cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1298
Views
5
Helpful
15
Replies

Routing issue 3560

Stacey Hummer
Level 1
Level 1

So, with all the changes on my network I seem to have forgotten all the basic information I have learned over time. I have my 3560 as the "core" switch/router running ospf. Everything works fine on the switch itself. But on port G0/21 is my ASA firewall. As I've previously posted the IPs I will do again.

Core switch 3560 - 10.2.0.2

                     G0/21 no switchport ip address 10.3.0.4 -------> ASA 10.3.0.10

From the 3560 I can ping 10.3.0.10 no problem.

I did a extended ping and said to ping from 10.2.0.2 and was not able to ping 10.3.0.10 which is sitting attached to G0/21

Routing entry for 10.3.0.0/24
  Known via "connected", distance 0, metric 0 (connected, via interface)
  Redistributing via eigrp 100, ospf 100
  Routing Descriptor Blocks:
  * directly connected, via GigabitEthernet0/21
      Route metric is 0, traffic share count is 1

 

router ospf 100
 router-id 10.2.0.2
 redistribute connected subnets
 redistribute static subnets
 network 10.2.0.0 0.0.255.255 area 0
 network 10.3.0.0 0.0.0.255 area 0
 network 10.4.1.0 0.0.0.255 area 0
 network 10.4.2.0 0.0.0.255 area 0
 network 10.4.0.0 0.0.255.255 area 0
 network 172.18.0.0 0.0.255.255 area 0
 network 192.168.1.0 0.0.0.255 area 0
 default-information originate

3560_B86_Core#ping 10.3.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.3.0.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

3560_B86_Core#ping
Protocol [ip]:   
Target IP address: 10.3.0.10
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 10.2.0.2
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.3.0.10, timeout is 2 seconds:
Packet sent with a source address of 10.2.0.2
.....

 

What am I missing ??? :(

Thanks in advance

 

 

15 Replies 15

The ASA pings work because it is using two different interfaces when you ping ie. the inside and the management interface.

But from the switch you are pinging the inside interface with a source IP of 10.2.x.x. But the ASA can't route that back from the inside interface because it has a directly connected interface in that IP subnet.

Jon