Some interfaces/VLAn are not trunking

Fabri_Fabri · ‎08-16-2013

Hi,

I inherited networking environment in an office and I'm trying to understand a few things.

Basically I have 2 switch catalyst connected through a trunk port. One port from the main switch (configured as a trunk too) is connected with an ASA firewall.

If I do "sh interfaces trunk" on the main switch I get:

=================================================

Port Mode Encapsulation Status Native vlan

Fa0/1 on 802.1q trunking 1

Fa0/11 on 802.1q trunking 1

Port Vlans allowed on trunk

Fa0/1 1-4094

Fa0/11 10-15,20

Port Vlans allowed and active in management domain

Fa0/1 1,5,11,40,50,9-15,20,999

Fa0/11 10-15-20

Port Vlans in spanning tree forwarding state and not pruned

Fa0/1 1,5,11,40,50,9-15,20,999

Fa0/11 10-15,20

=================================================

The Fa0/1 port is trunk to secondary switch.

The Fa0/11 port is trunk to firewall.

And I don't understand why only few vlan are trunked to firewall through that port (Fa0/11).

The main problem is that I configured a port in switch02 with vlan12 and it doesn't work.

cable is ok, link is up and protocol is up. I think the problem is trunk because on the same switch vlan12 works well.

I have many other vlan configured on switches and they trunk ok (for example vlan9).

On the main switch if I try a : "sh int fa0/15 trunk" (fa0/15 configured as vlan12)

Port Mode Encapsulation Status Native vlan

Fa0/15 auto negotiate not-trunking 1

Port Vlans allowed on trunk

Fa0/15 12

Port Vlans allowed and active in management domain

Fa0/15 12

Port Vlans in spanning tree forwarding state and not pruned

Fa0/15 12

status is "not-trunking" but I can't really understand why. Is it related to firewall trunk ?

Can you please help ?

Thanks.

John Blakley · ‎08-16-2013

If you look at f0/11, you will probably see a line that states "switchport trunk allowed vlan 10-15,20". If you want all vlans, allowed on the trunk, you can remove that line.

Port f0/15 is connected to a host that cannot trunk. The port's default is dynamic desirable, but the other side cannot trunk, so the port ends up in a non-trunking state. It's only allowing vlan 12 over that port. That could be because this port has a configuration of "switchport access vlan 12", but it's mode is dynamic desirable. If that's the case and dynamic fails, the port is set to an access port in the vlan specified.

HTH,
John

*** Please rate all useful posts ***

HTH, John *** Please rate all useful posts ***

glen.grant · ‎08-16-2013

Did you actually create vlAN 12 in switch 2 ? If you do a show vlan does vlan 12 show up ? Can post the config for Sw2 , at least the coneecting port config.

Fabri_Fabri · ‎08-19-2013

Hi John, hi glen thanks for reply.

To help diagnosing I phisically connected an host to a switch2 port configured in vlan 12 and it works; it can ping another host on vlan 12 connected to switch1. I think it confirms that trunking is working (even if a "sh int fa0/41 trunk" executed on switch1 get a non-trunking status, who knows why).

Actually, sorry not being probably clear, the problem is to ping the new host connected to vlan 12 from another vlan.

And I suspect that the problem is in the configuration of the trunking port that connect switch to firewall; in fact the very first host (configured from previous guy) on vlan 12 is pingable from other vlans ... the new one is not.

Also, I examined the fw configuration related to that vlan but I can't find any access-list that seems to restrict hosts.

Any help appreciated.

Regards

Fabri_Fabri · ‎08-19-2013

I can add that using packet tracer using ICMP (echo and echo reply) the packet is allowed from an host in another vlan to vlan 12 !!

Packet tracer says it is allowed .. but when I ping from windows and/or from Linux, the ping fails.

If I ping from the firewall console to new host in vlan 12 (connected to switch1), it works.

If I ping from switch1 console to new host in vlan 12 (connected to switch1) it DOES NOT work (ODD..).

If I ping from switch2 console to new host in vlan 12 (connected to switch1) it DOES NOT work.

This is strange to me, isn't it ?