I may be missing something extremely simple here, but im at loss trying to figure out what this Nexus switch is doing.

Here is the topology:

Sanitized and FIXED Topology

DISCLAIMER! I had made a mistake on the diagram by putting the wrong mask on the firewall, Ron pointed this out and i have updated the diagram.

Note: I'm expecting people to ask why this route exists: [1/0] via

It's a static route that's completely redundant to the default gateway, yet if i remove this it seems to sever all communication between the 2 VLANs.

1) Successful - PC (Orange) tries to ping PC (Green), the flow seems to look like:

[Square brackets indicate possible internal routing]

Echo Request: -> -> [ ->] ->

Echo Reply: -> [ ->] -> ->

Im looking to find out what decision process is taking place on the Nexus(SW1) when going between internal VLAN IP's (if thats whats happening).

2) Failed - PC (Orange) tries to ping SW1 interface VLAN2040 (, denied by firewall (it did not see the echo request):

Echo Request: -> 

Echo Reply: -> *Denied*

For this im trying to understand why the Nexus (SW1) is choosing to route to the default gateway instead of ARPing for the locally connected subnet (

This is my ping results from the PC:

Pinging with 32 bytes of data:
Request timed out.
Request timed out.

This capture shows the firewalls perspective, only seeing the reply: > icmp: echo reply > icmp: echo reply

If I set up a capture type of 'asp-drop', i can confirm the drop reason: > icmp: echo reply
Drop-reason: (inspect-icmp-seq-num-not-matched) ICMP Inspect seq num not matched

It's also worth noting that pinging will work in the reverse order, where SW1 can still ping the PC (asymmetrically) even though the PC cannot successfully ping SW1(denied by firewall).

This asymmetry causes ICMP connections to time out on the ASA using default timers (2 seconds):

16:22:57 Built inbound ICMP connection for faddr gaddr laddr type 8 code 0
16:22:59 Teardown ICMP connection for faddr gaddr laddr type 8 code 0

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Dec 15, 2019 at 19:41

2 Answers 2

1 [1/0] via

It's a static route that's completely redundant to the default gateway, yet if i remove this it seems to sever all communication between the 2 VLANs.

No, it's not. is a subnet of Without that routing entry, SW1 would try to send the packet locally within VLAN2040 - and not use its default gateway. With that entry, it passes the packet to FW1 to sort out. You haven't provided enough detail to tell what's going on there but apparently it does work.

You need to sort out the overlapping subnets (=renumber). That is a bad design generally, and sooner or later lands on your feet. I'd strongly advise to use a single standard network mask/prefix length throughout.


I see two things wrong:

  1. Your firewall is misconfigured. The inside interface has the wrong mask. VLAN 2040 is /21, but you've configured it as a /24.

  2. The orange PC has the wrong gateway. According to your diagram, the SVI for VLAN 2040 is, not

  • Well, i must admit you have a good eye! And setting the gateway to that would totally make it work. However im almost certain that is simply a mistake on my part in making the diagram. I will edit it ASAP, but for now assume that it is a /21 as it is on SW1.
    – Ryan B
    Commented Oct 19, 2019 at 1:31
  • Yea, I just confirmed. Mask is (/21).
    – Ryan B
    Commented Oct 19, 2019 at 2:28
  • What about the orange PC?
    – Ron Trunk
    Commented Oct 19, 2019 at 3:17
  • Well, with that gateway, is in the subnet, so it is the configured default gateway for about 200 workstations.
    – Ryan B
    Commented Oct 19, 2019 at 3:29
  • 1
    @RyanB, you have stumbled onto the reason we really want you to directly copy and paste the configurations into the question. There are also other configurations that can affect this, so you should really put in the full (sanitized) configurations. See the Network Engineering Question Checklist for guidance.
    – Ron Maupin
    Commented Oct 19, 2019 at 3:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.