Cant ping & access HP switch on network connected on trunking mode

Question

I have been facing this problem for a very long time. Here is a diagram of the switch situation:

The problem is that I have been trying to access the switch on the RIGHT(A3100) through the network but can't ping it(172.16.1.2) from anywhere. But the switch on the LEFT(A5500) can be accessed like normal through ping even HP web access.Right now, I can only access the RIGHT(A3100) switch through the console.

As we can see, both switches are connected through trunk port.

Here is some routing info from switch on the LEFT(A5500):

[Switch A5500]dis ip ro
Routing Tables: Public
        Destinations : 25       Routes : 25

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

0.0.0.0/0           Static 60   0            192.168.1.1     Vlan2
127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0
127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0
172.16.1.0/24       Direct 0    0            172.16.1.1      Vlan1
172.16.1.1/32       Direct 0    0            127.0.0.1       InLoop0
192.168.1.0/24      Direct 0    0            192.168.1.254   Vlan2
192.168.1.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.2.0/24      Direct 0    0            192.168.2.254   Vlan3
192.168.2.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.3.0/24      Direct 0    0            192.168.3.254   Vlan4
192.168.3.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.4.0/24      Direct 0    0            192.168.4.254   Vlan5
192.168.4.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.5.0/24      Direct 0    0            192.168.5.254   Vlan6
192.168.5.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.6.0/24      Direct 0    0            192.168.6.254   Vlan7
192.168.6.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.7.0/24      Direct 0    0            192.168.7.254   Vlan8
192.168.7.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.8.0/24      Direct 0    0            192.168.8.254   Vlan9
192.168.8.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.9.0/24      Direct 0    0            192.168.9.254   Vlan10
192.168.9.254/32    Direct 0    0            127.0.0.1       InLoop0
192.168.10.0/24     Direct 0    0            192.168.10.254  Vlan11
192.168.10.254/32   Direct 0    0            127.0.0.1       InLoop0

And here is the routing info for switch on the RIGHT(A3100):

[Switch A3100]dis ip r
Routing Tables: Public
        Destinations : 4        Routes : 4

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0
127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0
172.16.1.0/24       Direct 0    0            172.16.1.2      Vlan1
172.16.1.2/32       Direct 0    0            127.0.0.1       InLoop0

If you need more info just ask. I'm still new to this and not sure about the actual problem. Thanks in advance!

UPDATE : Both switch configuration

Switch A5500

[Switch A5500]dis cur
#
 version 5.20, Release 2208P01
#
 sysname Switch A5500
#
 undo password-control aging enable
 undo password-control length enable
 undo password-control history enable
 password-control login-attempt 3 exceed lock-time 120
#
 super password level 3 cipher IR(#N/:K>:Q'J\EJT`94,A!!
#
 irf mac-address persistent timer
 irf auto-update enable
 undo irf link-delay
#
 domain default enable system
#
#
local-user password-display-mode cipher-force
#
 ipv6
#
 telnet server enable
#
 management-vlan 9
#
 portal server 1 ip 192.168.8.223
 portal local-server http
#
ip vpn-instance 9
#
acl number 3997
 rule 0 permit ip dscp ef
 rule 1 permit tcp destination-port eq www
 rule 2 permit udp destination-port eq snmp
 rule 3 permit udp destination-port eq snmptrap
 rule 4 permit ip dscp cs6
 rule 5 permit ip dscp cs7
#
acl number 4999
 rule 0 permit type 8868 ffff
 rule 1 permit source-mac 00e0-bb00-0000 ffff-ff00-0000
 rule 2 permit source-mac 0003-6b00-0000 ffff-ff00-0000
 rule 3 permit source-mac 00e0-7500-0000 ffff-ff00-0000
 rule 4 permit source-mac 00d0-1e00-0000 ffff-ff00-0000
 rule 5 permit source-mac 0001-e300-0000 ffff-ff00-0000
 rule 6 permit source-mac 000f-e200-0000 ffff-ff00-0000
 rule 7 permit source-mac 0060-b900-0000 ffff-ff00-0000
 rule 8 deny dest-mac 0000-0000-0000 ffff-ffff-ffff
#
vlan 1
 description Vlan 1
#
vlan 2
 description Vlan 2
#
vlan 3
 description Vlan 3
#
vlan 4
 description Vlan 4
#
vlan 5
 description Vlan 5
#
vlan 6
 description Vlan 6
#
vlan 7
 description Vlan 7
#
vlan 8
 description Vlan 8
#
vlan 9
 description Vlan 9
#
vlan 10
 description Vlan 10
#
vlan 11
 description Vlan 11
#
vlan 12 to 4094
#
radius scheme system
 primary authentication 127.0.0.1 1645
 primary accounting 127.0.0.1 1646
 user-name-format without-domain
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
user-group system
#
local-user admin
 password cipher $2HRI'/MVL^,YWX*NZ55OA!!
 authorization-attribute level 3
 service-type telnet terminal
#
 stp enable
#
interface NULL0
#
interface Vlan-interface1
 ip address 172.16.1.1 255.255.255.0
 portal server 1 method layer3
#
interface Vlan-interface2
 ipv6 address 2400:7400:64:40::254/64
 ip address 192.168.1.254 255.255.255.0
#
interface Vlan-interface3
 ipv6 address 2400:7400:64:2::254/64
 ipv6 address auto link-local
 ip address 192.168.2.254 255.255.255.0
#
interface Vlan-interface4
 ipv6 address 2400:7400:64:3::254/64
 ipv6 address auto link-local
 ip address 192.168.3.254 255.255.255.0
#
interface Vlan-interface5
 ipv6 address 2400:7400:64:4::254/64
 ipv6 address auto link-local
 ip address 192.168.4.254 255.255.255.0
#
interface Vlan-interface6
 ipv6 address 2400:7400:64:5::254/64
 ipv6 address auto link-local
 ip address 192.168.5.254 255.255.255.0
#
interface Vlan-interface7
 ipv6 address 2400:7400:64:6::254/64
 ipv6 address auto link-local
 ip address 192.168.6.254 255.255.255.0
#
interface Vlan-interface8
 ipv6 address 2400:7400:64:7::254/64
 ipv6 address auto link-local
 ip address 192.168.7.254 255.255.255.0
#
interface Vlan-interface9
 ipv6 address 2400:7400:64:8::254/64
 ipv6 address auto link-local
 ip address 192.168.8.254 255.255.255.0
#
interface Vlan-interface10
 ipv6 address 2400:7400:64:9::254/64
 ipv6 address auto link-local
 ip address 192.168.9.254 255.255.255.0
#
interface Vlan-interface11
 ipv6 address 2400:7400:64:10::254/64
 ipv6 address auto link-local
 ip address 192.168.10.254 255.255.255.0
#
interface Vlan-interface12
#
interface GigabitEthernet1/0/1
 port link-mode bridge
 description Default(Firewall)
 port access vlan 2
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/2
 port link-mode bridge
 port access vlan 2
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/3
 port link-mode bridge
 port access vlan 11
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/4
 port link-mode bridge
 port access vlan 6
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/5
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/6
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/7
 port link-mode bridge
 port access vlan 3
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/8
 port link-mode bridge
 port access vlan 8
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/9
 port link-mode bridge
 port access vlan 10
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/10
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/11
 port link-mode bridge
 port access vlan 5
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/12
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/13
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/14
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/15
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/16
 port link-mode bridge
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/17
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/18
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/19
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/20
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/21
 port link-mode bridge
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/22
 port link-mode bridge
 shutdown
#
interface GigabitEthernet1/0/23
 port link-mode bridge
 shutdown
#
interface GigabitEthernet1/0/24
 port link-mode bridge
 shutdown
#
interface GigabitEthernet1/0/25
 port link-mode bridge
 port access vlan 5
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/26
 port link-mode bridge
 port access vlan 5
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/27
 port link-mode bridge
 port access vlan 6
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/28
 port link-mode bridge
 port access vlan 6
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#
interface GigabitEthernet1/0/29
 port link-mode bridge
 port access vlan 9
#
interface GigabitEthernet1/0/30
 port link-mode bridge
 port access vlan 9
#
interface GigabitEthernet1/0/31
 port link-mode bridge
 description To A3100 Switch
 port link-type trunk
 port trunk permit vlan all
 shutdown
 broadcast-suppression pps 3000
 undo jumboframe enable
#
interface GigabitEthernet1/0/32
 port link-mode bridge
 description To A3100 Switch
 port link-type trunk
 port trunk permit vlan all
 stp edged-port enable
#
 ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
#
 ipv6 route-static :: 0 2400:7400:64:40::1
#
 info-center synchronous
#
 snmp-agent
 snmp-agent local-engineid 8000002B001EC1800E806877
 snmp-agent community read public
 snmp-agent community write private
 snmp-agent sys-info version all
#
 load xml-configuration
#
user-interface aux 0
 authentication-mode scheme
user-interface vty 0 4
 authentication-mode scheme
user-interface vty 5 15
#
return
[Switch A5500]

Switch A3100

[Switch A3100]dis cur
#
 version 5.20, Release 5103P01
#
 sysname Switch A3100
#
 super password level 3 cipher IR(#N/:K>:Q'J\EJT`94,A!!
#
 domain default enable system
#
#
local-user password-display-mode cipher-force
#
 telnet server enable
#
 management-vlan 11
#
 portal local-server http
#
acl number 3997
 rule 0 permit ip dscp ef
 rule 1 permit tcp destination-port eq www
 rule 2 permit udp destination-port eq snmp
 rule 3 permit udp destination-port eq snmptrap
 rule 4 permit ip dscp cs6
 rule 5 permit ip dscp cs7
#
acl number 4999
 rule 0 permit type 8868 ffff
#
vlan 1
 description Vlan 1
#
vlan 2
 description Vlan 2
#
vlan 3
 description Vlan 3
#
vlan 4
 description Vlan 4
#
vlan 5
 description Vlan 5
#
vlan 6
 description Vlan 6
#
vlan 7
 description Vlan 7
#
vlan 8
 description Vlan 8
#
vlan 9
 description Vlan 9
#
vlan 10
 description Vlan 10
#
vlan 11 to 4094
#
radius scheme system
 primary authentication 127.0.0.1 1645
 primary accounting 127.0.0.1 1646
 user-name-format without-domain
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
user-group system
#
local-user admin
 password cipher $2HRI'/MVL^,YWX*NZ55OA!!
 authorization-attribute level 3
 service-type telnet terminal
#
 stp enable
 undo stp port-log all
#
interface NULL0
#
interface Vlan-interface1
 ip address 172.16.1.2 255.255.255.0
#
interface Ethernet1/0/1
 port access vlan 11
#
interface Ethernet1/0/2
 port access vlan 6
#
interface Ethernet1/0/3
 port access vlan 6
#
interface Ethernet1/0/4
 port access vlan 6
#
interface Ethernet1/0/5
 port access vlan 6
#
interface Ethernet1/0/6
 port access vlan 6
#
interface Ethernet1/0/7
 port access vlan 6
#
interface Ethernet1/0/8
 port access vlan 6
#
interface Ethernet1/0/9
 port access vlan 6
 stp edged-port enable
#
interface Ethernet1/0/10
 port access vlan 6
 stp edged-port enable
#
interface Ethernet1/0/11
 port access vlan 9
 stp edged-port enable
#
interface Ethernet1/0/12
 port access vlan 10
#
interface Ethernet1/0/13
 port access vlan 6
#
interface Ethernet1/0/14
 port access vlan 8
#
interface Ethernet1/0/15
 port access vlan 8
#
interface Ethernet1/0/16
 port access vlan 7
#
interface Ethernet1/0/17
 port access vlan 7
#
interface Ethernet1/0/18
 port access vlan 6
#
interface Ethernet1/0/19
 port access vlan 5
#
interface Ethernet1/0/20
 port access vlan 4
#
interface Ethernet1/0/21
 port access vlan 6
#
interface Ethernet1/0/22
 port access vlan 11
#
interface Ethernet1/0/23
 port access vlan 6
 stp edged-port enable
#
interface Ethernet1/0/24
 port access vlan 2
#
interface GigabitEthernet1/0/25
 description From Switch 5500
 port link-type trunk
 port trunk permit vlan all
 shutdown
 stp loop-protection
#
interface GigabitEthernet1/0/26
 description From Switch 5500
 port link-type trunk
 port trunk permit vlan all
 stp loop-protection
#
 ip route-static 192.168.0.0 255.255.240.0 172.16.1.1
#
 info-center synchronous
#
 load xml-configuration
#
user-interface aux 0
 authentication-mode scheme
user-interface vty 0 15
#
return
[Switch A3100]

Answer 1

You should check the portal server limitations, since it is enabled on A5500 Vlan 1 interface:

#
interface Vlan-interface1
ip address 172.16.1.1 255.255.255.0
portal server 1 method layer3
#

While a portal server hasn't stateful packet inspection functionality, it could prevent icmp echo reply response to pass Vlan 1 layer 3 interface, when directed to any IP address on the A5500 side.

Answer 2

(Disclaimer: I am not familiar with HP switches, so I wont' be able to give proper command syntax for show/display commands).

For a first, let's leave all routing discussion aside. AS5500 an AS3100 are on a common subnet (172.16.1.0/24) on VLAN1, so they must be able talk to each other directly. Accessing AS3100 from "elsewhere" is for later, we first have to solve a switching problem - or confirm that we don't have one.

Here's two test procedures to see if VLAN1 is actually "going through", i.o.w. if it is one single broadcast domain spannig both switches

1. Find A3100's and AS5500's MAC address for interface VLAN1. We would expect these MAC address to appear in a neighboring device's ARP cache after trying to talk to it. HP's equivalent of show ip interface vlan 1 should show these MAC addresses.

2. configure one switchport on both of the switches, into VLAN1, untagged. Configure a laptop's NIC with 172.16.1.xx and connect it to both ports in turn.

3. Ping both AS5500's and AS3100's IP addresses from that laptop. Ensure that the laptop actually attempts this from its 172.16.1.x address (e.g. by keeping any WiFi or 3G/4G interface disabled for the test). Write down the test results, and see if some pattern of ok/not-ok appears.

4. No matter if the pings work or not, always look at the laptop's ARP cache ("arp -a" on windows, "arp -na" on a *nix-like OSs). See if and which MAC addresses are learnt for AS5500's and AS3100's IP adresses - they should be the ones from step 1.

Or this way:

1. Generate some traffic (in extenso: ping A3100's IP address) from AS5500. Ensure that this traffic is actually generated from AS5500's interface VLAN1 - probably, there's a command line option to set the ping source address.

2. No matter if the ping works, check AS5500's ARP cache to see if it has learnt AS3100's MAC adress.

3. Check AS5500's CAM table resp. MAC address table for VLAN1. AS3100's VLAN 1 MAC address shold be visible on port 1/0/32. If not - then VLAN1 is not one single broadcast domain.

4. repeat 1-3 from AS3100 towards AS5500.

These tests should help to establish if VLAN1's broadcast domain is actually "going throgh" across both switches. My suspicion is that it is not.

I spotted a difference in your config:

AS5500:

interface GigabitEthernet1/0/32
 port link-mode bridge           
 description To A3100 Switch
 port link-type trunk
 port trunk permit vlan all
 stp edged-port enable   <-- IMO, that should not be here if you connect a switch to this port. 

AS3100:

interface GigabitEthernet1/0/26
 description From Switch 5500
 port link-type trunk
 port trunk permit vlan all
 stp loop-protection

Educated guess:

The stp edged-port enable on AS5500 that IMO should not be there. Edge-Type ports are for the edge: PCs, printers, servers etc. Never another bridge/switch.

I suspect that it has some influence on how the switches treat untagged traffic. Since VLAN1 is often being used as the default ("native") VLAN, frames from VLAN1 are usually sent without tags. What if one switch tags them, but the other doesn't, or expects them to be tagged, and drops incoming untagged frames, or maps untagged frames to another VLAN?

There might also be a difference in default behaviour w/regards to tagged/untagged frames of the two different switch models - you'll have to consult documentation to find out.

Answer 3

Your switch on the right (A3100) doesn't have a default gateway nor a route toward other subnets to answer back. It can only talk to machines within the subnet 172.16.1.0/24.

If you send the ping from any other subnet it has no idea where to send the answer packet.

Add a route of something like 192.168.0.0/20 netxhop 172.16.1.1 and you should be ok (A5500 should take care of the routing and the /20 covers from 192.168.0.0 to 192.168.15.255 so it would include your 10 /24 blocks in one route).

Answer 4

TO access the switch through remotely,switch should have Route or default gateway.

Use below commend you would be able to access the RIGHT(A3100)

ip route-static 0.0.0.0 0.0.0.0 172.16.1.1

Answer 5

I think you will want to remove the edge port setting from the A5500.

interface GigabitEthernet1/0/32

 port link-mode bridge
 description To A3100 Switch
 port link-type trunk
 port trunk permit vlan all
 stp edged-port enable   <----

The A5500 has a default route to 192.168.1.1. Have you tried using that on the other switch too?
ip route-static 0.0.0.0 0.0.0.0 192.168.1.1

Answer 6

Since the switch on the right doesn't have any routes aside from the local routes, it can only communicate on 172.16.1.0/24.

Answer 7

The 3100.
172.16.1.0/24 Direct 0 0 172.16.1.2 Vlan1

172.16.1.x is not reachable via 172.16.1.2. Maybe try and put a /32 on the 3100's .2 management address.