-self-signed-3857111040
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3857111040
revocation-check none
rsakeypair TP-self-signed-3857111040
!
!

quit
license boot level ipservices
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
ip ssh version 2
!
!
!
interface FastEthernet0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
!
interface GigabitEthernet1/0/1
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/2
switchport access vlan 20
switchport mode access
!
interface GigabitEthernet1/0/3
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/4
switchport access vlan 20
switchport mode access
!
interface GigabitEthernet1/0/5
!
interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/7
!
interface GigabitEthernet1/0/8
!
interface GigabitEthernet1/0/9
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
switchport access vlan 30
switchport mode access
!
interface GigabitEthernet1/0/14
switchport access vlan 40
switchport mode access
!
interface GigabitEthernet1/0/15
switchport access vlan 30
switchport mode access
!
interface GigabitEthernet1/0/16
switchport access vlan 40
switchport mode access
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
no switchport
ip address 192.168.5.2 255.255.255.252
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco
!
interface GigabitEthernet1/0/24
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
!
interface Vlan10
ip address 192.168.10.2 255.255.255.0
ip helper-address 192.168.10.0
ip helper-address 192.168.10.3
!
interface Vlan20
ip address 192.168.20.2 255.255.255.0
ip helper-address 192.168.20.0
ip helper-address 192.168.20.3
!
interface Vlan30
ip address 192.168.30.2 255.255.255.0
ip helper-address 192.168.30.0
ip helper-address 192.168.30.3
!
interface Vlan40
ip address 192.168.40.2 255.255.255.0
ip helper-address 192.168.40.0
ip helper-address 192.168.40.3
!
router ospf 1
log-adjacency-changes
network 192.168.10.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
network 192.168.30.0 0.0.0.255 area 0
network 192.168.40.0 0.0.0.255 area 0
!
ip classless
!
ip http server
ip http secure-server
!
ip sla enable reaction-alerts
!
!
!
line con 0
line vty 0 4
password
login local
transport input ssh
line vty 5 15
password cisco
login local
transport input ssh
!
end

Seb Rupik · ‎04-29-2021

OK, so to clarify, a host in vlan20 can ping the SVI (gateway) of VLAN 30 and VLAN40, but not any hosts in those VLANs? Have you disabled any software firewalls that are running on the target hosts?

cheers,

Seb

OneNinja · ‎04-29-2021

That's correct. Host on a vlan can only ping the svi(gateway) of the others vlan. I didn't disable any software. I used another host but am getting the same result.

Seb Rupik · ‎04-30-2021

if you can ping an SVI in another subnet it shows that the hosts interface netmask and gateway settings are correct. It also shows that the IP routing function is working on the switch. Since you have no ACLs on the switch the fact you cannot reach a host on another subnet is either an IP interface configuration issue with the target host or more likely a security policy (host based firewall) on the target host.

If HostA can ping the target hosts gateway, can the target host ping the HostA gateway address? What OS are the hosts running? Is there another service you can try to access on the target host, eg HTTP?

cheers,

Seb.

OneNinja · ‎04-30-2021

Thank you Seb. I really appreciated your inputs. I am able to ping hosts in other vlan. I think the issue was with the host.