Unable to ping Default Gateway

busines4u

So i feel like a complete noob not being able to figure this one out. Here is the scenario.

I am testing out a Layer 3 switch, Cisco 3550. I have two of the interfaces configured as routed ports and traffic is able to get where it needs to but there is a strange issue that I cannot figure out and was wondering if any of you Cisco gurus out there have seen such a thing.

I have a layer 2 switch connected to fa0/2 of the Cisco 3550. Fa0/1 connects to our main router that has connections to the rest of the network. The IP on the 3550 fa0/2 is 192.168.251.1 and the vlan 1 on the layer 2 switch is 192.168.251.2. If i power on the 3550 I can ping the Default Gateway for that interface (192.168.251.1) but after some amount of time elapses I can no longer ping this IP from behind that routed port (a machine connected to the layer 2 switch). I am able to get responses via other subnets but it is something from behind this Layer 3 switch that does not allow the ping responses to be sent back. I do not have any access-lists created to block any traffic.

The real kicker is that the machine connected to the Layer 3 switch is able to get to the internet and ping other gateways in the network so its not like the default gateway is down but it won't ping, and if i ever needed to troubleshoot this device I would definately get hung up on this because I simply can't ping the gateway telling me that i only have Layer 2 network connectivity.

Here is a basic topology to get an idea

InternetRouter<

---

FA0/1>Cisco3550<Fa0/2

---

>Cisco2900<---->laptop

Any ideas on this? If any one needs more info let me know.

Thanks in advance.

dead_p00l

Just a quess after a quick glance but I would say add a default route on the 2900.

darkerz

3550 L3?

As a started lab??

I am jealous.

After work, if there's no resolution I'll take a look as well.

busines4u

dead_p00l wrote: »

Just a quess after a quick glance but I would say add a default route on the 2900.

The Cisco 2900XL is a Layer 2 device. I cannot assign a static route on this type of device. However i do have the default gateway set with the following command.

"ip default-gateway 192.168.251.1" which is the fa0/2 interface of the L3 3550

okplaya

Not sure if I fully understand the issue. So you're saying you hook a PC up to the 2900XL and give it an IP address in the 192.168.251.0/24 network and gateway as .1? After doing that, the PC cannot ping its gateway?

Ryuksapple84

Tell me this, fa0/2 on the 3550, is that trunked to the internet router? I looked at the config and saw that you don't have it as an access port so it makes sense that you don't have router on a stick configured. But you may have to trunk that port on the MLS to the the connecting port on the interent router. That way when you have the 2900 use the MLS as the default gateway, you will nto lose connectivity.

I really hope I am looking at this right. At work right now, lol.

busines4u

busines4u wrote: »

The Cisco 2900XL is a Layer 2 device. I cannot assign a static route on this type of device. However i do have the default gateway set with the following command.

"ip default-gateway 192.168.251.1" which is the fa0/2 interface of the L3 3550

You are correct. I hooked up a laptop to the 2900XL and I have received an IP via DHCP from the 3550. I also assigned an IP statically thinking that perhaps DHCP was causing the issue. But anyways. The IP i gave it was in the 192.168.251.x network (.5 statically and .101 via DHCP.). I put the Default Gateway as 192.168.251.1 and the laptop can ping the gateway for some time after the 3550 is first turned on. Then after some times goes by i never get a response from the Default Gateway. But i can ping anything on the other side of the 3550.

I know how weird this sounds and it makes absolutely no sense to me.

busines4u

Ryuksapple84 wrote: »

Tell me this, fa0/2 on the 3550, is that trunked to the internet router? I looked at the config and saw that you don't have it as an access port so it makes sense that you don't have router on a stick configured. But you may have to trunk that port on the MLS to the the connecting port on the interent router. That way when you have the 2900 use the MLS as the default gateway, you will nto lose connectivity.

I really hope I am looking at this right. At work right now, lol.

Fa0/2 is not trunked because i have not setup any vlans. Everything is in the default VLAN1. As a matter of fact VLAN's are not utilized anywhere throughout the company.

I am using the internet router and the MLS connection as a point to point link.

I do not really lose connectivity because i am still able to ping from the laptop to the internet router and even to things that are connected on the other side of the internet router. It is just the simple fact that the default gateway for the laptop (192.168.251.1 which is fa0/2 of the L3 switch) will still pass traffic but it will stop responding to icmp's. Which in return causes me to think that I have no network connectivity to the rest of the network but in reality i do have network connectivity because i can access shares and ping things that are on the other side of the internet router. And when i say on the other side of the internet router i do mean internet access as well as other LAN's connected to this internet router.

Ryuksapple84

"Fa0/2 is not trunked because i have not setup any vlans. Everything is in the default VLAN1. As a matter of fact VLAN's are not utilized anywhere throughout the company.

I am using the internet router and the MLS connection as a point to point link."

Not sure if I am understanding this. You have configured PPPoE? I suspect this is a VLAN issue and that is why you are not able to ping the internet router.

What is the config for the interface on the internet router connecting to the MLS?

busines4u

Ryuksapple84 wrote: »

"Fa0/2 is not trunked because i have not setup any vlans. Everything is in the default VLAN1. As a matter of fact VLAN's are not utilized anywhere throughout the company.

I am using the internet router and the MLS connection as a point to point link."

Not sure if I am understanding this. You have configured PPPoE? I suspect this is a VLAN issue and that is why you are not able to ping the internet router.

What is the config for the interface on the internet router connecting to the MLS?

I do not have PPPoE configured. When i say that it is a point to point link i mean that there is an IP on each interface FA0/1 of the L3 switch and an IP on the internet router. The internet router is a SonicWALL NSA 3500. The interface has the IP of 192.168.250.1/24. Port fa0/1 on the MLS is configured for the IP of 192.168.250.2/24 and is able to ping this interface.

I know that this is hard to understand because it simply does not make sense (at least in my mind).

To make even less sense out of all of this is that i am connected to the network on the X0 (LAN) interface of the internet router and I can ping and get replies of FA0/2 on the MLS. But if i go to the laptop and try to ping this interface i get nothing. If i try to telnet to the MLS from the laptop connected to it i am unable to. But i am able to telnet to this MLS by using my machine that is located on the X0 LAN interface.

Let me know if you need any more info. I really appreciate your feedback.

Ryuksapple84

The port on the MLS connecting to the Switch... try this:

configure router on a stick so that MLS may act as the default gateway for the switch and any device behind it.

If I understand you correctly, you have a port on the MLS connected to the Firewall with only IP configured? You are going to need to point that MLS to the firewall either through an IGP or static route.

busines4u

Ryuksapple84 wrote: »

The port on the MLS connecting to the Switch... try this:

configure router on a stick so that MLS may act as the default gateway for the switch and any device behind it.

If I understand you correctly, you have a port on the MLS connected to the Firewall with only IP configured? You are going to need to point that MLS to the firewall either through an IGP or static route.

The MLS is the default gateway for the switch and any device that is behind it. I never configured RoaS before with only utilizing VLAN1. Which is why i turned fa0/2 into a routed port so that it would be just that a port that would route traffic.

The MLS does have a static route to the firewall and is able to communicate. Even when FA0/2 does not reply with pings the laptop connected to the L2 switch which connects to the L3 switch can still access the internet and other network resources.

I have to be careful with what VLANs i configure because our ISP strips off VLANs. The whole objective for setting up this lab is to ensure that i will be able to implement a L3 switch into the network so that it does all of our routing and terminates our incoming fiber connections.

Ryuksapple84

Why are you concerned with the ISP stripping off VLANS? If you connect a switch to a router and want them to communicate, I am pretty sure you will have to trunk them.

I think you need to include a lot more details and include a bigger picture... maybe a topology map. Is this your lab or for work?

busines4u

I am concerned about the ISP stripping off VLANS because if traffic tries to traverse that link when there is a VLAN in the packet then it is dropped or incorrectly routed through our ISP's network because they use VLANs on their network resulting in access to our branch sites being lost. This is what i was told when i first started at least. Just so you know our branch sites are all connected to our HQ via 5mb fiber connections from TWC.

I thought that a trunk would only needed to be created when multiple VLANS need to traverse the link. But since in this situation everything is at the default then everything is in VLAN1. There are no other VLANS configured on the L2 or the L3 switch.

I will definitely work on getting a topology thrown together along with some details.

This is currently in a lab environment and if i can get things to work properly I will implement it at work to stabilize our network.

mella060

The thing i am not sure about here is that you have the routed port (fa0/2) on the 3550 L3 switch connected to what ? Just a normal layer 2 port on the 2900XL ? Not sure how that really works. Is that how it is setup, a layer 3 port connected to a layer 2 port ?

It would most likely work fine if you had the routed port (fa0/2) connected to a layer 3 routed port on the 2900XL, but that is obviously not possible.

I'm not 100% sure but i am thinking that the link between the switches needs to be layer 2. Maybe set up a trunk but only allow the vlans you want to traverse the trunk.

Another thing that just came to mind. Do you have an SVI set up on the 3550 ? If not, then might be well worth looking into. An SVI (Switch vlan interface), acts as a virtual layer 3 interface on the Layer3 switch. This can act as your default gateway for vlan 1. On the 3550, you can create the SVI interface for vlan 1 and give it the IP 192.168.251.1

Layer3-Switch(config)# interface vlan1
Layer3-Switch(config-if)# ip address 192.168.251.1 255.255.255.0
Layer3-Switch(config-if)# no shut

Here is a link with a scenario a bit like yours...

http://www.networkstraining.com/how-to-configure-a-cisco-layer-3-switch-intervlan-routing/

Ryuksapple84

mella060 wrote: »

The thing i am not sure about here is that you have the routed port (fa0/2) on the 3550 L3 switch connected to what ? Just a normal layer 2 port on the 2900XL ? Not sure how that really works. Is that how it is setup, a layer 3 port connected to a layer 2 port ?

It would most likely work fine if you had the routed port (fa0/2) connected to a layer 3 routed port on the 2900XL, but that is obviously not possible.

I'm not 100% sure but i am thinking that the link between the switches needs to be layer 2. Maybe set up a trunk but only allow the vlans you want to traverse the trunk.

Another thing that just came to mind. Do you have an SVI set up on the 3550 ? If not, then might be well worth looking into. An SVI (Switch vlan interface), acts as a virtual layer 3 interface on the Layer3 switch. This can act as your default gateway for vlan 1. On the 3550, you can create the SVI interface for vlan 1 and give it the IP 192.168.251.1

Layer3-Switch(config)# interface vlan1
Layer3-Switch(config-if)# ip address 192.168.251.1 255.255.255.0
Layer3-Switch(config-if)# no shut

Here is a link with a scenario a bit like yours...

How to configure a Cisco Layer 3 switch-InterVLAN Routing | Networks Training

Yes, SVI would help. Your last explanation really helped me to gain an understanding about the situation. Try the SVI and let us know what happened. Either way, you will need to trunk. Just use the default vlan.

busines4u

You are correct. I have a L3 port (fa0/2) connected to a layer 2 port on the 2900XL (fa0/1).

I have created an SVI previously for vlan 1 since everything is in VLAN1 and i receive the same results. I can ping the SVI once the L3 switch is booted and then after it has been online for a little while it stops replying.

I will scrap the L3 port and go back to the SVI and will hard code a trunk between these two devices. I never though i would need to create a trunk between the two since only VLAN1 is present on both switches. But I am willing to try anything to get this issue resolved.

Thank you both. I will set this up and post back the results. In the mean time if you think of anything else to try feel free to let me know.

busines4u

Well i created the trunk and the Default gateway is still replying to the pings so it seems like that worked. I will need to check this laptop tomorrow to make sure that the gateway is still replying but i have a good feeling that it will.

I still cannot wrap my head around why i needed to create a trunk whenever there is only one VLAN and one subnet behind this port?

Thanks for your help guys I greatly appreciate it.

dead_p00l

busines4u wrote: »

I am concerned about the ISP stripping off VLANS because if traffic tries to traverse that link when there is a VLAN in the packet then it is dropped or incorrectly routed through our ISP's network because they use VLANs on their network resulting in access to our branch sites being lost. This is what i was told when i first started at least. Just so you know our branch sites are all connected to our HQ via 5mb fiber connections from TWC.

I thought that a trunk would only needed to be created when multiple VLANS need to traverse the link. But since in this situation everything is at the default then everything is in VLAN1. There are no other VLANS configured on the L2 or the L3 switch.

I will definitely work on getting a topology thrown together along with some details.

This is currently in a lab environment and if i can get things to work properly I will implement it at work to stabilize our network.

Not directly related to your issue but I noticed that you're using TWC fiber connections. The company I work for passes fiber connections across TWC on a regular basis and have no toruble using vlans. You need to make sure that TWC is either transporting your traffic via MPLS tunnel encapsulating your internal VLANS or that they're using dot1q tunneling. In my situation we hand off a dot1q tunnel from our A to TWC who then carries it viam MPLS to the Z site.

mella060

Maybe try using another vlan, say vlan 10. Create the SVI for vlan 10 such as 192.168.10.1 and set it up. Change the ip of the switch to say 192.168.10.2

Ryuksapple84

I hope you will now be able to ping form your laptop.
Just because you are using Vlan 1 on both switches does not mean it is the same vlan. Vlan 1 on the MLS and Vlan 1 on the 2900 are actually 2 different vlans. That is why you need to trunk the switches

busines4u

Ryuksapple84 wrote: »

I hope you will now be able to ping form your laptop.
Just because you are using Vlan 1 on both switches does not mean it is the same vlan. Vlan 1 on the MLS and Vlan 1 on the 2900 are actually 2 different vlans. That is why you need to trunk the switches

This makes sense. It seems to be working much better now. However I was out of the office last Thurs/Fri and did not have a chance to check on it. I will see if it remains responsive for the rest of the day. Thanks again guys.

Heero

I just read throught this thread and here is my thought.

1. There is no reason I can see why it would not work the way it was originally configured. The fact that you can ping it when it first boots up, and that the switch forwards traffic even if you cannot ping the default gateway, seems to indicate that there is no configuration error.

2. There don't need a trunk link in this scenario. If you do not need multiple vlans, you do not need a trunk link.

3. Check firewalls maybe. When you fail to ping the 3550 from the laptop, can you ping it from the 2960?

networker050184

Heero wrote: »

I just read throught this thread and here is my thought.

1. There is no reason I can see why it would not work the way it was originally configured. The fact that you can ping it when it first boots up, and that the switch forwards traffic even if you cannot ping the default gateway, seems to indicate that there is no configuration error.

2. There don't need a trunk link in this scenario. If you do not need multiple vlans, you do not need a trunk link.

3. Check firewalls maybe. When you fail to ping the 3550 from the laptop, can you ping it from the 2960?

Those were my thoughts also.

Forsaken_GA

Firewall, or losing a return route would be my guesses. Gotta remember ping is 2 way communication, and you need to verify that it works in both directions. If something loses ping, it may not be that the originating device can't talk to it's destination, it may be that the destination can't replh to the originating device.

Forsaken_GA

Ryuksapple84 wrote: »

I hope you will now be able to ping form your laptop.
Just because you are using Vlan 1 on both switches does not mean it is the same vlan. Vlan 1 on the MLS and Vlan 1 on the 2900 are actually 2 different vlans. That is why you need to trunk the switches

Not entirely.

When he issues no switchport on the 3550, it stopped being in a vlan.

Let me demonstrate -


stark(config)#do sh vlan

VLAN Name Status Ports
----

---

---

---

1 default active Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Fa0/25, Fa0/26, Fa0/27, Fa0/28, Fa0/29, Fa0/30, Fa0/31, Fa0/32, Gi0/1, Gi0/2

Ok, so this on a 3550. Fa0/3 is in vlan1, so let's see what happens when I go turn it into a layer 3 port.

stark(config)#int fa0/3
stark(config-if)#no switchport
stark(config-if)#do sh vlan

VLAN Name Status Ports
----

---

---

---

1 default active Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Fa0/25, Fa0/26, Fa0/27, Fa0/28, Fa0/29, Fa0/30, Fa0/31, Fa0/32, Gi0/1, Gi0/2

It's now gone.

Since there's no trunk link, there's no vlan tag. What should be coming from his host is a pure ethernet packet, going from the host, hitting the switch on it's ingress port, and the going out the uplink to the layer3 switch. That frame should not be changing at all until it hits the layer3 switch and then it needs to decide where to route it appropriately.

What he's trying to do should have worked. Connecting a layer 2 switch to a routed port on a layer 3 switch is exactly the same as if you were connecting it up to a router interface, say a fast ethernet port on a 2600 series router. You do not have to configure a trunk unless you want to do inter vlan routing, which he did not. In that case, every single thing connected to the layer 2 switch that's in the same vlan as the port connected to the routed port should be able to connect to that routed port. I'm not at home presently, so I can't move things around to mock up his situation and make it proof of concept, but I will later tonight, because I'm curious.

A few things I would try -

When the end host cannot ping the gateway, can the layer 2 switch? If you telnet into it and issue a ping to the routed port's IP, does it succeed?

If it does, then you can isolate the problem to the host. If it doesn't, you've got a routing problem.

Edit: And I see Heero already beat me to that conclusion

busines4u

Forsaken_GA wrote: »

Not entirely.

When he issues no switchport on the 3550, it stopped being in a vlan.

Let me demonstrate -


stark(config)#do sh vlan

VLAN Name Status Ports
----

---

---

---

1 default active Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Fa0/25, Fa0/26, Fa0/27, Fa0/28, Fa0/29, Fa0/30, Fa0/31, Fa0/32, Gi0/1, Gi0/2

Ok, so this on a 3550. Fa0/3 is in vlan1, so let's see what happens when I go turn it into a layer 3 port.

stark(config)#int fa0/3
stark(config-if)#no switchport
stark(config-if)#do sh vlan

VLAN Name Status Ports
----

---

---

---

1 default active Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/19
Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Fa0/25, Fa0/26, Fa0/27, Fa0/28, Fa0/29, Fa0/30, Fa0/31, Fa0/32, Gi0/1, Gi0/2

It's now gone.

Since there's no trunk link, there's no vlan tag. What should be coming from his host is a pure ethernet packet, going from the host, hitting the switch on it's ingress port, and the going out the uplink to the layer3 switch. That frame should not be changing at all until it hits the layer3 switch and then it needs to decide where to route it appropriately.

What he's trying to do should have worked. Connecting a layer 2 switch to a routed port on a layer 3 switch is exactly the same as if you were connecting it up to a router interface, say a fast ethernet port on a 2600 series router. You do not have to configure a trunk unless you want to do inter vlan routing, which he did not. In that case, every single thing connected to the layer 2 switch that's in the same vlan as the port connected to the routed port should be able to connect to that routed port. I'm not at home presently, so I can't move things around to mock up his situation and make it proof of concept, but I will later tonight, because I'm curious.

A few things I would try -

When the end host cannot ping the gateway, can the layer 2 switch? If you telnet into it and issue a ping to the routed port's IP, does it succeed?

If it does, then you can isolate the problem to the host. If it doesn't, you've got a routing problem.

Edit: And I see Heero already beat me to that conclusion

I really appreciate the input on all of this guys. I was able to verify this morning that the issue still persists. Yesterday from the laptop I was able to ping the default gateway of the Layer 3 switch. This morning I am unable to do so. So here are some of the things i tested for you.

I connected to the L2 switch and issued a ping to the Layer3 switch (default gateway of the laptop) and I did not see receive any replies.
From the L2 switch i also pinged the laptop and received a response.

From the laptop I pinged the L2 switch and received a reply.
From the laptop I pinged the L3 switch and did not receive a reply.

From my laptop which is located on the other side of the router I am able to still ping the default gateway of the laptop and receive replies.

I'm glad to hear that I do not need to form a trunk between these two devices as that would go against a lot of the things I learned from the Net Academy.

So from what has been discussed this looks like it is a routing issue. Everything is directly connected, I have a static route pointing to the upstream router. Below is the sh ip route on the L3 switch

L3Internal#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.250.1 to network 0.0.0.0

C 192.168.251.0/24 is directly connected, Vlan1
C 192.168.250.0/24 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 192.168.250.1

If anyone needs any more information or some additional show commands feel free to ask.

chopsticks

busines4u wrote: »

I connected to the L2 switch and issued a ping to the Layer3 switch (default gateway of the laptop) and I did not see receive any replies.
From the L2 switch i also pinged the laptop and received a response.

From the laptop I pinged the L2 switch and received a reply.
From the laptop I pinged the L3 switch and did not receive a reply.

From my laptop which is located on the other side of the router I am able to still ping the default gateway of the laptop and receive replies.

I'm still a noob but just wondering whether both devices are set to the same speed and negotiation mode (auto, full or half)?

busines4u

They are not hard coded to this. However they did auto-negotiate to 100mb Full-Duplex

chopsticks

My thought, why not and no harm trying to hard code them for a while for testing purpose?

Forsaken_GA

honestly, at this point, I'd need to put my hands on the gear to figure out what's going on. This is the point at which I'd start sniffing traffic to see what's going where.