Ping across VLAN's

[Andrew D]

I'm having problems pinging across VLAN's on my stacked switches. Any help would be appreciated.

!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log datetime localtime
service password-encryption
service sequence-numbers
!
!
no aaa new-model
clock timezone EST -5
clock summer-time EST recurring
switch 1 provision ws-c3750g-24t
switch 3 provision ws-c3750g-24t
system mtu routing 1500
ip routing
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface GigabitEthernet1/0/1
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/2
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/3
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/4
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet1/0/5
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet1/0/6
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet1/0/7
 description iSCSI
 switchport access vlan 100
 switchport mode access
!
interface GigabitEthernet1/0/8
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet1/0/9
 description LAN
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet1/0/10
 description LAN
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/0/13
 description esxi1 - mgmt
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet1/0/14
 description esxi1 - vmotion
 switchport access vlan 101
 switchport mode access
!
interface GigabitEthernet1/0/15
 description esxi1 - iDrac
 switchport access vlan 103
 switchport mode access
!
interface GigabitEthernet1/0/16
 description esxi3 - mgmt
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet1/0/17
 description LAN
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet1/0/18
!
interface GigabitEthernet1/0/19
 description esxi3 - iDrac
 switchport access vlan 103
 switchport mode access
!
interface GigabitEthernet1/0/20
!
interface GigabitEthernet1/0/21
 description Laptop - Mgmt
 switchport access vlan 103
!
interface GigabitEthernet1/0/22
!
interface GigabitEthernet1/0/23
 description esxi - uplink
 switchport access vlan 999
 switchport mode access
!
interface GigabitEthernet1/0/24
 description Primary Uplink
 switchport access vlan 999
 switchport mode access
!
interface GigabitEthernet3/0/1
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet3/0/2
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet3/0/3
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet3/0/4
 description SAN
 switchport access vlan 102
 switchport mode access
 spanning-tree portfast
!
interface GigabitEthernet3/0/5
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet3/0/6
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet3/0/7
 description iSCSI
 switchport access vlan 100
 switchport mode access
!
interface GigabitEthernet3/0/8
 description iSCSI
 switchport access vlan 102
 switchport mode access
!
interface GigabitEthernet3/0/9
 description LAN
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet3/0/10
 description LAN
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet3/0/11
!
interface GigabitEthernet3/0/12
!
interface GigabitEthernet3/0/13
 description esxi2 - mgmt
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet3/0/14
 description esxi2 - vmotion
 switchport access vlan 101
 switchport mode access
!
interface GigabitEthernet3/0/15
 description esxi2 - iDrac
 switchport access vlan 103
 switchport mode access
!
interface GigabitEthernet3/0/16
!
interface GigabitEthernet3/0/17
!
interface GigabitEthernet3/0/18
!
interface GigabitEthernet3/0/19
!
interface GigabitEthernet3/0/20
!
interface GigabitEthernet3/0/21
 description esxi - Uplink
 switchport access vlan 999
 switchport mode access
!
interface GigabitEthernet3/0/22
 description Laptop - Prod
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 100,102,103
 switchport mode trunk
!
interface GigabitEthernet3/0/23
 description esxi - Uplink
 switchport access vlan 999
 switchport mode access
!
interface GigabitEthernet3/0/24
 description Backup Uplink
 switchport access vlan 999
 switchport mode access
!
interface Vlan1
 no ip address
!
interface Vlan100
 ip address 10.10.100.253 255.255.255.0
!
ip default-gateway 10.10.100.1

ip route 0.0.0.0 0.0.0.0 10.10.100.1
ip classless
no ip http server
ip http secure-server
!
logging trap debugging
logging facility local2
!
!
line con 0
!
end

[GRANT3779]

Are we talking between Vlans, e.g from host in vlan 100 to a host in vlan 102? Or are you saying within the same vlan?

I see no default gateway configured for any other vlan apart from 100 on the switch. Is this switch intended to be the GW for all VLANs or do you have a router doing ROAS hanging off that switch?

If the switch is intended to be GW for all vlans then you will need to configure SVIs for the other vlans. If you have other layer 3 device elsewhere though then topology may help. 

If we are talking intra vlan communication then this is something else.

[Andrew D]

Between different VLANs the switch will not be used as a GW. I have a FW sitting on the trunk ports for 100,102,103.

[Julio E. Moisa]

Have you allowed icmp using ACLs? could you please provide more details about the FW. 

[Andrew D]

I'm thinking it's something with my switch. it's not showing ARP entries for physical devices that are on VLAN 103

000937: *Jun 11 17:38:32: %SYS-5-CONFIG_I: Configured from console by vty0 (127sh ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.10.100.5             0   000c.295e.bc62  ARPA   Vlan100
Internet  10.10.100.6            48   0050.56a4.5b0d  ARPA   Vlan100
Internet  10.10.100.1             7   0050.5699.001b  ARPA   Vlan100
Internet  10.10.100.10          159   0050.5699.7508  ARPA   Vlan100
Internet  10.10.100.20           48   000c.2953.a470  ARPA   Vlan100
Internet  10.10.100.25            0   000c.29f9.a575  ARPA   Vlan100
Internet  10.10.100.253           -   0023.abe9.6dc1  ARPA   Vlan100
Internet  10.10.103.253           -   0023.abe9.6dc2  ARPA   Vlan103

[GRANT3779]

What device does mac 0023.abe9.6dc2 belong to?

[Andrew D]

That is an IP i gave to vlan103 on the switch hoping it might help.

[GRANT3779]

Your switch naturally won't have any arp entries for any other ips except the 10.10.100.x /24 range.

Do you have a topology?

Is 10.10.100.1 an interface on the Juniper?

Can the 10.10.100.1 device reach the gw for the vlan 103 network?

[Andrew D]

The FW can ping it's own interface IP's so 10.10.100.1 can ping 10.10.103.1. Also to throw this out there, i have 1 physical device on 10.10.100.x and I can ping 10.10.103.1 but nothing else after that, just the GW

[Andrew D]

But when I run a trace on the FW it's hitting the correct policies and is passing... makes no sense

[Andrew D]

Attached is a wireshark capture

[Andrew D]

Attached is another capture showing it hitting the firewall policy and being approved.

[Andrew D]

Attached is a quick and fancy drawing. I didnt include all of the interfaces that are in the ARP table, some are SAN connections/iSCSI etc. but hope this helps. Everything is virtually being done except the physical switch and the 2 physical servers and a SAN. Each server has 8 eth ports on them.

[Andrew D]

I figured out my problem, thanks guys for all your help

[Julio E. Moisa]

Hi

Have you considered to use etherchannel instead 2 trunks?