router ping internet switch doesnt

[mikloarp182]

Hi everyone,

I have a weird issue, I'm seeing my infrastructure, I have a adtran (ISP century Link) goes to my router, the router is able to go to internet, I have my switch c3560 working fine is able to ping segments on vlan 10 ans vlan 20 thorugh the MPLS but no internet, my router isnt able to ping those segments even though i can reach it from other location, router ping internet switch cant, ip default gateway obviosly has been configured but no luck, anyadvice?

[mikloarp182]

Interface config 

interface GigabitEthernet0/0
 description Connection to CL MPLS
 ip address 65.115.x.x 255.255.255.252
 ip verify unicast reverse-path
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly
 no ip route-cache cef
 no ip mroute-cache
 duplex auto
 speed auto
 snmp trap ip verify drop-rate
 no mop enabled
!
interface GigabitEthernet0/0.10
 ip flow ingress
!
interface Service-Engine0/0
 description $FW_INSIDE$
 ip unnumbered GigabitEthernet0/1.100
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 shutdown
 service-module ip address 10.1.32.5 255.255.255.0
 service-module ip default-gateway 10.1.32.1
!
interface GigabitEthernet0/1
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 no mop enabled
!
interface GigabitEthernet0/1.10
 description Data VLAN
 encapsulation dot1Q 10 native
 ip address 172.18.32.1 255.255.252.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 no cdp enable
!
interface GigabitEthernet0/1.100
 description Voice VLAN
 encapsulation dot1Q 100
 ip address 10.1.32.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 no cdp enable
 h323-gateway voip interface
 h323-gateway voip h323-id IV-VOIP-GW
 h323-gateway voip bind srcaddr 10.1.32.

[mikloarp182]

SWITCH INT CONFIG 

interface FastEthernet0/19
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 10
 switchport mode trunk
 switchport voice vlan 100
 spanning-tree portfast

above is the router interfaces config 

I have 0.0.0.0 0.0.0.0 ip_cl_next hop

Like I said I can reach internet from router but not from the switch 

[Dan Miley]

so, I don't see any routes in your configuration.

so the switch has a default gateway pointing to the correct internet router? (Adtran I think).

** and here's the kicker.

and the adtran has routes for the networks behind the L3 switch pointing to the switch interface.

you can test by using an extended ping.

do a ping from the switch, then do another specifying the source address as the vlan interface.

if that does not fix, go into each device and do  

show ip route

follow the packets and the return packets.

hope it helps, 

Dan

[mikloarp182]

Hi Dan,

Thanks for answering on my router I have one static route (adtran)
ip route 0.0.0.0 0.0.0.0 65.115.x.x (adtran interfaces)
 

[Dan Miley]

it sounds like you need  to add routes in your adtran to the vlan networks with the gateway pointing to the switch

You may have to do the same on the router, pointing the vlan networks to the switch.

This should allow the packets to return from the internet.

Attach a topology, and show ip route from all devices if you still need help.

[Dan Miley]

also if you are doing nat in the router, you will need nat statements for the vlan networks behind the switch.

Dan

[mikloarp182]

I forgot tell you

My router ip route static next hop is pointing to atrain in ( I can send ICMP to google for example)

My switch has layer 3 capabilities and I did the same with the router interface as hop to the same and aint worked, but my switch reached other segments through mpls but my router doesnt, and i did the tracerts are going for the same way 

[Dan Miley]

it looks like you need to add some routes in the adtran to allow the packets to get back to the vlan networks behind the layer3 switch.

one route for each vlan.

Dan