Current connection path: desktop <-> access switch <-> core switch <-> NAT firewall for internet access

Objective: adding additional path as following to test another new NAT firewall which have IP; While all other desktop on except desktop would go to as usual.

New additional connection path: desktop <-> access switch <-> core switch

Original routing config on access switch (No dynamic routing protocol):

interface Vlan420
 description OFFICE USER LAN
 ip address

ip route

Original config on core switch (Contain dynamic routing protocol):

interface Vlan451
 ip address

ip route

route-map static2ospf permit 10 
 match tag 100
 set metric-type type-1

router ospf 10
 redistribute connected route-map connected2ospf
 redistribute static route-map static2ospf
 passive-interface default
 no passive-interface GigabitEthernet1/0/46
 no passive-interface GigabitEthernet1/0/47
 no passive-interface TenGigabitEthernet1/1/4
 no passive-interface GigabitEthernet2/0/47
 no passive-interface TenGigabitEthernet2/1/4
 network area 0
 network area 0
 network area 0
 network area 0
 network area 0

working traceroute from (Ping loss expected after because we have a firewall to block traceroute and ping)

traceroute -n
traceroute to (, 30 hops max, 60 byte packets
 1  1.775 ms  2.074 ms  1.968 ms
 2  1.422 ms  1.318 ms  1.620 ms
 3  2.121 ms  2.439 ms  2.734 ms
 4  * * *
 5  * * *

After applying this line of config on core switch, route to everywhere start failing

ip route tag 100 name my_test

failing traceroute from (all packet stuck at which is the access switch VLAN420 interface

traceroute -n
traceroute to (, 30 hops max, 60 byte packets
 1  1.791 ms  1.650 ms  1.537 ms
 2  * * *
 3  * * *

Question: access switch pointing default gateway to which is the core switch, then in core switch it's going default gateway to; What's wrong on the routing after I put a more specific route via "ip route" command with same default gateway?

Remark: We are trying to put in static route for old internet firewall before putting

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 21:49

1 Answer 1


If I understand you correctly, the host is still connected to ACCESS switch Vlan420.

Why did you add a route -> on CORE switch? That prevents the CORE switch, and everything upstream, from correctly routing packets to the host. That's why the traceroute doesn't progress further than the ACCESS switch.

What's wrong on the routing after I put a more specific route via "ip route" command with same default gateway?

When the CORE switch gets traceroute packets from it attempts to reply but the replies go the wrong way -- up to instead of down to the ACCESS switch which would forward them to the host. The static route you added broke the routing for by misdirecting traffic bound for that IP.

So the question is, what are you trying to accomplish by configuring the mentioned static route?

ACCESS# ip route tag 100 name my_test
  • The static route is an experiment to confirm static route is working, which we will use another IP replacing to another IP, also, can you please edit answer? You didn't include answer but rather a question / statement Aug 25, 2020 at 23:07
  • I'm not sure what kind of answer you're looking for, other than the above. Either you or I have a significant misunderstanding about your topology & question. The reason your traceroute test stopped working when you configured the static route is you "broke" the route to by configuring the static route. Your new static route directs traffic away from the actual host, not toward it. If you could explain your goal more clearly, it might be possible to provide a better answer. Aug 25, 2020 at 23:57
  • adding some more details on the original post, please check Aug 26, 2020 at 0:19
  • my question is how to make static route work for desktop, which I could point to anywhere. Aug 26, 2020 at 0:20
  • If I understand correctly, upstream of your CORE switch, you have a firewall/NAT device (existing) and want to test a new one (new.) That's not as simple as putting in a static route; in fact it requires a lot of effort in your topology. The reason is you need incoming traffic to your network for the test workstation to pass through the NEW NAT device, and outgoing traffic -- only from that workstation -- to pass out via the NEW device. You have a really big misunderstanding of how this stuff works together. Aug 26, 2020 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.