cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
876
Views
15
Helpful
12
Replies

Unable to get internet to core switch from firewall

kcross
Level 1
Level 1

So bear with me as I am familiar with networking but not to an extensive extent. We are in the process of replacing a switch and I am configuring/testing it. For some reason I am unable to get internet to the switch or ping the firewall from the switch. We are using a catalyst 9300 and a sonicwall for our firewall. I have the switch plugged into one of the interfaces on the firewall, and the interface on the firewall is assigned a IP (which I can ping and know if functioning). I created a VLAN on the firewall (VLAN 5) and assigned ge 1/0/1 to VLAN 5 and assigned it a IP from that VLAN. I have then set the firewalls address as the default gateway as well on the switch. I can ping the VLAN I created, I can ping the firewalls address from other hosts on the network but for some reason I can't reach it from the switch. The port is set as a trunk port (this also does not work as an access port). Any ideas what could be blocking this? I can attach the switch configuration if needed. Any advice would be greatly appreciated! 

1 Accepted Solution

Accepted Solutions

You need always to point to the right gateway to work. so 10.20.1.1 is the right one for your config.

you mean after changing from 10.20.1.1 still not able to reach internet ?

what is the device IP address, are you able to ping 10.20.1.1 ?

post new config to review?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

View solution in original post

12 Replies 12

balaji.bandi
Hall of Fame
Hall of Fame

i would advice to post the config. if the RFC1918 address to reach internet on Sonicwall you need to have NAT for that new VLAN 5 address space.

check sonicwall NAT policy and ACL:

https://www.sonicwall.com/support/knowledge-base/how-do-i-configure-nat-policies-on-a-sonicwall-firewall/170505782921100/

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Hello,

seeing the config would be helpful. From what you describe, all you basically need on the switch is this:

interface Vlan 5

ip address 192.168.5.2 255.255.255.0

ip default-gateway 192.168.5.1 (IP address of the SonicWall

I just posted the config, the default gateway (10.2.1.1) is the firewall, the VLAN 5 subnet is (10.20.1.1) which is why I assigned the interface on the switch (10.20.1.10)

Hello,

that does not look right. 

interface Vlan5
ip address 10.20.1.10 255.255.255.0
!
ip default-gateway 10.2.1.1

The SonicWall and the Vlan 5 interface of the switch are not in the same subnet. Change the IP address of the SonicWall to 10.20.1.1 and the default gateway statement on the switch to:

ip default-gateway 10.20.1.1

kcross_0-1667927869794.png

So here is the interfaces on the firewall, I am unable to change the IP of X2 due to the fact that VLAN5 is set to that IP address and I cannot have them both which is why I had it configured the way above. This is where the gap in knowledge occurs.

If the switch acts as layer2 only - as suggested you need to change the default gateway to 10.20.1.1 to work all your VLAN 5 clients.

by saying that VLAN 5 client can reach the gateway of SonicWall 10.20.1.1

for the internet, you need to check the SonicWall config to allow these IP to NAT.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Here is where I am confused, The interface on the firewall is set to 10.2.1.1 and I have created a Vlan interface (VLAN 5) on the firewall that is shown above (10.20.1.1). Should the gateway not be set to 10.2.1.1 since this is the firewall? Does setting the gateway to 10.20.1.1 still work even though this is just the VLAN interface? This is where my confusion comes in. Ultimately does setting it to 10.20.1.1 still get it to the firewall which in turn can get it to the internet? (if properly configured). Sorry for the questions

You need always to point to the right gateway to work. so 10.20.1.1 is the right one for your config.

you mean after changing from 10.20.1.1 still not able to reach internet ?

what is the device IP address, are you able to ping 10.20.1.1 ?

post new config to review?

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

This resolved the issue, thank you so much.

interface GigabitEthernet1/0/1
 switchport access vlan 5
 switchport mode trunk <<<<- this is trunk not access vlan 5

you make mistake in config g1/0/1 by add trunk after you assign vlan5 so the SW accept last command  

so I need to remove the second command correct? 

Correct remove it. 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card