1

I have a user getting some "security error when trying to access the Server2" from Server1. Both server1 and server2 are connected to the same switch but the servers are on different VLANs.

Server1 - IP addr. 10.114.91.40 - Vlan1904 - Gateway 10.114.91.252/24

Server2 - IP addr. 10.115.210.76 - Vlan1877 - Gateway 10.115.210.252/24

I logged into the Switch and successfully pinged 10.115.210.76 but could not ping 10.114.91.40:

SW1# ping 10.114.91.40
PING 10.114.91.40 (10.114.91.40): 56 data bytes
36 bytes from 10.114.91.252: Destination Host Unreachable
Request 0 timed out
36 bytes from 10.114.91.252: Destination Host Unreachable
Request 1 timed out
36 bytes from 10.114.91.252: Destination Host Unreachable
Request 2 timed out
36 bytes from 10.114.91.252: Destination Host Unreachable
Request 3 timed out
36 bytes from 10.114.91.252: Destination Host Unreachable
Request 4 timed out

Here are further details. What is strange to me is that if I traceroute Server1, I get a reply not from the server itself but from its default gateway. Why is that and how does it work. Also pay attention that there is !H sign in the traceroute output:

SW1# traceroute 10.114.91.40
traceroute to 10.114.91.40 (10.114.91.40), 30 hops max, 40 byte packets
1 10.114.91.252 (10.114.91.252) 1.008 ms !H 0.418 ms !H 0.474 ms !H

Here is the show ip route command for the Server1 - it says that the path to Server1 goes via its default gateway:

SW1# sh ip route 10.114.91.40
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]

10.114.91.0/24, ubest/mbest: 1/0, attached
*via 10.114.91.252, Vlan1904, [0/0], 2y3w, direct

Server1 is on VLAN1904. Here is the VLAN1904 interface:

SW1# sh int Vlan1904
Vlan1904 is up, line protocol is up
Hardware is EtherSVI, address is 00aa.980c.3f41
Description: ***Linux_User_Test_2***
Internet Address is 10.114.91.252/24
MTU 9216 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 2/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA
Last clearing of "show interface" counters never
60 seconds input rate 9968116 bits/sec, 2960 packets/sec
60 seconds output rate 7807575 bits/sec, 2650 packets/sec
Load-Interval #2: 5 minute (300 seconds)
input rate 12.25 Mbps, 3.24 Kpps; output rate 11.08 Mbps, 2.97 Kpps
L3 Switched:
input: 61594435293 pkts, 20817831682880 bytes - output: 62930952743 pkts, 19735891643201 bytes
L3 in Switched:
ucast: 61529227443 pkts, 20810125939277 bytes - mcast: 65207850 pkts, 7705743603 bytes
L3 out Switched:
ucast: 62930952743 pkts, 19735891643201 bytes - mcast: 0 pkts, 0 bytes

Now the other end - Server2. As I mentioned earlier, I can ping Server2. And when I traceroute Server2 IP addr., I get reply directly from the Server2 and not from its default gateway, as is the case with Server1:

SW1traceroute 10.115.210.76
traceroute to 10.115.210.76 (10.115.210.76), 30 hops max, 40 byte packets
1 10.115.210.76 (10.115.210.76) 0.712 ms 0.554 ms 0.591 ms

And here is show ip route to the Server2. Here the output says that the path to server2 goes via 10.115.210.76 - i.e. the server itself. Remember, when I issued show ip route for the Server1, the output said that the path went through Server1's default gateway. Is it normal?

SW1# sh ip route 10.115.210.76
IP Route Table for VRF "default"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]

10.115.210.76/32, ubest/mbest: 1/0, attached
*via 10.115.210.76, Vlan1877, [250/0], 1d00h, am

Server2 resides in Vlan 1877 and here is the VLAN interface:

SW1# sh int Vlan1877
Vlan1877 is up, line protocol is up
Hardware is EtherSVI, address is bbbb.980c.3f41
Description: ***LINUX_BACKUP_TEST***
Internet Address is 10.115.210.252/24
MTU 9216 bytes, BW 1000000 Kbit, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not supported
ARP type: ARPA
Last clearing of "show interface" counters never
60 seconds input rate 22116 bits/sec, 4 packets/sec
60 seconds output rate 2976 bits/sec, 3 packets/sec
Load-Interval #2: 5 minute (300 seconds)
input rate 21.92 Kbps, 4 pps; output rate 3.17 Kbps, 3 pps
L3 Switched:
input: 227370630555 pkts, 330619803530696 bytes - output: 209935318021 pkts, 21355307781488 bytes
L3 in Switched:
ucast: 227167894930 pkts, 330596189744029 bytes - mcast: 202735625 pkts, 23613786667 bytes
L3 out Switched:
ucast: 209935318021 pkts, 21355307781488 bytes - mcast: 0 pkts, 0 bytes

Do you think the connectivity problem exists somewhere in the Switch or somewhere in Server1's network configuration?

Let me know if you need some additional output from the switch. I cannot paste the whole running config because its really huge. Here are the VLAN interfaces' configs for extra details:

SW1# sh run int Vlan1877



!Command: show running-config interface Vlan1877





version 5.2(7)



interface Vlan1877

  no ip redirects

  ip address 10.115.210.252/24

  ip unreachables

  ip ospf passive-interface

  ip router ospf 1 area 0.0.0.0

  hsrp version 2

  hsrp 1877

  authentication md5 key-chain HSRP

  preempt delay minimum 180 reload 240

  timers 1 3

  ip 10.115.210.254

  no shutdown

  mtu 9216

  description ***LINUX_BACKUP_TEST***



SW1# sh run int Vlan1904



!Command: show running-config interface Vlan1904



version 5.2(7)



interface Vlan1904

  no ip redirects

  ip address 10.114.91.252/24

  ip unreachables

  ip ospf passive-interface

  ip router ospf 1 area 0.0.0.0

  hsrp version 2

  hsrp 1904

  authentication md5 key-chain HSRP

  preempt delay minimum 180 reload 240

  timers 1 3

  ip 10.114.91.254

  ip dhcp relay address 10.252.63.132

  ip dhcp relay address 10.252.63.4

  ip dhcp relay address 10.83.234.2

  ip dhcp relay address 10.83.234.34

  no shutdown

  mtu 9216

  description ***Linux_User_Test_2***
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:29
2

tl;dr

if I traceroute Server1, I get a reply not from the server itself but from its default gateway. Why is that and how does it work.

The gateway is unable to ARP the destination IP address.

The most likely reason is that Server 1 can't see its gateway and vice versa. Make sure you can ping the router and double check whether Server 1's NIC config and the switch config match.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.