How should edge switches have their routing configured (when there is a mgmt vlan in the mix)

Question

I'm having trouble with a new network topology we are trying to implement onto our environment. The issue seems to be with the switches. The problem is not relevant to this question but for completeness sake I'll share it anyways.

Totally on random clients we are losing internet connectivity. The issue seems to happen because the device loses connection to the default gateway IP address (which is the backbone svi IP). If we just disable and re-eanble the network adapter on the device everything goes back to normal.

Back to my question; I think I might have made an error with this topology. We have a backbone (5512rzl2) and several edge switches (2930F). For switch management purposes we have vlan 3 on every switch. every switch has a unique vlan ip (svi) for this management purpose.

sw-backbone>
vlan 3
name management
tagged 25-28
ip address 10.10.3.100
exit

sw-edge1>
vlan 3
name management
tagged 25-28
ip address 10.10.3.1
exit

sw-edge2>
vlan 3
name management
tagged 25-28
ip address 10.10.3.2
exit

and so on...

Also on each edge switch we have this routing config on top:

ip route 0.0.0.0 0.0.0.0 10.10.3.100

the backbone has a different default route which points to our firewall (the lan is on vlan 50)

ip route 0.0.0.0 0.0.0.0 192.168.50.1

My thought was that I need to point each switch to the management backbone svi. After having the problem above I'm doubting I got this setup correct.

Finally my question; In the scenario above, should edge switches have "ip route 0.0.0.0 0.0.0.0 10.10.3.100" on their configs? Instead should I change that route to the default gateway IP like on the backbone - to point to our firewall "192.168.50.1". Or should edge switches not have any ip routes on them.. In which case the backbone will do all the routing I assume.

As you can see I'm very confused on how this pretty basic topology should be configured. Any experts that could share some insight would be great.

Thank you.

PS: I have L3 intervlan routing enabled on the backbone. The firewall is for internet traffic and for routing between vLANs that do not have SVIs (IPs).

Edit: To add to the PS above and a question with it; I have

ip routing

command on the backbone only. the edge switch don't have this line on them. Is this the correct way? Or should I write that command on each edge switch too? (I want intervlan layer 3 routing to be done via the backbone.)

Answer 1

I think it's best to answer from bottom up. I'm assuming all your subnets are /24.

In the scenario above, should edge switches have "ip route 0.0.0.0 0.0.0.0 10.10.3.100" on their configs?

Looks fine. Your management PCs need to be reachable from there, of course.

should I change that route to the default gateway IP like on the backbone - to point to our firewall "192.168.50.1".

If the switches have no interface in that subnet (doesn't look like it) that won't work.

Or should edge switches not have any ip routes on them.. In which case the backbone will do all the routing I assume.

If you access switch management from any IP address not in the management subnet then you do need a (default) gateway to that address. And yes, the backbone needs to do that routing.

I have ip routing command on the backbone only. the edge switch don't have this line on them.

That is correct if you don't route on the edge switches (which would require a somewhat different setup). With a "flat" network towards the edge switches (=all VLANs connect to the backbone), those need an IP address for management only.

Totally on random clients we are losing internet connectivity. The issue seems to happen because the device loses connection to the default gateway IP address (which is the backbone svi IP).

"lose Internet connectivity" is a very unspecific error. You need to check for the details:

• A client can reach (ping) its default gateway. Failing that, does it ARP resolve the gateway? The former indicates L2 or L3 connectivity problems, the latter only L2.
• tracert resp. traceroute the destination - where does the route begin to time out? That node either filters the request or has no valid route back to the client.
• A good indicator for client connectivity is the MAC table in a connect switch - do all involved switches show the client MAC on the correct port (show mac-address 00:11:22:33:44:55) and VLAN?
• Check the edge/backbone switches' and the firewall's log for anomalies.

If we just disable and re-eanble the network adapter on the device everything goes back to normal.

That is very strange. It might indicate a problem with DHCP or DHCP snooping. Check for lease timeout or similar.

If you have a non-simplistic setup or use snooping then you should add all the details (full config at best) to your question.