Cisco Switch – Troubleshooting Ping Issues with Attached Device

ciscopingswitchswitchingvlan

PC1-VLAN1======Switch : Successful pings from the switch
PC1-VLAN2======Switch : *Unsuccessful* pings from the switch

I've got a single switch with a static IP directly connected to PC1 with a static IP, both on the same 192.168.1.0/24 network. The switch has no VLAN's on it except the default VLAN1.

With this setup, the switch can successfully ping PC1.

If I Create a VLAN2 and assign PC1's port to VLAN2, the switch can no longer ping PC1. I would understand if another PC on a different VLAN couldn't ping PC1, but I would think that the switch could ping either.

What am I missing?

Thanks!

Best Answer

That's the whole point of VLANs. VLANs create a layer-2 separation. You can't get from one layer-2 domain to another without a layer-3 device (router) connecting them. The switch is just another host on a different VLAN.

The VLANs are like yards separated by fences. You need a gate (router) to get from one to the other.

If you add a VLAN 2 SVI on the switch with an address in the same subnet as the PC, you could ping the PC.

Related Solutions

Ping Issues – Why Can’t Ping Address Across Routed Link

A router (layer-3 switch, included) doesn't route from one network to the same network. If you had two different networks, one on each side, of the first switch, the layer-3 switch could route from one network to the other, and the ping should succeed.

Cisco SG-300 – Help with VLANs, ACLs, DHCP on Layer 3 Switch

You do not need the ip helper-address statement.

As I understand your requirement, you only want to allow printers on vl 2 to be accessed from vl 3. Nothing else on vl 2 can be accessed from vl 3.

ip access-list extended vlan3-in
 remark allow printers.  Repeat this line for each printer
 permit ip any host <printer address>
 remark alternatively, you can only allow the printer port on the VLAN, for ex.
 permit tcp any 192.168.2.0 0.0.0.255 eq 9100
 remark block the rest of vlan 2
 deny ip any 192.168.2.0 0.0.0.255
 remark permit Internet
 permit ip any any

interface vlan 3
service-acl input vlan3-in

If your AP can offer multiple SSIDs, then you can have one SSID for each VLAN. You tag the VLANs and set the switchport to trunk.

If your AP can't offer multiple SSIDs, then make the switch port an access port and don't tag the vlan.

Best Answer

Related Solutions

Ping Issues – Why Can’t Ping Address Across Routed Link

Cisco SG-300 – Help with VLANs, ACLs, DHCP on Layer 3 Switch

Related Topic