Procurve 5412zl - unable to traceroute to direct attached devices

[DG48067]

I have a ProCurve 5412zl with an IP address of 192.168.1.1 and there are certain devices that are up and running fine - 192.168.1.2 is a Cisco PIX, for example.

Devices on the 192.168.1.x subnet can access and use the PIX at that address. Upon adding a VLAN and new subnet, it has been discovered that other subnets cannot access this device. Long story short: performing a traceroute from *inside* the 192.168.1.1 switch fails to 192.168.250.2 (which is directly attached). To further complicate the issue, this same switch is able to ping the device successfully. How can ping complete successfully if the switch doesn't even know how to traceroute to a direct-attached device in the same subnet and vlan?

To further complicate the issue, other devices in the 192.168.1.x subnet are able to access the PIX at 192.168.1.2. I had another device in a similar situation and I was able to fix the issue by unplugging it and moving it to a different port but this did not work for the PIX.

I have spent the last two months figuring this out. I can't reboot the switch without a ton of planning because iSCSI is running through the switch for a lot of servers (I inherited this situation - not my design).

Any insight can be payed for out of pocket - I am that frustrated.

[Shadow13]

Have you enabled routing on the switch ??

Because these are 2 different VLANS and 2 different subnets so for sure you will not be able to comunicate between them unless there is a device handling routing between them, so in this case you can just enable routing on the switch by issuing the command
#ip routing

Also make sure ro assing an ip address under the 2nd VLAN if not already assigned.

Then test the connectivity :)

Regards

[DG48067]

Yes, routing is enabled. I actually had two DNS servers - one at 192.168.1.5 and one at .6. Both were ping-able but I could only traceroute to one (from inside the switch that hosts them). I was able to resolve that problem by plugging the impacted device into another port (and then plugging it back into the old port once the switch picked it up).

[Shadow13]

did you configure a route in the PIX pointing to the other vlan ? if not then you should do that...

Contact Cisco Support and check this with them plz and let us know

[DG48067]

I'd first like to get the PIX to traceroute from inside the switch that it is connected to. At this point, if it does not respond to the other VLAN, then I will worry about routes. But, as it sits, my problem is that I cannot traceroute to a PIX at 192.168.1.2 from the switch at 192.168.1.1 even though devices in the subnet are using it in production right now.

This is my problem.

[Shadow13]

how will you traceroute when the PIX does not have a route to send the packets back to that subnet ?? since the PIX is reachable on the same subnet, and since the intervlan routing is working fine between the 2 vlans then it's the PIX issue not the switch.

[Shadow13]

regarding the trace on the same vlan. what to trace ?? since they are on the same vlan the packet will be switched not routed