How to connect to 2930F from my Management PC?

[SHtan]

Hello people,

I want to send syslog from the 16P CORE SWITCH (VLAN 300, 192.168.300.10) to a syslog server on VLAN 300, 192.168.300.30. I had configured this and the syslog server is able to receive syslog from the Core switch. 

But I was not able to connect from the MGT PC to the 16P CORE SWITCH. I was not able to

1. ping or ssh the 16P CORE SWITCH IP address from the MGT PC.

2. ping or ssh the MGT PC from the 16P CORE SWITCH.

My question - How to do i connect from the MGT PC to the 16P CORE SWITCH?

I'm using the Sophos FW to perform InterVlan routing, as such I had enabled a rule on Sophos to communicate between VLAN 100 and VLAN 300.

https://i.ibb.co/KDPbd1c/a.png 

[Emil_G]

Hello @SHtan 

Please check if the 16P CORE SWITCH has a correct setting for ip default-gateway or default route. If IP routing is disabled on the 16P CORE SWITCH you should configure ip default-gateway with the IP of the firewall in VLAN 300. If IP routing is enabled you should configure a static default route pointing to the IP of the firewall in VLAN 300. You can use the commands "show ip" and "show ip route" to check this settings.

The MGT PC in VLAN 100 should also have the IP of the firewall in VLAN 100 as default gateway. This is configured either statically or provided by DHCP.

You have used ping, did you test what happens when you use tracert or traceroute from both sides? It should show you which hops the traffic traverses in order to reach the destination and where it breaks.

If it is still not working maybe you can provide the running configuration of the 16P CORE SWITCH (show running-config)

[SHtan · Accepted solution]

Hey Emil_G,

Your solution worked! I set ip default-gateway on the 16P Core Switch and i am now able to ssh in from the MGT PC. 

With the default-gateway set on the 16P Core Switch, another problem cropped up. I'm now not able to ssh into the Management Switch. Putty hangs and never reaches the Management Switch.

On investigation, I've noted the Firewall had blocked the SSH connection because the SSH connection (from the Management PC to the Management Switch) did not have an IN interface with a corresponding OUT interface. 

It seemed strange because SSH connection from the Management PC to the Management Switch works! Moreover, there is an IN interface with a corresponding OUT interface.

Is there some setting in the Management Switch i need to enable? source interface or something? Apologies - this is the first time i'm setting up a network with the 2930F.

[Emil_G]

Hello @SHtan 

Is the topology you attached to your question still valid? That means the MGT PC is connected to the 8P Management switch, on an untagged port in VLAN 100. The 8P Management switch also has 2 connections to the firewall, one for VLAN 300 and another for VLAN 100. Are this 2 physical ports or it is a single physical port with 2 VLANs tagged on it? The connection between the 8P and the 16P switch carries only VLAN 300. Does the 8P Management switch has its management IP in VLAN 300 or in VLAN 100?

If this is still the topology I cannot understand why adding a default gateway on the 16P Core should affect connectivity between the MGT PC and 8P switch. This traffic shouldnt traverse the 16P Core at all no matter if it is switched or routed.

Or do you actually mean that you are trying to SSH from the CLI of the 16P core switch to the 8P management switch and its not working?

[SHtan]

Hello Emil_G,

Yes the topology is still valid.

That means the MGT PC is connected to the 8P Management switch, on an untagged port in VLAN 100. - Correct.

The 8P Management switch also has 2 connections to the firewall, one for VLAN 300 and another for VLAN 100. - Correct

Are this 2 physical ports or it is a single physical port with 2 VLANs tagged on it? - 2 physical ports.

The connection between the 8P and the 16P switch carries only VLAN 300. - Correct

Does the 8P Management switch has its management IP in VLAN 300 or in VLAN 100? - I've set one management IP in each VLAN.

If this is still the topology I cannot understand why adding a default gateway on the 16P Core should affect connectivity between the MGT PC and 8P switch. This traffic shouldnt traverse the 16P Core at all no matter if it is switched or routed.

Or do you actually mean that you are trying to SSH from the CLI of the 16P core switch to the 8P management switch and its not working? - Negative. I am able to ssh from the 16P core switch to the 8P management switch but not able to ssh into the 8p management switch.

I had just tested the following

I have pretty much identical configuration for both the 16P and the 8P.

Removed ethernet connection between 16P and 8P. Now I can SSH into the 8P from my Mgt PC, of course I can't SSH into the 16P any more. 

I've reloaded the SSH keys (via crypto) just in case but nothing is helping.

I shut down everything and then rebooted the two switches. Went for a long walk.

I can now log into both the switches from the MGT PC. I have no idea why this is happening. I'll monitor this for the next couple days.