08-02-2018 07:59 AM
Dear All,
This is my Network Diagram. When i am trying to ping from my CISCO 4331 Router to another vlan I am unable to ping. I am putting following command.
CISCO-4331-ROUTER#ping 192.168.16.1 source 192.168.15.250
or
CISCO-4331-ROUTER#ping 192.168.15.1 source 192.168.16.250
or
CISCO-4331-ROUTER#ping 192.168.17.1 source 192.168.16.250
Please suggest what changes I have to make to ping another vlan.
08-02-2018 08:48 AM
Can you post the configuration for the switch?
08-02-2018 09:44 PM
Hi Jackson,
interface GigabitEthernet1/0/35
description ****** CISCO-4331 ROUTER ******
switchport trunk allowed vlan 6-8
switchport mode trunk
interface GigabitEthernet1/0/2
description *** CONNECTED TO FORTINET INT-1 ***
switchport trunk allowed vlan 6-8
switchport mode trunk
* Do you have VLANs 6,7, and 8 created on the switch?
Ans : YES...
MAL-GIGA-SW#sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 xxxxxxxxxxxxxxxxxxxx
2 xxxxxxxxxxxxxxxxxxxxxx
3 xxxxxxxxxxxxxxxxxxxxxx
4 xxxxxxxxxxxxxxxxxxxxxx
6 SERVER-VLAN active Gi1/0/8
7 MANAGEMENT-VLAN active Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi1/0/15
Gi1/0/16, Gi1/0/17, Gi1/0/21, Gi1/0/22, Gi1/0/25
8 USER-VLAN active Gi1/0/27, Gi1/0/29, Gi1/0/30, Gi1/0/32, Gi1/0/33, Gi1/0/34, Gi1/0/36
Regards
Sanjay Goswami
08-02-2018 09:21 AM
Hello Sanjay,
I hope you're doing well.
Some questions regarding this setup:
* Are you able to ping Fortinet IP addresses from the Cisco router when not specifying the source of the ICMP echo request in the ping command? Or by sourcing with IP address within the same VLAN as destination IP address.
* Are those interfaces on the Catalyst switch configured as trunk interfaces? Both the one connected to the router and the one connected to the Fortinet device.
* Do you have VLANs 6,7, and 8 created on the switch?
* Is that Fortinet device not filtering ICMP echo requests or allowing ICMP echo request from any source?
You can also create Layer 3 VLAN interfaces (VLAN SVIs) on the switch fro testing purposes and try pinging the configured IP address for each VLAN from the router or from the Fortinet device.
Regards,
08-02-2018 09:41 PM
Hi Andres
At first thanks for your quick response. Please find the required information,
* Are you able to ping Fortinet IP addresses from the Cisco router when not specifying the source of the ICMP echo request in the ping command? Or by sourcing with IP address within the same VLAN as destination IP address.
Ans: YES but in same VLAN not others.
MAL-HO-4331#ping 192.168.15.1 source 192.168.15.250
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.15.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.15.250
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
******* THIS IS NOT WORKING (WHICH IS MY ACTUAL ISSUE) *****
MAL-HO-4331#ping 192.168.15.1 source 192.168.16.250
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.15.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.16.250
* Are those interfaces on the Catalyst switch configured as trunk interfaces? Both the one connected to the router and the one connected to the Fortinet device.
Ans: Yes. Both the Interfaces has been configured as Trunk. Here is the configuration,
interface GigabitEthernet1/0/35
description ****** CISCO-4331 ROUTER ******
switchport trunk allowed vlan 6-8
switchport mode trunk
interface GigabitEthernet1/0/2
description *** CONNECTED TO FORTINET INT-1 ***
switchport trunk allowed vlan 6-8
switchport mode trunk
* Do you have VLANs 6,7, and 8 created on the switch?
Ans : YES...
MAL-GIGA-SW#sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 xxxxxxxxxxxxxxxxxxxx
2 xxxxxxxxxxxxxxxxxxxxxx
3 xxxxxxxxxxxxxxxxxxxxxx
4 xxxxxxxxxxxxxxxxxxxxxx
6 SERVER-VLAN active Gi1/0/8
7 MANAGEMENT-VLAN active Gi1/0/9, Gi1/0/10, Gi1/0/11, Gi1/0/12, Gi1/0/13, Gi1/0/14, Gi1/0/15
Gi1/0/16, Gi1/0/17, Gi1/0/21, Gi1/0/22, Gi1/0/25
8 USER-VLAN active Gi1/0/27, Gi1/0/29, Gi1/0/30, Gi1/0/32, Gi1/0/33, Gi1/0/34, Gi1/0/36
* Is that Fortinet device not filtering ICMP echo requests or allowing ICMP echo request from any source?
Ans : No Idea.
Please feel free for any other clarification.
Regards
Sanjay Goswami
08-03-2018 08:42 AM
Test the following on the router:
!Ping router IP address in VLAN 6 from the router itself sourcing from VLAN 7
ping 192.168.15.250 source 192.168.16.250
!Similarly
ping 192.168.15.250 source 192.168.17.250
ping 192.168.16.250 source 192.168.17.250
Consider, as suggested previously, configuring Layer 3 VLAN interfaces (VLAN SVIs) on the switch for testing purposes and try pinging the configured IP address for each VLAN from the router or from the Fortinet device.
Comment on your results?
Share the configuration of both the router and the switch.
Comment on your results.
Regards,
08-04-2018 03:49 AM
08-03-2018 12:52 AM
Hello
Disable any ip routing enabled on the switch.
08-04-2018 06:52 AM
08-03-2018 01:52 AM - edited 08-03-2018 01:52 AM
Hello,
Couple of questions / considerations:
1. Is there any possibility to see Cisco 2900 switch configuration?
2. It could be a good idea to use native VLANs on trunks as well
3. Consider to disable DTP on trunk links at least between Cisco 2900 device and Fortinet device
4. Make sure that Cisco 2900 and Fortinet device using same STP mode
5. Please provide show interface gi1/0/2 and show spanning-tree vlan for appropriate VLANs on Cisco 2900 switch
This will give more information about your setup.
08-04-2018 06:14 AM
08-04-2018 11:31 AM - edited 08-04-2018 11:34 AM
Hello,
OK, based on your configuration you are using PVST mode. Make sure that your Fortinet switch is using the same STP mode otherwise you may face up with very strange LAN behavior including Layer 2 loops. Second - due to you are not specifying any native VLAN on trunk port between Fortinet and Cisco 2960 switch, by default Cisco switch will use VLAN 1. If native VLAN will mismatch STP tree for all VLANs might note be formed and Layer 2 loops may occur.
I would recommend following configuration:
1. Configure both switches to use same STP mode
2. Configure dummy VLAN (for example 999) as dummy VLAN to be used as native VLAN for trunk port to Fortinet switch. You may consider to use this VLAN as native VLAN for all trunk ports
3. Disable DTP protocol on this trunk interface to dynamically negotiate trunk settings. This might be an issue when you establish trunk connections to non-Cisco devices. This needs to be done on both ends for Cisco and Fortinet device
All in all, your configuration on Cisco 2960 switch will look like this:
!
vlan 999
name NATIVE-DYMMY
!
interface GigabitEthernet1/0/2
description *** CONNECTED TO FORTINET INT-1 ***
switchport trunk allowed vlan 6-8
switchport trunk native vlan 999
switchport mode trunk
switchport nonegotiate
!
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: