5

On a Cisco Catalyst 3850 Stack there is attached a Link to a Carrier who provide a few connections seperated with vlans (100,101,...) so I create a VLAN 100 on my cisco switch and setup a IP Address but in case I capture the Traffic on my Interface there isnt show any ICMP Packages. The VLAN ID is only needed to tag the Traffic for the Carrier, the Device on the remote site is not member of the VLAN and get the traffic untagged.

This is my config for Interface and VLAN:

!
interface GigabitEthernet2/0/8
 switchport trunk allowed vlan 100,101
 switchport mode trunk
end
!
interface Vlan100
 ip address 10.1.18.9 255.255.255.252
end 

After configured that I start capture on Port gi2/0/8 and try Ping to 10.1.18.10 but in the PCAP there is no ICMP Package, what is wrong with my setup?

The complete running config:

    version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service compress-config
!
hostname cat03
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
!
no aaa new-model
switch 1 provision ws-c3850-12s
switch 2 provision ws-c3850-12s
!
!
!
!
!
!
!
!
!
!
!
!
qos queue-softmax-multiplier 100
!
!
!
diagnostic bootup level minimal
spanning-tree mode rapid-pvst
spanning-tree extend system-id
hw-switch switch 1 logging onboard message level 3
hw-switch switch 2 logging onboard message level 3
!
redundancy
 mode sso
!
!
vlan configuration 100,404,408-409
!         
!
class-map match-any non-client-nrt-class
!
policy-map port_child_policy
 class non-client-nrt-class
  bandwidth remaining ratio 10
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
interface Port-channel2
 switchport trunk native vlan 10
 switchport mode trunk
!
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 ip address 10.1.20.6 255.255.255.0
 negotiation auto
!
interface GigabitEthernet1/0/1
 switchport access vlan 400
 speed nonegotiate
!
interface GigabitEthernet1/0/2
 description PortChannel ISR
 switchport trunk native vlan 10
 switchport mode trunk
 channel-group 2 mode on
!
interface GigabitEthernet1/0/3
 switchport access vlan 408
!         
interface GigabitEthernet1/0/4
 switchport access vlan 403
!
interface GigabitEthernet1/0/5
 no switchport
 no ip address
!
interface GigabitEthernet1/0/6
 no switchport
 no ip address
!
interface GigabitEthernet1/0/7
 no switchport
 no ip address
!
interface GigabitEthernet1/0/8
 no switchport
 no ip address
!
interface GigabitEthernet1/0/9
 switchport access vlan 404
!
interface GigabitEthernet1/0/10
!
interface GigabitEthernet1/0/11
!
interface GigabitEthernet1/0/12
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/1
!         
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface GigabitEthernet2/0/1
!
interface GigabitEthernet2/0/2
 description PortChannel ISR
 switchport trunk native vlan 10
 switchport mode trunk
 channel-group 2 mode on
!
interface GigabitEthernet2/0/3
!
interface GigabitEthernet2/0/4
 no switchport
 ip address 10.1.18.1 255.255.255.252
!
interface GigabitEthernet2/0/5
!
interface GigabitEthernet2/0/6
!
interface GigabitEthernet2/0/7
!
interface GigabitEthernet2/0/8
 switchport trunk allowed vlan 100,101
 switchport mode trunk
!
interface GigabitEthernet2/0/9
!
interface GigabitEthernet2/0/10
!
interface GigabitEthernet2/0/11
!
interface GigabitEthernet2/0/12
!
interface GigabitEthernet2/1/1
!
interface GigabitEthernet2/1/2
!
interface GigabitEthernet2/1/3
!
interface GigabitEthernet2/1/4
!
interface TenGigabitEthernet2/1/1
!
interface TenGigabitEthernet2/1/2
!
interface TenGigabitEthernet2/1/3
!
interface TenGigabitEthernet2/1/4
!
interface Vlan1
 no ip address
!
interface Vlan100
 ip address 10.1.18.9 255.255.255.252
!
ip default-gateway 10.1.20.1
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 10.1.20.1 name Mgmt-DefaultRoute
!
ip access-list extended AutoQos-4.0-wlan-Acl-Bulk-Data
 permit tcp any any eq 22
 permit tcp any any eq 465
 permit tcp any any eq 143
 permit tcp any any eq 993
 permit tcp any any eq 995
 permit tcp any any eq 1914
 permit tcp any any eq ftp
 permit tcp any any eq ftp-data
 permit tcp any any eq smtp
 permit tcp any any eq pop3
ip access-list extended AutoQos-4.0-wlan-Acl-MultiEnhanced-Conf
 permit udp any any range 16384 32767
 permit tcp any any range 50000 59999
ip access-list extended AutoQos-4.0-wlan-Acl-Scavanger
 permit tcp any any range 2300 2400
 permit udp any any range 2300 2400
 permit tcp any any range 6881 6999
 permit tcp any any range 28800 29100
 permit tcp any any eq 1214
 permit udp any any eq 1214
 permit tcp any any eq 3689
 permit udp any any eq 3689
 permit tcp any any eq 11999
ip access-list extended AutoQos-4.0-wlan-Acl-Signaling
 permit tcp any any range 2000 2002
 permit tcp any any range 5060 5061
 permit udp any any range 5060 5061
ip access-list extended AutoQos-4.0-wlan-Acl-Transactional-Data
 permit tcp any any eq 443
 permit tcp any any eq 1521
 permit udp any any eq 1521
 permit tcp any any eq 1526
 permit udp any any eq 1526
 permit tcp any any eq 1575
 permit udp any any eq 1575
 permit tcp any any eq 1630
 permit udp any any eq 1630
 permit tcp any any eq 1527
 permit tcp any any eq 6200
 permit tcp any any eq 3389
 permit tcp any any eq 5985
 permit tcp any any eq 8080
ip access-list extended icmpacl
 permit icmp any any echo
 permit icmp any any echo-reply
!
access-list 144 permit icmp any any echo
access-list 144 permit icmp any any echo-reply
!
snmp-server community private RO
snmp-server trap-source GigabitEthernet0/0
!
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 exec-timeout 0 0
 login local
 transport input ssh
line vty 5 15
 exec-timeout 0 0
 login local
 transport input ssh
!
!
monitor session 1 source interface Gi1/0/10
monitor session 1 source interface Gi2/0/10
monitor session 1 destination interface Gi1/0/12 encapsulation dot1q ingress dot1q vlan 401
monitor session 2 source interface Gi1/0/11
monitor session 2 source interface Gi2/0/11
monitor session 2 destination interface Gi2/0/12 encapsulation dot1q ingress dot1q vlan 401
wsma agent exec
 profile httplistener
 profile httpslistener
!
wsma agent config
 profile httplistener
 profile httpslistener
!
wsma agent filesys
 profile httplistener
 profile httpslistener
!
wsma agent notify
 profile httplistener
 profile httpslistener
!
!         
wsma profile listener httplistener
 transport http
!
wsma profile listener httpslistener
 transport https
!
ap group default-group
end

On the Switch console I try to ping 10.1.18.10 and this is the status of the interfaces:

sh ip int br
Interface              IP-Address      OK? Method Status                Protocol   
Vlan100                10.1.18.9       YES manual up                    up      
GigabitEthernet2/0/8   unassigned      YES unset  up                    up   

And this is the Output of my ping command:

cat03#ping 10.1.18.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.18.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
cat03#

And for capturing I create this capture:

cat03#sh mon cap dumpPing para
   monitor capture dumpPing interface GigabitEthernet2/0/8 both
   monitor capture dumpPing match any
   monitor capture dumpPing file location flash-1:dumpICMP.pcap buffer-size 10
   monitor capture dumpPing limit packets 100

And after ping to 10.1.18.10 I cant see a ICMP PAckage in this pcap

UPDATE

Here is the output of sh vlan br

#show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi2/0/6, Gi2/0/7, Gi2/0/9
100  VLAN0100                         active    
400  VLAN0400                         active    Gi1/0/1
401  VLAN0401                         active    Gi1/0/10, Gi1/0/11, Gi2/0/10, Gi2/0/11
402  VLAN0402                         active    Gi2/0/1
403  VLAN0403                         active    Gi1/0/4
404  VLAN0404                         active    Gi1/0/9
405  VLAN0405                         active    Gi2/0/3
406  VLAN0406                         active    
407  VLAN0407                         active    
408  VLAN0408                         active    Gi1/0/3
409  VLAN0409                         active    Gi2/0/5
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 

UPDATE

CDP is enabled and I can see the remote device:

#sh cdp neighbors detail                  
Device ID: ext-par1.de
Entry address(es): 
  IP address: 10.1.18.10
Platform: Cisco CISCO2921/K9,  Capabilities: Switch IGMP 
Interface: GigabitEthernet2/0/8,  Port ID (outgoing port): GigabitEthernet0/1
Holdtime : 125 sec

Version :
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 20-Mar-12 18:57 by prod_rel_team

advertisement version: 2
VTP Management Domain: ''
Duplex: full
2
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Jan 5, 2021 at 19:41
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 19:41

1 Answer 1

1

Based on your question and config. your are correct. @Marc 'netztier' Luethi, answer is technically the next thing to test. I, like he, is guessing their port config is Access instead of a trunk. Save yourself a hassle of trying to reverse engineer their config and ask ISP for their port config to your connection "show run int Gi0/1" . If they balk, ask them to remove any comments or such internal data. Both sided need to work together. Did they offer a sample configuration? If not, ask.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.