• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Weird routing problem (PFSense, Cisco 3550)

M

Meanee

n00b
Joined
Feb 6, 2013
Messages
46
Hello everyone.

I hope some gurus would be able to help me out with a problem that is really kicking my ass.

Here's the setup.

I have an ESX server with a vSwitch and 3 port groups. Each port group is a VLAN.
Group 1 - 10.0.10.0/24
Group 2 - 10.0.5.0/24
Group 3 - 10.0.50.0/24

In addition, untagged group of 192.168.1.0/24 (on another NIC from ESX) which is also part of my home network.

My main router is a pfSense, My VLAN router is a Cisco 3550, used to route traffic between those group VLANs above.

Now, here's the problem.
Each group can easily ping each other.
I can ping each group's hosts from my main PC, at 192.168.1.0/24 network.
But when it comes to pinging 192.168.1.1 from any group, it goes nowhere.

Here's my configuration from 3550 (useless junk removed)

ip subnet-zero
ip routing
!
vtp mode transparent
vlan internal allocation policy ascending
vlan dot1q tag native
!
vlan 2005
!
vlan 2010
!
vlan 2050
!
vlan 2060
!
interface FastEthernet0/47
switchport trunk encapsulation dot1q
switchport mode trunk
interface Vlan1
ip address 192.168.1.236 255.255.255.0
!
interface Vlan2005
ip address 10.0.5.1 255.255.255.0
!
interface Vlan2010
ip address 10.0.10.1 255.255.255.0
!
interface Vlan2050
ip address 10.0.50.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.1.1


On pfSense, I defined static routes.
J4kHjdY.png



And weird thing is, when I ping from Cisco's 10.0.5.1 or any other SVIs, it goes nowhere too.
Here's me trying to ping.
Switch#ping 192.168.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Switch#ping 10.0.5.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.5.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Switch#ping 10.0.5.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.5.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Switch#ping
Protocol [ip]:
Target IP address: 192.168.1.1
Repeat count [5]:
Datagram size [100]:
Timeout in seconds [2]:
Extended commands [n]: y
Source address or interface: 10.0.5.1
Type of service [0]:
Set DF bit in IP header? [no]:
Validate reply data? [no]:
Data pattern [0xABCD]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.0.5.1
.....
Success rate is 0 percent (0/5)
Switch#

Any clues? I am banging my head against the wall. Went as far as recreating this same exact scenario in Packet Tracer and it works 100%
 
Remove this command "vlan dot1q tag native". You have specified that VLAN1 (native) is also tagged, but ESX does not expect to get tagged traffic for VLAN1, since ESX does not tag VLAN1.
Or change on ESX to tag also VLAN1.

This should solve the problem.
 
alkocelj said:
Remove this command "vlan dot1q tag native". You have specified that VLAN1 (native) is also tagged, but ESX does not expect to get tagged traffic for VLAN1, since ESX does not tag VLAN1.
Or change on ESX to tag also VLAN1.

This should solve the problem.
Click to expand...

Did that. Removed the vlan dot1q tag native. Same thing, unfortunately
 
Can you ping each SVI from pfSense?

What is the firewall config on the LAN interface?
 
djflow195 said:
Can you ping each SVI from pfSense?

What is the firewall config on the LAN interface?
Click to expand...

Yes, SVIs are pingable from PFSense. VMs on that vlan are also pingable.

Firewall config on LAN is default, so it's allow any/any.
 
Adding a bit more info. Did a packet capture of my ping attempts, and it shows that source of ping is 192.168.1.236 (SVI for vlan 1), not the 10.0.5.1.
 
Hate to do this, but.. bump.

Also, if anyone can suggest a way to route between 3 port groups maybe with a pfsense appliance, I would gladly give that a try.
 
Can you ping from VM (VLAN2) to IP Address of VLAN3?
Can you ping between VMs in different VLAN?

You need to find out that VLAN routing is working on Cisco 3550 switch. If this works then you can add Pfsense.
 
Sorry used different VLANs.
Again try to ping from VM in VLAN2005 to ip address of VLAN2010?

Also give output of command "sh ip route" on Cisco 3550.
 
Ummm what IS 192.168.1.1? I don't see you mention that anywhere...if the 192.168.1.1 device doesn't know how to get to the 10. networks then it's not going to reply...
 
You must log in or register to reply here.
Back
Top