5406 vlan routing issue

[Fezbro]

We have a 5406 switch with 3 vlans. Vlan 1 with gateway 194.1.1.133 (255.255.255.0), vlan 2 with 172.18.0.1(255.255.252.0) and vlan 9 with 172.18.9.1 (255.255.255.0). Ip routing is enabled, and there are no access lists.

Vlans 1 and 2 can ping anything. Vlan 9 however can ONLY ping vlan 2. There are no acls set. Anyone have any clues as to what I can check next?

Thanks

 

[unclerico]

can you post your config??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[VinceWhirlwind]

If VLANs 1 & 2 can ping anything, does that mean devices on VLANs 1 & 2 can ping devices on VLAN 9?

 

[Fezbro]

Hi

Yes VLANs 1 & 2 can both ping VLAN 9, VLAN 9 can ping VLAN 2, but not VLAN 1.

Config is:


module 1 type J8707A
module 2 type J8702A
module 3 type J8702A
module 5 type J8702A
module 6 type J8702A
module 9 type J8702A
module 10 type J8702A
interface E12
speed-duplex 100-full
exit
interface J8
speed-duplex auto-10-100
exit
ip routing
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged A3-A4,B1-B3,B5-B7,B9,B12,B14,B16,B18,B21,B23-B24,C1-C1,C5,C9-C10,E1-
E3,I1,I4-I6,J13-J14
ip address 194.1.1.133 255.255.255.0
tagged A1-A2,B4,C7,C13-C14,I2,J1,J7,J12
no untagged B8,B10-B11,B13,B15,B17,B19-B20,B22,C2-C4,C6,C8,C11-C12,C15-C24,E4
-E24,F1-F24,I3,I7-I24,J2-J6,J8-J11,J15-J24
exit
vlan 2
name "New subnet"
untagged B8,B10-B11,B13,B15,B17,B19-B20,B22,C4,C6,C8,C12,C15-C24,E4-E24,F1-F3
,F5,F7-F24,I3,I7-I16,I18-I24,J2-J6,J8-J11,J15-J20,J22-J24
ip address 172.20.0.1 255.255.0.0
ip address 172.18.0.1 255.255.252.0
tagged A1-A2,B1,B4,C1,C7,I2,J7,J14
exit
vlan 3
name "DMZ"
untagged C2-C3,C11,F4,F6,I17,J21
tagged A1-A2,B1,B4,C1,I2,J7,J14
no ip address
exit
vlan 4
name "vMotion"
tagged B1,C13-C14,J1,J12
no ip address
exit
vlan 9
name "VOIP"
untagged C7
qos priority 7
ip helper-address 172.18.0.21
ip address 172.18.9.1 255.255.255.0
tagged A1-A2,B1,B4,C5,E18,F17,I2
exit
ip route 0.0.0.0 0.0.0.0 194.1.1.254

I can ping the inside of our firewall, which is in the VLAN 1 range, but any other server fails. I did note however that when I try to ping, our firewall creates an outbound connection?

 

[Blackcode7475]

what is this for:

ip address 172.20.0.1 255.255.0.0

 

[Fezbro]

Hi

That is a legacy entry. The old network guy was planning to migrate us away from our 194 range, but we then got pushed into the 172.18 range by our parent company.

 

[VinceWhirlwind]

The successful ping VLAN1-->VLAN9 proves that ICMP reply packets are successfully travelling VLAN9-->VLAN1

That would indicate your device on VLAN1 has Windows firewall blocking ICMP.