SSH to Access Switch Management Console from other VLANs

Question

The infrastructure I currently work on has 3 switches:

One 3560X which is acting as a core switch and as a VTP Server with below characteristics:

no aaa new-model
system mtu routing 1500
ip routing

interface FastEthernet0
 ip address 10.0.0.11 255.255.255.0
 no ip route-cache
!

interface Vlan100
 ip address 10.1.0.1 255.255.252.0
!
interface Vlan110
 ip address 10.1.4.1 255.255.252.0
 ip helper-address 10.0.4.40
!

It's got about 5 VLANs with IP set as 10.1.0.1/22, 10.1.4.1/22 etc. The FastEthernet0 is Management port.

Current VLAN Layout is like:

Vlan1                  10.0.0.1         YES NVRAM  up                    up      
Vlan2                  10.0.1.1        YES NVRAM  up                    up      
Vlan10                 unassigned      YES unset  down                  down    
Vlan20                 10.0.2.1        YES NVRAM  up                    up      
Vlan30                 10.0.4.1        YES NVRAM  up                    up      
Vlan100                10.1.0.1        YES NVRAM  up                    up      
Vlan110                10.1.4.1        YES NVRAM  up                    up      

Then I have 2 other Cisco 2960Xs, acting as Access Switches and as VTP clients. Both switch is SSH enabled and I can do ssh by connecting to the management console and by assigning an IP to the client machine which is in the range management port.

I have below stuffs working correcting:

1. Inter-VLAN routing from all the switches.
2. I can ssh to the Core switch using any of the VLAN IP addresses (E.g. 10.1.4.1) and manage it.

But

1. I cannot ping the Default VLAN IP (10.0.0.1) from any other VLAN
2. I cannot ping IP address given to the management consoles of the 2960Xs (10.0.0.11, 10.0.0.12).

Question is, how I can do an SSH to the Access Switch and Manage it by sitting in other VLANs? What configuration is pending here ?

Update: Corrected wrong default VLAN IP Address. I can now ping the Default VLAN.

Answer 1

Based on @TeunVink's comments, Problem 1 was fixed.

Below are the methods I have used for setting up the management interface.

I chose not to use VLAN 1 for management, as per many recommendations. So I cleared IPs from VLAN 1 and Management Console (Fastethernet0), as:

conf t
int vlan 1
no ip address
exit
int fa0
no ip address
exit

Assuming that VTP is enabled is working between Core and Access switches:

Create a separate management vlan in the core switch. E.g. VLAN 10

conf t
vlan 10
name management
exit

Assign IP address to this vlan

int vlan 10
ip address 10.0.10.1 255.255.255.0
exit

Then connect to the 2960 access switch via console and verify the vlan 10 is present there using show vlan command. It should be there as the VTP already would have taken care of distributing it. Now assign ip separately here for vlan 10 in the access switch as:

conf t
int vlan 10
ip address 10.0.10.2 255.255.255.0
exit

Configure ssh by following this link.

That's it. Now Ping 10.0.10.2 from other vlans to the Access switch. Should be good to go.

This link can be treated as an excellent reference for this purpose.

Answer 2

2960X have only one vlan interface allowed so I'm assuming you've configured the IP on Vlan1 for their management interfaces.

Add the following to both switches:

ip default-gateway 10.0.0.1

Try ping the switch from another vlan now... it should work. SSH etc should work as well assuming you've generated crypto keys and the other associated work needed to enable a switch for SSH access.

Also why does the 3560X FastEthernet0 have the 10.0.0.11 address that you mentioned is assigned to one of your 2960s?

Make sure Vlan1 has not been pruned from any trunks either. If you want to maintain Vlan1 for management data communication.