No Internet Access and Unable to Ping out on Layer 3 Switch

[BennyTheBee]

I am doing a project in my class where I have to be able to access the internet from a layer 3 switch that is using internalVlan routing. 

I am using the schools internet connection to supply the switch/hosts with the connection. I am able to ping to other devices on the VLAN, and I am able to ping the switch. That is where it stops. I am unable to ping the schools gateway and beyond. 
I have ip routing enabled, and I have the fa1/0/48 using switchport mode trunk. switchport trunk encapsulation dot1q.

Any ideas how to solve this would be greatly appreciated. 

[Georg Pauwen]

Hello,

is this a real project, or a simulation ? Check if your switch can do NAT (some can, while most cannot). Which switch model do you have ?

[Richard Burts]

I agree with the points made by Georg. And I am thinking about the statement in the original post that he can not ping the school gateway and beyond. That suggests that the gateway may not have a route to the subnet he is connected to. And that would certainly prevent any Internet access.

[BennyTheBee]

The model of the switch is a Catalyst 3750 v2. I have setup ip route with 0.0.0.0 0.0.0.0 10.10.12.1. I may have configured the ip route wrong.

[Richard Burts]

Thanks for the additional information. The 3750 switch does not support doing address translation. So for your traffic to access the Internet you will need to configure address translation on an appropriate device (probably the school gateway). Do you have access to that device?

We see that address translation will be an issue, but it is not the only issue. Address translation would not have any impact on being able to ping the gateway. So if you can not ping the gateway then there is some additional issue. We do not know enough about your environment to know if you configured the default route incorrectly or if the gateway does not have a route to your subnet, or whether it might be something else. Do you have access to the gateway? If so can you test whether the gateway can ping to something in your subnet?

[BennyTheBee]

I do not have access to the gateway, but I do as well have a 1900 Router as well as a 2811 I believe. I can post the running config if you wish.

[BennyTheBee]

Anything that we use with the out of the box config will work to an outside connection, but as soon as we start throwing configs on it, it bricks the connection. 

[BennyTheBee]

Another update. I have configured the 1900 Router to have int ge0/1 to get an ip from the schools dhcp. I have set int ge0/0 with a private ip. I set a ip route of 0.0.0.0 0.0.0.0 ge0/1. I am able to ping the gateway from the router still, and I am able to ping the switch from the router. On the switch I am able to ping the Router, but I am unable to ping past that. 

[Richard Burts]

Glad to hear that you have made progress and that the router is now able to ping the gateway. A static route which specifies just the outbound ethernet interface may work but it is an inefficient solution (in part because it will have to arp for every destination address to which it wants to forward traffic). A better static default route would be for 0.0.0.0 0.0.0.0 dhcp.

I believe that the reason why the switch is able to ping the router but not beyond that is that the device to which the router connects does not have a routing entry for the subnet you have created for the switch.

[BennyTheBee]

I do believe I tried that for a static route before I tried the port. It did not work as well, but I will try that again.

[BennyTheBee]

We are also going to be checking with the schools IT to see if we can get a direct outside connection to the ISP.

[Richard Burts]

The way of configuring the static default route that I suggested should work and be better than just specifying the outbound interface. If you tried it and it did not work (or work as well) then please post details of how you configured it and what the issue was.

A direct connection to the ISP would make it simpler than switch connecting to router going through school network to school gateway. Depending on how it is set up you are likely to need to do address translation for your traffic going to the Internet. Doing address translation probably means that you will need a router to be able to do it.

[BennyTheBee]

After asking around, it seems it may be an ACL block.

[Richard Burts]

Thanks for the update.

[BennyTheBee]

So we have since eliminated the switch and are directly connected to the router. The PC and router can now ping the schools gateway, but they are unable to ping past it. 

Router Config for the interfaces

int gigabitEthernet0/0

      ip address 192.168.1.1 255.255.255.0

      ip nat inside 
int gigabitEthernet0/1
      ip address dhcp

      ip nat outside

ip route 0.0.0.0 0.0.0.0 gigabitEthernet0/0

access-list 50 permit 192.168.1.0 0.0.0.255

ip nat inside source list 50 interface 50 interface gigabitEthernet0/1 overload

ip routing