0

I'm having trouble with a new network topology we are trying to implement onto our environment. The issue seems to be with the switches. The problem is not relevant to this question but for completeness sake I'll share it anyways.

Totally on random clients we are losing internet connectivity. The issue seems to happen because the device loses connection to the default gateway IP address (which is the backbone svi IP). If we just disable and re-eanble the network adapter on the device everything goes back to normal.

Back to my question; I think I might have made an error with this topology. We have a backbone (5512rzl2) and several edge switches (2930F). For switch management purposes we have vlan 3 on every switch. every switch has a unique vlan ip (svi) for this management purpose.

sw-backbone>
vlan 3
name management
tagged 25-28
ip address 10.10.3.100
exit

sw-edge1>
vlan 3
name management
tagged 25-28
ip address 10.10.3.1
exit

sw-edge2>
vlan 3
name management
tagged 25-28
ip address 10.10.3.2
exit

and so on...

Also on each edge switch we have this routing config on top:

ip route 0.0.0.0 0.0.0.0 10.10.3.100

the backbone has a different default route which points to our firewall (the lan is on vlan 50)

ip route 0.0.0.0 0.0.0.0 192.168.50.1

My thought was that I need to point each switch to the management backbone svi. After having the problem above I'm doubting I got this setup correct.

Finally my question; In the scenario above, should edge switches have "ip route 0.0.0.0 0.0.0.0 10.10.3.100" on their configs? Instead should I change that route to the default gateway IP like on the backbone - to point to our firewall "192.168.50.1". Or should edge switches not have any ip routes on them.. In which case the backbone will do all the routing I assume.

As you can see I'm very confused on how this pretty basic topology should be configured. Any experts that could share some insight would be great.

Thank you.

PS: I have L3 intervlan routing enabled on the backbone. The firewall is for internet traffic and for routing between vLANs that do not have SVIs (IPs).

Edit: To add to the PS above and a question with it; I have

ip routing

command on the backbone only. the edge switch don't have this line on them. Is this the correct way? Or should I write that command on each edge switch too? (I want intervlan layer 3 routing to be done via the backbone.)

2
  • Note, if ip routing isn't enabled, the ip route command will have no effect. The switch will be in "host mode", were ip default-gateway applies.
    – Ricky
    Commented Feb 21, 2023 at 22:06
  • @Ricky "ip routing" is the only line in the running-config. I checked if it accepted anything else like "enabled" which it does not. Also the inter-vlan routing is working via the backbone so i think it is enabled.
    – shafuq
    Commented Feb 22, 2023 at 7:48

1 Answer 1

2

I think it's best to answer from bottom up. I'm assuming all your subnets are /24.

In the scenario above, should edge switches have "ip route 0.0.0.0 0.0.0.0 10.10.3.100" on their configs?

Looks fine. Your management PCs need to be reachable from there, of course.

should I change that route to the default gateway IP like on the backbone - to point to our firewall "192.168.50.1".

If the switches have no interface in that subnet (doesn't look like it) that won't work.

Or should edge switches not have any ip routes on them.. In which case the backbone will do all the routing I assume.

If you access switch management from any IP address not in the management subnet then you do need a (default) gateway to that address. And yes, the backbone needs to do that routing.

I have ip routing command on the backbone only. the edge switch don't have this line on them.

That is correct if you don't route on the edge switches (which would require a somewhat different setup). With a "flat" network towards the edge switches (=all VLANs connect to the backbone), those need an IP address for management only.

Totally on random clients we are losing internet connectivity. The issue seems to happen because the device loses connection to the default gateway IP address (which is the backbone svi IP).

"lose Internet connectivity" is a very unspecific error. You need to check for the details:

  • A client can reach (ping) its default gateway. Failing that, does it ARP resolve the gateway? The former indicates L2 or L3 connectivity problems, the latter only L2.
  • tracert resp. traceroute the destination - where does the route begin to time out? That node either filters the request or has no valid route back to the client.
  • A good indicator for client connectivity is the MAC table in a connect switch - do all involved switches show the client MAC on the correct port (show mac-address 00:11:22:33:44:55) and VLAN?
  • Check the edge/backbone switches' and the firewall's log for anomalies.

If we just disable and re-eanble the network adapter on the device everything goes back to normal.

That is very strange. It might indicate a problem with DHCP or DHCP snooping. Check for lease timeout or similar.

If you have a non-simplistic setup or use snooping then you should add all the details (full config at best) to your question.

5
  • thanks for your input. From the first four answers it seems my topology is correct for those parts. I will accept your answer since that was my main question. But I also want to provide some info about the problem in hand. The machines used to have their default gateways pointing to the firewall IP. Our recent change was to change this to point to the backbone SVI IP instead. We have only changed gateways for computers that have static IPs. So it can't be dhcp related. Tracert hangs with empty lines and no pings to the bb svi (192.168.50.1) -i will probably have to make a new question for this
    – shafuq
    Commented Feb 21, 2023 at 11:14
  • 1
    Our recent change was to change this to point to the backbone SVI IP instead - you should make sure that there's no asymmetric routing (one direction via firewall, the other via backbone) as that will screw up stateful inspection. Usually it's best to remove L2 connectivity to the firewall when you point your edge default gateway elsewhere; otherwise beware of ICMP redirects (they may be default for Procurve gear, depending on firmware rev)!
    – Zac67
    Commented Feb 21, 2023 at 11:18
  • I noticed something even more strange! When a client loses connection to the bb svi it normally doesnt ping from either side - meaning from client to bb or bb to client. But if i go under vlan 1 in the backbone and ping from there the dropped connection comes back instantly. This doesn't work from under config directly or the vlan it is a part of (vlan-50). only under vlan1 if i try to ping the connection restores as soon as i hit enter. What could this mean?!
    – shafuq
    Commented Feb 22, 2023 at 7:54
  • 1
    @shafuq You do need to check the MAC connectivity = MAC tables and the logs.
    – Zac67
    Commented Feb 22, 2023 at 8:33
  • I found the problem. It was a loop on one of the edge switches. Once I disconnected the looped interface everything went back to normal. Thanks for all your help!
    – shafuq
    Commented Feb 28, 2023 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.