topic Re: VLAN Routing issues in ICX Switches

VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 08:18:44 GMT

Hello I am trying to setup an ICX 7150 to allow me to have multiple vlans share the same dhcp server on one vlan and the internet connection on the default vlan

However my very simple config seems unable to route from vlan 2 across to the default vlan

I have port 1/2/1 configured with ip address 192.168.50.15/24

My router is ip 192.168.50 254

I have the ip address range 10.172.2.1/24 attached to virtual interface VE 2

DCHP on 10.172.2.0 and that works if i connect to a untagged switchport

But I am unable to access the internet from any device with a 10.172.2.x address, default gateway is set to 10.172.2.1

Any advice greatly received and config shown below

ICX7150-C12 Router#sho run
Current configuration:
!
ver 08.0.95dT213
!
stack unit 1
module 1 icx7150-c12-poe-port-management-module
module 2 icx7150-2-copper-port-2g-module
module 3 icx7150-2-sfp-plus-port-20g-module
stack-port 1/3/1
stack-port 1/3/2
!
!
global-stp
!
!
!
vlan 1 name DEFAULT-VLAN by port
spanning-tree
!
vlan 2 name server by port
untagged ethe 1/1/1 to 1/1/4
router-interface ve 2
!

aaa authentication web-server default local
aaa authentication login default local
boot sys fl sec
console timeout 30
enable aaa console
ip dhcp-client disable
ip dhcp-server enable
!
ip dhcp-server pool server
lease 0 0 30
network 10.172.2.0 255.255.255.0
option 3 ip 10.172.2.1
option 5 ip 8.8.8.8
deploy
!
ip default-network 192.168.50.0/24
ip dns server-address 192.168.50.254
ip route 0.0.0.0/0 192.168.50.254
ip route 10.172.2.0/24 192.168.50.254
ip router-id 192.168.50.15
!
telnet timeout 10
no telnet server
username super password .....
username mgladmin password .....
!
!
password-change any
!
!
!
!
manager registrar
34.89.230.72 34.89.230.73
manager active-list 34.89.230.73 34.89.230.72
!
manager port-list 987
!
!
router ospf
area 0.0.0.0
!
!
!
!
!
!
!
!
interface ethernet 1/2/1
ip address 192.168.50.15 255.255.255.0
no ip dhcp-client enable
!
interface ve 2
port-name Server
ip address 10.172.2.1 255.255.255.0
!
!
ip ssh timeout 30
ip ssh idle-time 10
!
end

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 08:29:46 GMT

hello David,

quick hint, not sure about it, but can you remove

"ip route 10.172.2.0/24 192.168.50.254"

and give a "show ip route" please

Re: VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 08:37:53 GMT

@vincent_felisaz

Hi Vincent thanks for the fast response, I have removed the ip route and this is the result of the Sho Ip route

ICX7150-C12 Router(config)#sho ip route
Total number of IP routes: 3
Type Codes - B:BGP D:Connected O:OSPF R:RIP S:Static; Cost - Dist/Metric
BGP Codes - i:iBGP e:eBGP
OSPF Codes - i:Inter Area 1:External Type 1 2:External Type 2
STATIC Codes - v:Inter-VRF
Destination Gateway Port Cost Type Uptime
1 0.0.0.0/0 192.168.50.254 e 1/2/1 1/1 S 1h2m
2 10.172.2.0/24 DIRECT ve 2 0/0 D 2m25s
3 192.168.50.0/24 DIRECT e 1/2/1 0/0 D 1h2m

Thank You

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 08:47:22 GMT

Is your 10.172.2.0 network is known by the 192.168.50.254 router ?

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 08:51:09 GMT

and also try from the ICX these 2 commands:

"ping 8.8.8.8 source 192.168.50.15"

"ping 8.8.8.8 source 10.172.2.1"

Re: VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 09:43:11 GMT

@vincent_felisaz Hi, no the router is a basic unit with a single ip address 192.168.50.254 that NATs out to the internet, I have the ICX switch in router mode and assumed that it would route traffic from multiple VLAN's with various subnets to the internet via the default LAN on 192.168.50.0/24. This is a trail setup for a much bigger network I am installing.

below are the results from the ping test

ICX7150-C12 Router>ping 8.8.8.8 source 192.168.50.15
Sending 1, 16-byte ICMP Echo to 8.8.8.8, timeout 5000 msec, TTL 64
Type Control-c to abort
Reply from 8.8.8.8 : bytes=16 time=15ms TTL=116
Success rate is 100 percent (1/1), round-trip min/avg/max=15/15/15 ms.
ICX7150-C12 Router>ping 8.8.8.8 source 10.172.2.1
Sending 1, 16-byte ICMP Echo to 8.8.8.8, timeout 5000 msec, TTL 64
Type Control-c to abort
Request timed out.
No reply from remote host.
ICX7150-C12 Router>

Thank you

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 10:23:17 GMT

Ok thanks for the provided information.

So here is the issue, your NAT router must be aware of the 10.172.2.0 network. Otherwise it will not be able to route the traffic back to the end-device. There is no NAT on the ICX itself to mask the different subnets in its VLAN.

One way to do it is to configure the NAT/Internet Access router with all the local subnets.
The second way is to use dynamic routing like OSPF to have exchanges between the 2 routers about their local subnets. In this way the ICX will announce to the NAT router the subnet 10.172.2.0 and others if there are.

Re: VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 10:38:23 GMT

Hi Vincent

Ok I kind of understand, but my router will only take 1 ip address, the Cisco system we have in place currently the router only has a single gateway ip address, i thought the the 10.172.2.0/24 would route to 192.168.50.254 via the ruckus unit, the switch is in router mode and all the examples I have seen show that to be the case. I have OSPF already switched on already. Also is it not routing the packets from 10.172.2.x across to 192.168.50.254.?

I very much appreciate you help with this thank you

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 11:58:10 GMT

For OSPF to work, you have to enable it globally, and assign interface(s) in the area (the right one if you have several). You have enable it already but you have to go on interface to assign it. So for your setup :

"interface ethernet 1/2/1"

"ip ospf area 0.0.0.0"

and then to check of this is working :

"show ip ospf neighbor"

Re: VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 13:45:01 GMT

No Joy on this i'm afraid. Does this product not route packets from one VLAN to another?

Thanks for the help so far, I don't want to appear ungrateful for all your help.

David

Re: VLAN Routing issues

vincent_felisaz — Thu, 28 Oct 2021 14:25:02 GMT

Surely it does ! This is a router and does inter-VLAN routing, static and dynamic (with license).

Re: VLAN Routing issues

david_cummins — Thu, 28 Oct 2021 15:29:58 GMT

Hi Vincent

Of course it does its just my frustration I apologise, I'm going to swap to a better router firewall with vlan tagging and routing capabilities and see if that helps me get it sorted. I'll be back when I'm ready.