4

As you can see in below diagram regarding the Inter-VLAN between Server (VLAN 107) with The site in (VLAN 104)actually, we can ping all the inter-VLAN on the site. but we cannot browse some of them such as Radar and microwave we cannot browse them by their software. only ping them. only by access VLAN we can ping and browse them, but by inter_VLAN we cannot browse could you support??

enter image description here

Switch config:

version 16.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
!
hostname CORE-01[SCC-NSE-0002]
!
!
vrf definition Mgmt-vrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
!
no aaa new-model
clock timezone AST 3 0
switch 1 provision ws-c3850-48xs
!
!
!
!
ip routing
!
!
!
ip multicast-routing
ip multicast auto-enable
ip multicast group-range 10
ip name-server 8.8.8.8 8.8.4.4
!
!
!
!
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!
!
!
redundancy
 mode sso
!
!
!
class-map match-any system-cpp-police-topology-control
  description Topology control
class-map match-any system-cpp-police-sw-forward
  description Sw forwarding, SGT Cache Full, LOGGING
class-map match-any system-cpp-default
  description DHCP snooping, show forward and rest of traffic
class-map match-any system-cpp-police-sys-data
  description Learning cache ovfl, Crypto Control, Exception, EGR Exception, NFL SAMPLED DATA, Gold Pkt, RPF Failed
class-map match-any system-cpp-police-punt-webauth
  description Punt Webauth
class-map match-any system-cpp-police-forus
  description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station
  description MCAST END STATION
class-map match-any system-cpp-police-multicast
  description Transit Traffic and MCAST Data
class-map match-any system-cpp-police-l2-control
  description L2 control
class-map match-any system-cpp-police-dot1x-auth
  description DOT1X Auth
class-map match-any system-cpp-police-data
  description ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-control-low-priority
  description ICMP redirect and general punt
class-map match-any system-cpp-police-wireless-priority1
  description Wireless priority 1
class-map match-any system-cpp-police-wireless-priority2
  description Wireless priority 2
class-map match-any system-cpp-police-wireless-priority3-4-5
  description Wireless priority 3,4 and 5
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control
  description Routing control
class-map match-any system-cpp-police-protocol-snooping
  description Protocol snooping
!
policy-map port_child_policy
 class non-client-nrt-class
  bandwidth remaining ratio 10
policy-map system-cpp-policy
 class system-cpp-police-data
  police rate 200 pps
 class system-cpp-police-sys-data
  police rate 100 pps
 class system-cpp-police-sw-forward
  police rate 1000 pps
 class system-cpp-police-multicast
  police rate 500 pps
 class system-cpp-police-multicast-end-station
  police rate 2000 pps
 class system-cpp-police-punt-webauth
 class system-cpp-police-l2-control
 class system-cpp-police-routing-control
  police rate 1800 pps
 class system-cpp-police-control-low-priority
 class system-cpp-police-wireless-priority1
 class system-cpp-police-wireless-priority2
 class system-cpp-police-wireless-priority3-4-5
 class system-cpp-police-topology-control
 class system-cpp-police-dot1x-auth
 class system-cpp-police-protocol-snooping
 class system-cpp-police-forus
 class system-cpp-default
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 no ip address
 shutdown
 negotiation auto
!
interface TenGigabitEthernet1/0/1
 description <<<<< UPLINK FEC-110>>>>>
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/0/2
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/0/3
 description <<<<< UPLINK FEC-118>>>>>
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/0/4
 description <<<<< UPLINK FEC-124>>>>>
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/0/5
 description <<<<< UPLINK FEC-130>>>>>
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/0/6
 switchport access vlan 102
 switchport mode access
 shutdown
!
interface TenGigabitEthernet1/0/7
 description <<<<<SECTOR-02 LOOP 7 - FEC142 UPLINK>>>>>>
 switchport access vlan 102
 switchport mode access
!
interface TenGigabitEthernet1/0/8
 description <<<<<LOOP 1 - FEC148 UPLINK>>>>>>
 switchport access vlan 104
 switchport mode access
!
interface TenGigabitEthernet1/0/9
 description <<<<<LOOP 2  - FEC154 UPLINK >>>>>>
 switchport access vlan 104
 switchport mode access
!
interface TenGigabitEthernet1/0/10
 description <<<<<LOOP 10 - FECxxxxx UPLINK>>>>>>
 switchport access vlan 104
 switchport mode access
!
interface TenGigabitEthernet1/0/11
 switchport access vlan 103
 switchport mode access
!
interface TenGigabitEthernet1/0/12
 switchport access vlan 103
 switchport mode access
!
interface TenGigabitEthernet1/0/13
 switchport access vlan 103
 switchport mode access
!
interface TenGigabitEthernet1/0/14
 description <<<<<UPLINK FEC-179>>>>>
 switchport access vlan 101
 switchport mode trunk
!
interface TenGigabitEthernet1/0/15
 description To SCC-NSW001
 switchport mode trunk
!
interface TenGigabitEthernet1/0/16
 switchport access vlan 108
 switchport mode access
!
interface TenGigabitEthernet1/0/17
 switchport trunk allowed vlan 120
 switchport mode trunk
!
interface TenGigabitEthernet1/0/18
!
interface TenGigabitEthernet1/0/19
 switchport mode trunk
!
interface TenGigabitEthernet1/0/20
 switchport mode trunk
!
interface TenGigabitEthernet1/0/21
 switchport mode trunk
!
interface TenGigabitEthernet1/0/22
 switchport mode trunk
!
interface TenGigabitEthernet1/0/23
 description <<<<<LOOP 2  - FEC153 UPLINK >>>>>>
 switchport access vlan 104
!
interface TenGigabitEthernet1/0/24
 switchport mode trunk
!
interface TenGigabitEthernet1/0/25
 switchport access vlan 107
 switchport mode access
!
interface TenGigabitEthernet1/0/26
!
interface TenGigabitEthernet1/0/27
 description <<<<Marine Loop1-UPLINK FEC-201>>>>>
 switchport access vlan 105
 switchport mode access
!
interface TenGigabitEthernet1/0/28
 description <<<<Marine Loop1-UPLINK FEC-219>>>>>
 switchport access vlan 106
 switchport mode access
!
interface TenGigabitEthernet1/0/29
 description <<<<<UPLINK FEC-213>>>>>
 switchport access vlan 105
 switchport mode access
!
interface TenGigabitEthernet1/0/30
 description Trunking with Moxa-Test
 switchport trunk allowed vlan 101-104
 switchport mode trunk
!
interface TenGigabitEthernet1/0/31
!
interface TenGigabitEthernet1/0/32
 description <<<<<UPLINK FEC 212 - 225temp >>>>>>
 switchport access vlan 106
 switchport mode access
!
interface TenGigabitEthernet1/0/33
 switchport mode trunk
!
interface TenGigabitEthernet1/0/34
 switchport mode trunk
!
interface TenGigabitEthernet1/0/35
 description <<<<<To SCC-NSW-003>>>>
 switchport mode trunk
!
interface TenGigabitEthernet1/0/36
 description <<<<<MARINE-PIB74 >>>>>>>
 switchport mode trunk
!
interface TenGigabitEthernet1/0/37
!
interface TenGigabitEthernet1/0/38
!
interface TenGigabitEthernet1/0/39
 description <<<<<VIDEOWALL SCC>>>>>
 switchport mode trunk
!
interface TenGigabitEthernet1/0/40
!
interface TenGigabitEthernet1/0/41
 switchport mode dot1q-tunnel
 no cdp enable
!
interface TenGigabitEthernet1/0/42
!
interface TenGigabitEthernet1/0/43
!
interface TenGigabitEthernet1/0/44
!
interface TenGigabitEthernet1/0/45
!
interface TenGigabitEthernet1/0/46
!
interface TenGigabitEthernet1/0/47
!
interface TenGigabitEthernet1/0/48
 description UP-Link with FortiGate1000D
 no switchport
 ip address 192.168.20.253 255.255.255.0
!
interface TenGigabitEthernet1/1/1
!
interface TenGigabitEthernet1/1/2
!
interface TenGigabitEthernet1/1/3
!
interface TenGigabitEthernet1/1/4
!
interface TenGigabitEthernet1/1/5
!
interface TenGigabitEthernet1/1/6
 description <<<<<UPLINK FEC-130>>>>>
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/1/7
!
interface TenGigabitEthernet1/1/8
!
interface TenGigabitEthernet1/1/9
!
interface TenGigabitEthernet1/1/10
!
interface TenGigabitEthernet1/1/11
 switchport access vlan 101
 switchport mode access
!
interface TenGigabitEthernet1/1/12
!
interface TenGigabitEthernet1/1/13
!
interface TenGigabitEthernet1/1/14
!
interface TenGigabitEthernet1/1/15
!
interface TenGigabitEthernet1/1/16
!
interface FortyGigabitEthernet1/1/1
!
interface FortyGigabitEthernet1/1/2
!
interface FortyGigabitEthernet1/1/3
!
interface FortyGigabitEthernet1/1/4
!
interface Vlan1
 ip address 10.0.25.2 255.255.255.0
 standby 1 ip 10.0.25.100
 standby 1 priority 150
 standby 1 preempt
!
interface Vlan12
 no ip address
!
interface Vlan66
 description FAT IP[To be deleted]
 ip address 10.112.6.1 255.255.255.0
!
interface Vlan67
 description SIQURA CAMERA DEFAULT[To be deleted]
 no ip address
!
interface Vlan101
 description RSFIP-001
 ip address 10.0.1.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.1.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan102
 description RSFIP-002
 ip address 10.0.2.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.2.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan103
 description RSFIP-003
 ip address 10.0.3.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.3.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan104
 description RSFIP-004
 ip address 10.0.4.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.4.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan105
 ip address 10.0.5.2 255.255.255.0
 standby 1 ip 10.0.5.254
 standby 1 priority 150
 standby 1 preempt
!
interface Vlan106
 ip address 10.0.6.2 255.255.255.0
 standby 1 ip 10.0.6.254
 standby 1 priority 150
 standby 1 preempt
!
interface Vlan107
 description Head End Equipments
 ip address 10.0.7.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.7.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan108
 description <<<<<BUILDING & GATES>>>>>
 ip address 10.0.8.2 255.255.255.0
 ip pim sparse-dense-mode
 standby 1 ip 10.0.8.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan109
 ip address 10.0.9.2 255.255.255.0
 standby 1 ip 10.0.9.254
 standby 1 priority 150
 standby 1 preempt
 ip igmp join-group 224.16.0.0
!
interface Vlan110
 ip address 10.0.10.2 255.255.255.0
 standby 1 ip 10.0.10.254
 standby 1 priority 150
 standby 1 preempt
!
interface Vlan120
 ip address 172.17.1.1 255.255.0.0
!
interface Vlan200
 ip address 192.168.10.100 255.255.255.0
!
interface Vlan303
 description PELCO
 ip address 192.168.0.254 255.255.255.0
!
ip default-gateway 192.168.20.254
ip forward-protocol nd
ip forward-protocol udp ntp
ip http server
ip http authentication local
ip http secure-server
ip dns server
ip route 0.0.0.0 0.0.0.0 192.168.20.254
ip route 0.0.0.0 0.0.0.0 172.16.1.1
ip route 0.0.0.0 0.0.0.0 192.168.30.254
!
ip access-list extended AutoQos-4.0-wlan-Acl-Bulk-Data
 permit tcp any any eq 22
 permit tcp any any eq 465
 permit tcp any any eq 143
 permit tcp any any eq 993
 permit tcp any any eq 995
 permit tcp any any eq 1914
 permit tcp any any eq ftp
 permit tcp any any eq ftp-data
 permit tcp any any eq smtp
 permit tcp any any eq pop3
ip access-list extended AutoQos-4.0-wlan-Acl-MultiEnhanced-Conf
 permit udp any any range 16384 32767
 permit tcp any any range 50000 59999
ip access-list extended AutoQos-4.0-wlan-Acl-Scavanger
 permit tcp any any range 2300 2400
 permit udp any any range 2300 2400
 permit tcp any any range 6881 6999
 permit tcp any any range 28800 29100
 permit tcp any any eq 1214
 permit udp any any eq 1214
 permit tcp any any eq 3689
 permit udp any any eq 3689
 permit tcp any any eq 11999
ip access-list extended AutoQos-4.0-wlan-Acl-Signaling
 permit tcp any any range 2000 2002
 permit tcp any any range 5060 5061
 permit udp any any range 5060 5061
ip access-list extended AutoQos-4.0-wlan-Acl-Transactional-Data
 permit tcp any any eq 443
 permit tcp any any eq 1521
 permit udp any any eq 1521
 permit tcp any any eq 1526
 permit udp any any eq 1526
 permit tcp any any eq 1575
 permit udp any any eq 1575
 permit tcp any any eq 1630
 permit udp any any eq 1630
 permit tcp any any eq 1527
 permit tcp any any eq 6200
 permit tcp any any eq 3389
 permit tcp any any eq 5985
 permit tcp any any eq 8080
!
!
!
control-plane
 service-policy input system-cpp-policy
!
!
no vstack
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 login
line vty 5 15
 login
!
ntp server 10.0.25.100
!
end

CORE-01[SCC-NSE-0002]#
  • 2
    If ping works you don't have a routing issue. Likely, device access is restricted to the local segment only. That is a host issue and sadly off-topic here. – Zac67 Mar 24 at 19:44
  • thanks for Reply, yes, we can ping all the devices through the inter-VLAN but we cannot browse some of the devices in the site through their software. but if we connected to the same VLAN everything working fine. the issue only with Inter-valn – Sayed Wafi Mar 24 at 19:48
  • You need to edit your question to include the full 3850 configuration. We cannot simply guess or speculate what the problem is. – Ron Maupin Mar 24 at 19:54
  • 3
    Please post configs here as preformatted text using { and }, do not use external sites to host them. That way the question here remains useful even after the files are removed from your google drive. – Teun Vink Mar 24 at 21:51
  • 1
    When you say "Browse them by their software" do you mean actually use a web browser to connect to the device's internal web server, or is there a proprietary application that "browses" or "discovers" devices on the local LAN? If it's the latter, then it most likely won't work because those discovery mechanisms are usually broadcast-based which can't cross a network boundary. Otherwise it sounds like a security policy somewhere. That's just my guess. – Tim Mar 31 at 22:30
1

L3 is working fine based on the all descriptions I suggest following can support further troubleshooting

  1. Connect a unix-like client in VLAN 104 and do nmap port scan to see the response on which L4 port destination is responding.

  2. Check destination host configuration for any potential restrictions

  3. Check the return network access path from destination device to server to be sure on any asynchronous network path

Additionally: 4. Capture packets (SPAN or inline Fluke Network) on destination device

  1. If you want to eliminate network L2/L3/L4 then you can connect a test client on same vlan on same switch and test network access to server

  2. If you know on which L4 port destination is suppose to work then you can use any
    specialised tools to investigate/Tshoot further

HTH

0

No issues on in your configurations and ping is confirmed your configurations are okay. Therefore you need to check configuration in your devices. In addition to that Use Traceroute and identify issue location. (no power to add comment)

  • Thanks for your reply, I did the Traceroute and I got the below : CORE-01[SCC-NSE-0002]#traceroute 10.0.4.177 Type escape sequence to abort. Tracing the route to 10.0.4.177 VRF info: (vrf in name/id, vrf out name/id) 1 10.0.4.177 1 msec 1 msec 1 msec – Sayed Wafi Mar 25 at 8:46
  • please provide trace route details. please mention source and destination – infra Mar 25 at 8:51
  • try to trace route from your server or device which is not connected. I think you have trace from cisco 3850 switch – infra Mar 25 at 8:55
0

Ping requires ICMP layer 3 protocol, means you have layer 3 connectivity. FOr browsing port 80 or 443 should be allowed, check if you have any ACL which is blocking these ports. If no ACL's then see if you can check on the server itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.