cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3738
Views
5
Helpful
21
Replies

Newly configured Catalyst 3850 L3 Switch not routing, Ip-helper not workin

wmlarkin1
Beginner
Beginner

Hi I have just configured a 3850 switch for ip routing and have been through the configuration many times, but still no routing is taking place.  I have enable ip routing and setup several vlans with IP address (different subnets) added several trunk ports and switch ports to test my configuration.  I also have a Windows DHCP server with associated scopes for the various subnets, but not except the defualt vlan (which I set to 10) is working. 

 

Here is my configuration for the CoreSwitch

 


!
! Last configuration change at 15:47:07 UTC Sat Jul 20 2019 by admin
!
version 16.6
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no platform punt-keepalive disable-kernel-core
!
hostname Core-Switch
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
enable secret 5 $1$wEUy$iJ.U37OqiVLaORCJ2n5GG0
!
no aaa new-model
switch 1 provision ws-c3850-24p
!
!
!
!
ip routing
!
ip domain name aaota.org
!
!
!
!
!
!
!
!
!
crypto pki trustpoint TP-self-signed-939288410
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-939288410
revocation-check none
rsakeypair TP-self-signed-939288410
!
!
crypto pki certificate chain TP-self-signed-939288410
certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
!
!
!
diagnostic bootup level minimal
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
username admin password 7 08751E1A5D4B5C46
!
redundancy
mode sso
!
!
transceiver type all
monitoring
!
!
class-map match-any system-cpp-police-topology-control
description Topology control
class-map match-any system-cpp-police-sw-forward
description Sw forwarding, L2 LVX data, LOGGING
class-map match-any system-cpp-default
description DHCP Snooping, EWLC control, EWCL data
class-map match-any system-cpp-police-sys-data
description Learning cache ovfl, Crypto Control, Exception, EGR Exception, NFL SAMPLED DATA, RPF Failed
class-map match-any system-cpp-police-punt-webauth
description Punt Webauth
class-map match-any system-cpp-police-l2lvx-control
description L2 LVX control packets
class-map match-any system-cpp-police-forus
description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station
description MCAST END STATION
class-map match-any system-cpp-police-multicast
description Transit Traffic and MCAST Data
class-map match-any system-cpp-police-l2-control
description L2 control
class-map match-any system-cpp-police-dot1x-auth
description DOT1X Auth
class-map match-any system-cpp-police-data
description ICMP redirect, ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-stackwise-virt-control
description Stackwise Virtual
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control
description Routing control
class-map match-any system-cpp-police-protocol-snooping
description Protocol snooping
class-map match-any system-cpp-police-system-critical
description System Critical and Gold
!
policy-map system-cpp-policy
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
no ip address
shutdown
speed 1000
negotiation auto
!
interface GigabitEthernet1/0/1
switchport access vlan 10
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/2
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/3
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/4
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/5
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/6
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/7
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/8
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/9
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/10
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/11
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/12
switchport trunk native vlan 10
switchport mode trunk
!
interface GigabitEthernet1/0/13
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/14
!
interface GigabitEthernet1/0/15
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/16
!
interface GigabitEthernet1/0/17
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/22
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/23
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/0/24
switchport access vlan 10
switchport mode access
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface Vlan1
no ip address
shutdown
!
interface Vlan10
ip address 172.16.0.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan100
ip address 172.16.10.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan110
ip address 172.16.12.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan200
ip address 172.16.20.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan210
ip address 172.16.22.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan300
ip address 172.16.30.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan310
ip address 172.16.32.254 255.255.255.0
ip helper-address 172.16.0.5
!
interface Vlan600
ip address 172.16.60.254 255.255.255.0
ip helper-address 172.16.0.5
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route 0.0.0.0 0.0.0.0 172.16.0.1
ip ssh version 2
!
!
!
!
!
control-plane
service-policy input system-cpp-policy
!
!
line con 0
password 7 1443405F5856737A
logging synchronous
login
stopbits 1
line aux 0
password 7 1443405F5856737A
login
stopbits 1
line vty 0 4
password 7 135145465F5E5D7B
logging synchronous
login local
transport input all
line vty 5 15
password 7 135145465F5E5D7B
logging synchronous
login local
transport input all
!
!
mac address-table notification mac-move
!
!
!
!
!
end

4 Accepted Solutions

Accepted Solutions

"Another good test would be from the server and from the Internet router are they able to ping the various SVIs configured on your new core switch."

You might also try pinging those hosts from your switch using an extended ping using a source interface or source IP from a SVI that they do not reside on. If your Windows (DHCP) server cannot communicate with the other SVIs, it won't be able to give out DHCP addresses.

As Rick notes, if a host can ping other SVIs, likely the L3 switch is routing correctly, and the problem is likely with the other hosts, most commonly, again as Rick notes, an issue with the default gateway. (For your DHCP server, also don't forget to provide your DHCP clients with their correct default gateway settings.)

Also BTW, on many Cisco switches, if there isn't any "up" port on a VLAN for a SVI, the SVI will be "down". If a SVI is down, of course, you won't be able to ping it.

Rick mentions the need for the Internet router to have routes to internal networks. He's correct. This might be accomplished by running a routing protocol between that router and your L3 switch, or using static routes. If the latter, also keep in mind you might be able to just use a summary prefix or prefixes. For example, rather than having all internal networks defined on your Internet router, you might just have 172.16.0.0/16. If the former, you can also be able to "source" the default route on the Internet router so that the L3 switch doesn't need a static for it.

View solution in original post

Hello Bill,

you have been provided several good suggestions by Rick and Joseph and by Peter.

 

The first important key point is the default gateway settings on PCs that should be the new switch C3850 SVI interface IP address in all cases.

What is special about vlan 10?

Not the fact the vlan 10 is the native vlan in your trunk ports, this is an OSI layer 2 concept.

You have issues at OSI layer 3 IP routing level ( if any)

In vlan 10 subnet 172.16.0.0/24 you have:

the external internet facing router with IP address 172.16.0.1

the DHCP server with IP address 172.16.0.X

 a pair of hosts in same IP subnet.

 

Verify on the windows DHCP server what default gateway it has. If the DHCP server was already installed before introducing the new L3 switch, it is likely pointing to 172.16.0.1 instead of 172.16.0.254 (new switch).

Of course it can ping the directly connected 172.16.0.254 it is just a question of ARP resolution.

If the DHCP server cannot ping the other SVI interfaces on the new switch the possible issues are:

DHCP server has default gateway pointing to 172.16.0.1

the router at 172.16.0.1 has no knowledge of the new Vlans behind the new switch.

 

Check the ip routing table on the router.

If needed you should add static routes like

ip route 172.16.30.0 255.255.255.0 172.16.0.254.

 

This should fix your network about intervlan routing and capability to ping the router from different Vlans then vlan 10.

 

The question of the ip helper-address has to be troubleshooted later when inter Vlan routing is working as desired.

 

Hope to help

Giuseppe

 

 

View solution in original post

Bill

 

The symptom that you describe with the server strongly suggest that its default gateway is not set correctly to be the switch SVI. The symptom with the Internet router suggest that it does not have routes for the networks configured on the switch. At this point it sounds like the switch is configured pretty well and the issue is not on the switch but with the devices connected to the switch.

 

HTH

 

Rick

HTH

Rick

View solution in original post

" I was originally trying this route 172.16.0.0 255.255.255.0 172.16.0.254, thinking that it would cover ALL of the SVI's, but for some reason this never worked."

Or try 172.16.0.0 255.255.0.0 172.16.0.254

View solution in original post

21 Replies 21