Routing between two 3560

[Steen.Larsen]

Hi,

I have created a route between two switches that I plan to connect at two different locations.

One is at main site and has the following VLAN, route interface and routes:

interface Vlan16

ip address 10.45.16.252 255.255.255.0

interface GigabitEthernet4/0/12

no switchport

ip address 10.45.32.253 255.255.255.252

spanning-tree link-type point-to-point

ip route 0.0.0.0 0.0.0.0 10.45.16.1

ip route 10.45.32.0 255.255.255.192 10.45.32.254

ip route 10.45.233.0 255.255.255.0 10.45.32.254

The second switch at remote site has:

interface GigabitEthernet0/48

no switchport

ip address 10.45.32.254 255.255.255.252

interface Vlan111

ip address 10.45.233.1 255.255.255.0

ip helper-address 10.45.16.6

!

ip route 0.0.0.0 0.0.0.0 10.45.32.253

Now, almost everthing is good except from the remote site I cannot get to the 10.45.16.0/24 network. That is I can ping the 10.45.16.1 and the 10.45.16.252 addresses of the partner switch and the gateway but not any other addresses in the network. The DHCP server is on the 10.45.16.0/24 network and clients at remote site can acquire ip and get to all other network but the one local to the partner switch.

From the 10.45.16.0/24 network hosts I can reach the remote site 10.45.233.0/24 fine.

What am I missing here?

[nisagar]

Hi,

Please Add "ip route 10.45.16.0 255.255.255.0 10.45.32.254" in main site to reach 10.45.16.0/24 network from remote site.

[Steen.Larsen]

Do you mean I should add this route to the switch at main site that has this LAN and send to 10.45.32.254 which is the route link IP at the remote site?

[Jan Hrnko]

Hi Nitin,

I'm sorry but are you sure that would help to solve this issue? It seems to me that you would only create route from the switch where the lan already is back to the network of the host that is trying to access it. To put it in another words: the switch where you want to put the ip route command has this network directly conneted. I believe that the problem and solution is somewhere else.

Best regards,

Jan

[Jan Hrnko]

Hi Steen,

A friend of mine suggested that the problem is likely to be on the hosts itself or maybe it is problem of some firewall. I believe that if you can ping 10.45.16.1 and the 10.45.16.252 adresses the routing works just fine.

Best regards,

Jan

[Jason Dance]

Steen,

Are the other main site ip address ranges that you are trying to ping from the remote site hosted in vlans on the same main site switch?  Or is 10.45.16.1 hosted on another router / L3 switch?

[Steen.Larsen]

10.45.16.0/24 is in one VLAN only connected directly to the main site switch.

10.45.16.1 is the default gateway and this is the firewall - also acting as a router for this network.

Normally the hosts on 10.45.16.0/24 has 10.45.16.1 as default gateway but even if I set one to use 10.45.16.252 (the main site switch) it cannot be reached from remote site.

[tironevi]

Steen,

What is the Default Gateway that DHCP is providing to the remote clients?

Can you provide a traceroute  from the remote client towards 10.45.16.0/24.

[Steen.Larsen]

Default gateway for the remote site clients at 10.45.233.0/24 is 10.45.233.1 - the IP of the local VLAN111.

Here are examples of traceroutes:

First one that fails to a host at 10.45.16.80/24

C:\Documents and Settings\Steen>tracert 10.45.16.80

Tracing route to host16 [10.45.16.80]

over a maximum of 30 hops:

  1    <1 ms    <1 ms     1 ms  10.45.233.1

  2    <1 ms    <1 ms    <1 ms  10.45.32.253

  3     *        *        *     Request timed out.

  4     *     ^C

Heres one that goes to 10.45.16.1

C:\Documents and Settings\Steen>tracert 10.45.16.1

Tracing route to 10.45.16.1 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.45.233.1

  2    <1 ms    <1 ms    <1 ms  10.45.32.253

  3    <1 ms    <1 ms    <1 ms  10.45.16.1

Trace complete.

And the same to 252

C:\Documents and Settings\Steen>tracert 10.45.16.252

Tracing route to switch-cluster [10.45.16.252]

over a maximum of 30 hops:

  1     1 ms    <1 ms    <1 ms  10.45.233.1

  2    <1 ms    <1 ms    <1 ms  switch-cluster [10.45.16.252]

Trace complete.

Here's one that goes to another network beyond the firewall

C:\Documents and Settings\Steen>tracert 10.45.240.20

Tracing route to host3 [10.45.240.20] over a maximum of 30 hops:

  1     2 ms     1 ms    <1 ms  10.45.233.1

  2    <1 ms    <1 ms    <1 ms  10.45.32.253

  3     5 ms     1 ms    <1 ms  10.45.16.1

  4     1 ms    <1 ms    <1 ms  hosts3 [10.45.240.20]

Trace complete.

Lastly one that goes from 10.45.16.80 back to the host on the remote site

C:\Documents and Settings\Steen>tracert 10.45.233.31

Tracing route to host31 [10.45.233.31]

over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  10.45.16.1

  2     2 ms     1 ms    <1 ms  switch-cluster [10.45.16.252]

   3     5 ms     4 ms     4 ms  10.45.32.254

  4    <1 ms    <1 ms    <1 ms  host31 [10.45.233.31]

Trace complete.

[Peter Paluch]

Hi Steen,

Jan suggested that the problem does not seem to be in your network devices' configuration but rather in the configuration of the individual stations you are pinging or tracerouting to. As soon as you have successfully pinged at least one IP adress within the network 10.45.16.0/24 different from the router itself (such as 10.45.16.1), the routing has been proven to work correctly. You now have to inspect the individual stations that do not respond for the reason why they didn't respond:

• Are they configured to respond to pings? Are they using any kind of firewall?
• Do they use a correct default gateway? Does that gateway know how to reach back your network 10.45.233.0/24?

Best regards,

Peter

[Steen.Larsen]

The hosts are responding to ping from all other networks and no matter what gateway 10.45.16.1 or 10.45.16.252.

I have now found that changing the default gateway on the main site hosts at 10.45.16.0/24 to 10.45.16.252 seems to resolve it.

It must be the ring routing when some hosts use the firewall 10.45.16.1 address and possibly the firewall that drops this traffic.

[Jason Dance]

Does 10.45.16.1 (the firewall/router) have the following routes?:

ip route 10.45.32.0 255.255.255.192 10.45.16.252

ip route 10.45.233.0 255.255.255.0 10.45.16.252

If not you may want to add them.

This will create the following routing pattern though:

inbound: remote host > 10.45.233.1 > tunnel > 10.45.32.253 > (via vlan 16 and .252) host

outbound: host > 16.1 > 10.45.16.252 > tunnel > 10.45.32.254 >remote host.

I would recommend separating the firewall onto its own network and letting the L3 switch do the internal routing, it would be a little cleaner.

HTH

Jason

[Steen.Larsen]

The firewall does have these routes.

I believe you are on to something but I think that changing all hosts gateway to the main site switch will work as well as separating the firewall.

Thank you for you help.

[Jason Dance]

You're welcome, glad I could help!

-Jason