Cisco – VLAN not working in trunk between SonicWALL and Cisco

ciscosonicwallvlan

This was caused by me forgetting about a switch. Continue reading only if you're very bored

SonicWALL NSA 3500 connected to Cisco Catalyst 3850. The SonicWALL has "sub-interfaces" (VLANs) V2, V800, and V802. The 2 and 802 have worked fine for forever, and I am now trying to add 800, but no traffic is working through the trunk. See the image for my configs. I can't get a downstream "switchport access vlan 800" port with a device to connect, and on the switch I can't ping 172.16.16.7, which is the SonicWALL sub-interface IP, whereas I can ping the IP for VLAN 802.

EDIT – Since configuring the Cisco with "ip classless" I was able to get Spanning-Tree to get out of "BKN" status and VLAN 800 now shows up as a non-pruned VLAN in "sh int gi1/0/2 trunk" but my main issue of not being able to pass traffic or connect an access device on that VLAN still persists.

Here's the link to the image in case it's too small to see here: http://oi60.tinypic.com/15cllp1.jpg

EDIT

Switch#sh span summ

Switch is in pvst mode
Root bridge for: VLAN0800
Extended system ID           is enabled
Portfast Default             is disabled
PortFast BPDU Guard Default  is disabled
Portfast BPDU Filter Default is disabled
Loopguard Default            is disabled
EtherChannel misconfig guard is enabled
UplinkFast                   is disabled
BackboneFast                 is disabled
Configured Pathcost method used is short

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0001                     0         0        0          9          9
VLAN0002                     0         0        0         14         14
VLAN0003                     0         0        0          9          9
VLAN0004                     0         0        0         10         10
VLAN0005                     0         0        0         10         10
VLAN0006                     0         0        0          9          9
VLAN0007                     0         0        0          9          9
VLAN0008                     0         0        0          9          9
VLAN0009                     0         0        0          9          9

Name                   Blocking Listening Learning Forwarding STP Active
---------------------- -------- --------- -------- ---------- ----------
VLAN0010                     0         0        0          9          9
VLAN0011                     0         0        0          9          9
VLAN0012                     0         0        0         10         10
VLAN0013                     0         0        0          9          9
VLAN0014                     0         0        0          9          9
VLAN0015                     0         0        0         11         11
VLAN0016                     0         0        0          9          9
VLAN0017                     0         0        0          9          9
VLAN0018                     0         0        0         11         11
VLAN0103                     0         0        0          9          9
VLAN0104                     0         0        0         10         10
VLAN0105                     0         0        0         10         10
VLAN0106                     0         0        0          9          9
VLAN0107                     0         0        0          9          9
VLAN0111                     0         0        0          9          9
VLAN0800                     0         0        0          9          9
VLAN0802                     0         0        0         10         10
VLAN0803                     0         0        0          9          9
---------------------- -------- --------- -------- ---------- ----------
27 vlans                     0         0        0        258        258

Switch#sh span vlan 800

VLAN0800
    Spanning tree enabled protocol ieee
    Root ID    Priority    4896
        Address     dca5.f433.4980
        This bridge is the root
        Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec

    Bridge ID  Priority    4896   (priority 4096 sys-id-ext 800)
        Address     dca5.f433.4980
        Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec
        Aging Time  300 sec

Interface           Role Sts Cost      Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/2             Desg FWD 19        128.2    P2p
Gi1/0/14            Desg FWD 4         128.14   P2p
Gi1/0/15            Desg FWD 4         128.15   P2p
Gi1/0/16            Desg FWD 4         128.16   P2p
Gi1/0/17            Desg FWD 4         128.17   P2p
Te1/1/3             Desg FWD 4         128.55   P2p
Te1/1/4             Desg FWD 4         128.56   P2p
Po1                 Desg FWD 3         128.2027 P2p
Po2                 Desg FWD 3         128.2028 P2p

Switch#sh int gi1/0/2 switchport

Name: Gi1/0/2
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk Native VLAN tagging: enabled
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk associations: none
Administrative private-vlan trunk mappings: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled
Appliance trust: none

*See my top edit – VLAN 800 now shows up in "sh int gi1/0/2 trunk" as a non-pruned VLAN but that didn't change my issue of not being able to connect anything on that VLAN and I still cannot ping 172.16.16.7

Best Answer

It sounds like a routing issue. Make sure the Cisco Catalyst 3850 has a default route to the SonicWALL NSA 3500 or a route directly to the 172.16.16.0/24 destination via the SonicWALL. Not having the proper routes would prevent the switch from being able to PING an IP address not on the same subnet.

I would be curious to know whether the device on vlan 800 could PING 172.16.16.7.

Providing some TRACEROUTE results would also be helpful from the switch to 172.16.16.7 and also to the device on vlan 800 and from the device on vlan 800 to 172.16.16.7 and also to the switch.

Related Solutions

Cisco – Vlans and subinterfaces

Pardon, in your cut and pasted configs, you appear to be describing Gi0/48 - your uplink to your router, but in your question refer specifically to hosts connected to Gi0/18. I'm going to assume you're describing two different ports here. Further, I'm assuming from details in your config statements and question, that vlan 3 is being used for the 192.168.0.80/28 traffic. I'm going to assume that the vlan has already been declared on your 3560. (Check sh vlan)

First of all, your port Gi0/18 should be configured for access mode on vlan 3. Likely, something like this:

interface GigabitEthernet 0/18
switchport access vlan 3
switchport mode access

As far as for other recommendations. Will all/most of your traffic from your IP subnets be to and from the internet. Basically, If you have enough traffic between subnets, it may suit you to have the 3560 act as your internal router and then dedicate your 3825 to be your border router. The problem is that if your router is baring the entire load for all routing, then a packet from one subnet will arrive at your switch, then be forwarded via the dot1q to your trunk on some vlan X, the router then makes a routing decision and sends the same packet back along the dot1q trunk on some new vlan Y now destined for the destination machine. Btw, I'm simply describing the situation of internal traffic to your customers/organization that crosses your different subnets.

Instead, you can configure the 3560 at the, assuming normal conventions, first address of each vlan/subnet. E.g. 192.168.0.81 and enable ip routing. The next step is you create a new subnet specifically for between the router and switch. For convenience, i'd use something completely different, for example, 192.0.2.0/24 is reserved for documentation examples. Configure the router at 192.0.2.1 and the switch at 192.0.2.2. Have the switch use 192.0.2.1 as the default route. Configure the router to reach 192.168.0.0/16 via the switch at 192.0.2.2. If your network is small enough, static routes should be sufficient. No need for OSPF or anything.

Of course, this would be a rather dramatic change; but it has potential for being a large improvement. It all depends on the nature of your traffic.

For reference, cisco lists the Cisco Catalyst 3560G-48TS and Catalyst 3560G-48PS having a 38.7 Mpps forwarding rate and the Cisco 3825 as having 0.35Mpps forwarding rate. Mpps, just in case you don't know, is millions of packets per second.

It's not bandwidth, but it's how many 64 byte packet routing decisions the device can make a second. The length of the packet doesn't affect how long it takes to making a routing decision. So the peak performance in bits/bytes will be somewhere in a range. In terms of bandwidth, it means that 350kpps is 180Mbps w/ 64byte packets and 4.2Gbps w/ 1500 byte packets. Mind you, that's in bits per second, so think of it as 18 Megabytes or 420 Megabytes per second in regular file-size terms.

In theory, this means that your 3560G can route somewhere between 19.8Gbps and 464Gbps or rougly 2GBps and 45GBps.

Actually, looking at those numbers, you most definitely should consider the plan I described above. Dedicate your 3825 to handling, presumably, NAT'd external traffic and let your 3560 handle the rest.

I'm sorry this is so long; I'm bored at work waiting for tapes to finish. Cheers.

Switch – Configure LAG group for specific ports on Dell PowerConnect 5424 switches

You certainly don't show any mac-learning across either side of the LAG, which indicates to me that there is something more basic wrong.

Start by ensuring that your ethernet interfaces participating in the LAG are up on both sides
Ensure that you have the same LAG configuration on both sides (easiest is usually auto). Then ensure that LACP has brought the LAG virtual interface up
Ensure your vlan trunking parameters are the same on both sides
Ensure that spanning-tree is not blocking the LAG due to another redundant link between the switches. If there is a redundant link, shut that down too.

Failing that, remove the LAG configuration from both sides and shutdown all but one ethernet link between the switches. Try to get connectivity working like that. Once you have this working, add the LAG configuration and duplicate the config that worked on the single ethernet link into the LAG ports.

Best Answer

Related Solutions

Cisco – Vlans and subinterfaces

Switch – Configure LAG group for specific ports on Dell PowerConnect 5424 switches

Related Topic