Require multiple ports on a workstation interface

[James Pilcher]

Hello,

We have 2 vlans 99 & 82; 99 is a Q/A environment and 82 is a development one. I want to be able to manage devices from both networks from my admin workstation.

The network path looks like this: workstation ---> 2960 FPS (A) --> 4500-x --> 2960 FPS (B) --> vlans 99 & 82

I am able to ping from switch A to both vlans gateway addresses as well as a devices inside each of the vlans.

The workstation current interface config is:

interface GigabitEthernet5/0/19
 switchport access vlan 82
 switchport trunk native vlan 99
 switchport trunk allowed vlan 82,99
 switchport mode trunk

I can ping any address in the 99 vlan but cannot ping an address in the 82 vlan.

Any assistance will be appreciated.

[Jon Marshall]

Do both vlans have L3 interfaces on the 4500 switch or is that the reason you need to have both vlans on your workstation ?

Jon

[James Pilcher]

There are vlan interfaces with configured IP's on all 3 switches. 

Configs:

Switch (A)

stack1#sh run int vlan 99
interface Vlan99
 ip address 10.10.x.x 255.255.0.0
end

stack1#sh run int vlan 82
interface Vlan82
 ip address 10.2.82.x 255.255.255.0
end

4500:

CORE#sh run int vlan 99
interface Vlan99
 ip address 10.10.x.x 255.255.0.0
 ip helper-address 10.20.2.x
 ip helper-address 10.20.2.x
 ip helper-address 10.20.2.x
 ip helper-address 10.99.1.x
 ip helper-address 10.20.2.x
 ip helper-address 10.20.2.x
 ip helper-address 10.20.2.x
 ip helper-address 10.71.1.x
 ip directed-broadcast
end

CORE#sh run int vlan 82
interface Vlan82
 ip address 10.2.82.x 255.255.255.0
end

Switch (B):

Dev1#sh run int vlan 99
interface Vlan99
 ip address 10.10.x.x 255.255.0.0
end

Dev1#sh run int vlan 82
interface Vlan82
 ip address 10.2.82.x 255.255.255.0
end

[Jon Marshall]

So if your 4500 has L3 interfaces for both vlans then you don't need your workstation in both vlans.

Just pick one of them, make the port connecting to your workstation an access port in that vlan, assign an IP to your workstation from that vlans IP subnet and set the default gateway to be the L3 SVI IP for the vlan on the 4500.

Note the IP stuff will probably be via DHCP unless you want your workstation to have a static IP for acls etc.

Then let the 4500 route between the vlans.

I can't see why you need your workstation to be in both vlans.

Is there a specific reason for that ?

Jon

[James Pilcher]

That is what I thought at first, my initial workstation interface config was a simple one:

Switchport access vlan 99

switchport mode access

end

But with that config if i ping anything in the 10.2.82.x (vlan 82) i don't get a reply. but from the switch A vlan 82 pings just fine.

At first I thought I might need a specific ACL to allow traffic from my workstation (either IP or MAC) to vlan 82 but I was not sure so I opened this discussion to see if I was off on anything.
 

[Jon Marshall]

What are the gateway IPs for both vlans ?

I notice your 4500 has SVIs for both vlans but so does the Dev1 device which presumably is the 2960 FPS (B) switch ?

Edit - also I can't see any acls in your configurations, are there any ?

Jon

[James Pilcher]

The vlans have IP's but no specified gateway. My understanding is that the IP address of the vlan is the gateway address for that vlan on that switch.

the only switch that has ACl's is the 4500 which is the core L3 router for the environment switch (A) belongs to, switch (B) however was designed to be a separate network separated by vlan and un-accessible to the 99 vlan with a single connection for management purposes only.

I can send the ACL list but it is quite extensive.

[Jon Marshall]

The vlans have IP's but no specified gateway. My understanding is that the IP address of the vlan is the gateway address for that vlan on that switch.

Each client in a vlan should have a default gateway which is the L3 vlan interface on the your L3 switch which I assume is the 4500.

switch (B) however was designed to be a separate network separated by vlan and un-accessible to the 99 vlan with a single connection for management purposes only

I don't follow.

Your original schematic shows vlans 82 and 99 on switch B, is that not the case ?

If vlan 82 is not meant to be accessible to vlan 99 is this done purely by acls or  does vlan 82 not route off the 4500 ?

If all devices in both vlans have their default gateways set to the corresponding IP on the 4500 then it sounds like it is the acl that is blocking the traffic.

But the configuration you posted shows no acls applied to any of the SVIs on the switches.

All your switches seem to have multiple SVIs which is unusual.

Can you confirm what the default gateways are for devices on both vlans so we can at least work out which switch is routing for which vlan.

Jon