Layer 3 Catalyst and vlan routing help

T

TheDude05

Limp Gawd
Joined
Jan 27, 2005
Messages
393
I'm in the process of trying to move our companies network over from a public address range (199.0.9.x/24) which we dont own to a private range (192.168.200.x/24). I have a catalyst 3550 that I want to do the routing with. I have two vlans set up, one for the old subnet and one for the new subnet. Both vlans have a virtual interface. I have two machines in each vlan that can ping their respective virtual interface. I can ping each interface from the switch. Both vlans show up in the routing table but they will not route between one another. Heres some relevant info from the switch. Need some help. Thanks

Code: 
catalyst3550#sh run
Building configuration...

Current configuration : 5455 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname catalyst3550
!
enable secret 5 *******************************************
!
no aaa new-model
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
!
spanning-tree mode mst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
interface Port-channel1
 switchport mode access
 shutdown
!
interface Port-channel2
 switchport mode access
 shutdown
!
interface Port-channel3
 switchport mode dynamic desirable
 shutdown
!
interface Port-channel4
 switchport mode dynamic desirable
 shutdown
!
interface FastEthernet0/1
 switchport access vlan 2
 switchport mode dynamic desirable
!
interface FastEthernet0/2
 switchport mode dynamic desirable
!

... removed ...

!
interface Vlan1
 ip address 192.168.200.1 255.255.255.0
!
interface Vlan2
 ip address 199.0.9.2 255.255.255.0


... removed ..

and some show commands

Code: 
catalyst3550#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

C    199.0.9.0/24 is directly connected, Vlan2
C    192.168.200.0/24 is directly connected, Vlan1


catalyst3550#show int vlan1
Vlan1 is up, line protocol is up
  Hardware is EtherSVI, address is 0017.956f.de00 (bia 0017.956f.de00)
  Internet address is 192.168.200.1/24
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:01:30, output 00:01:58, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/57/0 (size/max/drops/flushes); Total output drops: 5
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     5753560 packets input, 718270615 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicast)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     23726 packets output, 3097765 bytes, 0 underruns
     0 output errors, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out


catalyst3550#show int vlan2
Vlan2 is up, line protocol is up
  Hardware is EtherSVI, address is 0017.956f.de00 (bia 0017.956f.de00)
  Internet address is 199.0.9.2/24
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 7
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 3000 bits/sec, 2 packets/sec
  5 minute output rate 2000 bits/sec, 2 packets/sec
     10554515 packets input, 1284335830 bytes, 0 no buffer
     Received 0 broadcasts (24631 IP multicast)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     19839 packets output, 1439295 bytes, 0 underruns
     0 output errors, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
 
you need to setup some static routes, or a routing protocol.

go into config
type router rip
then
version 2
network 192.168.200.0
network 199.0.9.0

or set it up according to what protocol you want
Id go with static routes since it seems to be a really simple network
 
I still have to route if I'm connected? If so, how should i set up the route? I tried a static earlier and got this

Code: 
catalyst3550(config)#ip route 192.168.200.0 255.255.255.0 192.168.200.1
%Invalid next hop address (it's this router)
 
Without knowing how your network is setup its a little hard to diagnose everything.

is your network setup like so?

switch(vlan 1) <> 3550 <> switch (vlan 2)

If so, you would want to setup f0/1 and f0/2 as trunks, also is this just connecting the two sites, or is it connecting the two sites and providing a path to the internet. Im not sure exactly what youre doing so bear with me.
 
Our network looks like this from top to bottom. I left our outside addresses out, just know the pix is doing pat.. (if it matters)


(Gateway Router) <--> (Pix 515 - 199.0.9.1) <--> (Cat 3550 vlans 1 & 2) <--> non-managed switches

vlan1 virtual interface address is 192.168.200.1
vlan2 virtual interface address is 199.0.9.2


I want to be able to route between the two vlans/subnets with both having access to the internet. Its so we can slowly migrate everything over to the new 192.168.200.x subnet
 
You won't need static routes for the internal subnets. All clients on both subnets should use the 3550 addresses as their default gateway. Then put a a route on the 3550 as follows:

ip route 0.0.0.0 0.0.0.0 199.0.9.1

You should also put a route on the PIX for the 192.168.200.0 subnet.

You could fire up Wireshark and start doing some packet traces. It sounds like a route issue. Packets probably get to the destination subnet, but the client may not know where to send the reply to.
 
TheDude05 said:
Our network looks like this from top to bottom. I left our outside addresses out, just know the pix is doing pat.. (if it matters)


(Gateway Router) <--> (Pix 515 - 199.0.9.1) <--> (Cat 3550 vlans 1 & 2) <--> non-managed switches

vlan1 virtual interface address is 192.168.200.1
vlan2 virtual interface address is 199.0.9.2


I want to be able to route between the two vlans/subnets with both having access to the internet. Its so we can slowly migrate everything over to the new 192.168.200.x subnet
Click to expand...

okay, first off, change your vlans so that they match the ip range (just for clarity's sake)
create 2 vlans (you shouldnt use vlan 1 for anything, its somewhat an unwritten rule to disable it as soon as you get your router, the interface at least)

vlan192 for the 192.168 network
vlan199 for the 199.0 network

create the vlan interfaces again (this will mean getting rid of the other interfaces)
int vlan192
ip add 192.168.200.1 255.255.255.0
int vlan199
ip add 199.0.9.2 255.255.255.0

next throw in an ip route to your default gateway
ip route 0.0.0.0 0.0.0.0 199.0.9.1 (im guessing your pix is the gateway)

next add the correct switch ports to whatever vlans they need to be a part of

the problem i think youre going to have is that the 199 address already is setup in terms of df gatways and whatnot.
you might want to look at doing the following instead of a vlan interface for 199

on any port not in use, type no switchport
this will allow it to be configured much like a routers int
then type ip add 199.0.9.2 255.255.255.0

and add a route on the pix to vlan192

also remember to issue no shutdowns on everything including the v-ints
 
Thanks for your help guys. This where I'm at right now

I added the static route for the 192 network on the pix. The pix routes the traffic to the vlan199 interface. I also added the default route on the switch which goes to the pix. I can ping the pix successfully from vlan192 which is good. I can also ping any host on vlan199 as long their gateway is the vlan199 interface.

BUT I still cant ping any 192.168.200.x address from my vlan199 host regardless if my gateway is the pix or the switch.


EDIT: FIXED. The machine I was trying it from has another NIC in it that is connected to Nortel switch I'm configuring. Thus my traffic was going out that interface :p ** hits head **


Thanks for your help guys!
 
You could have also added the network as a secondary to that vlan. (I use this frequently for migrating from one address space to another.)

ip address 192.168.200.1 255.255.255.0 secondary
ip address 199.0.9.2 255.255.255.0


NOTE: You should realy use another VLAN number other than 1. It's typicaly used for management. Good practice not to!
 
NOTE: Quick note for anyone who uses this thread for a solution. You may need to run "no ip redirects" or else your user's routing tables will be full of useless routes to internet hosts



Actually the secondary address would work better in my case. That way I wont have to worry about putting them in a new vlan. There are a couple reasons though why I am changing back to vlan1. I work in a small business as an intern during my breaks from college and this is my last break. My boss is more of a Windows Server guy and knows less than I do about networking. So my idea was that if they get a new switch he can just plug the thing in and not have to worry about configuring vlans since the new ports will default to 1. We only have about 130 devices on our network.

I know its terrible practice but to be honest I dont care. If the new guy who is replacing me wants to fix them he can do it but I don't know if he knows anymore than my current boss.
 
You must log in or register to reply here.
Back
Top