poststandard wrote:
Jon,
OK you are right, as far as VLAN 11, the active is the 10.10.x.2 address and the standby is the 10.10.x.3.
What I don't understand is why does 10.10.x.2 ping with no problem with the same access list, but not the 10.10.x3?
You said: "If you want to test the ping from your host you will need to modify the acl and add a line in for just that"
Can you provide an example of what that line should look like?
I appreciate your help.
Forgot to mention from your last post, don't use same priority on each router. Use 110 on the want you want active and 100 on the one you want standby. The priority is used to work out which router will be active, the highest number becomes the active router.
What I don't understand is why does 10.10.x.2 ping with no problem with the same access list, but not the 10.10.x3?
Okay i'll try and explain. An access-list applied inbound to a L3 vlan interface controls traffic that comes from clients on that vlan. So in your example the acl is applied to traffic coming from vlan 11 clients. You are pinging from a client not on that vlan. So the packet arrives at the L3 switch from a different vlan. The packet is then forwarded to the L3 SVI for vlan 11 on the same switch. So this one will respond to ping because the packet has not come from vlan 11 but from some other vlan.
So your client = 172.x.x.x
4500_1 is the switch that your clients traffic arrrives on. 4500_1 L3 SVI for vlan 11 is 10.10.x.2.
4500_2 is the switch that is connected to 4500_1 via a L2 trunk. 4500_2 L3 SVI for vlan 11 is 10.10.x.3.
So you ping 10.10.x.2 from your client. The packet arrives at 4500_1 and goes to the vlan 11 interface. However note that the packet did not arrive at the vlan 11 interface from vlan 11. The packet actually came from another vlan ie. your clients vlan. So access-list 114 was not checked.
When you ping 10.10.x.3 the packet again arrives on 4500_1 and this time the packet is routed onto vlan 11 and switched across the trunk link. Now the packet is actually coming from vlan 11 because 4500_1 placed it into vlan 11 so acl 114 now comes into play and denies the ping.
Like i said it's because of the virtualisation of the interfaces on a L3 switch that things can get a bit confusing.
The acl line would look something like
access-list 114 permit icmp host <172.x.x.x> host 10.10.x.2 echo-request
access-list 114 permit icmp host <172.x.x.x> host 10.10.x.3 echo-request
but note that you would have to redo the acl unless it is numbered and these lines need to go straight after the top 4.
Jon
