2

Is there something new that I do not know about with newer Cisco gear. In order to manage my switch I usually have to assign a VLAN 1 interface and add a default route (or ip default-gateway) to access other subnets.

I plugged this switch in and simply gave it a VLAN 1 IP address (10.0.0.50 255.255.255.0) and I can magically reach things out side of my subnet.

This is a cheap 2960:

EDIT, The config is as follows:

switch1#sh run
Building configuration...

Current configuration : 6835 bytes
!
! Last configuration change at 18:00:35 EST Wed Aug 21 2013 by user
! NVRAM config last updated at 18:01:23 EST Wed Aug 21 2013 by user
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname switch1
!
boot-start-marker
boot-end-marker
!
logging buffered 65536
enable secret 5 OMIT
!
username OMIT privilege 15 secret 5 OMIT
!
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authorization commands 15 default group tacacs+ none
aaa accounting commands 15 default stop-only group tacacs+
!
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EST recurring
switch 1 provision ws-c2960s-48ts-l
!
!
no ip domain-lookup
ip domain-name nope.com.net.org
vtp mode off
!
!
!
!
spanning-tree mode rapid-pvst
spanning-tree portfast bpduguard default
spanning-tree extend system-id
spanning-tree vlan 1-4094 priority 61440
!
!
!
!
vlan internal allocation policy ascending
!
ip ssh version 2
!
!
interface FastEthernet0
 no ip address
!
interface GigabitEthernet1/0/1
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/2
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/3
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/4
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/5
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/6
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/7
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/8
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/9
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/10
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/11
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/12
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/13
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/14
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/15
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/16
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/17
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/18
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/19
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/20
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/21
 switchport mode access
 no cdp enable
!
interface GigabitEthernet1/0/22
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/23
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/24
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/25
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/26
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/27
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/28
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/29
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/30
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/31
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/32
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/33
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/34
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/35
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/36
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/37
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/38
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/39
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/40
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/41
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/42
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/43
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/44
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/45
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/46
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/47
 switchport mode access
 shutdown
 no cdp enable
!
interface GigabitEthernet1/0/48
 description trunk to switch2-Gi1/0/48
 switchport mode trunk
!
interface GigabitEthernet1/0/49
 shutdown
!
interface GigabitEthernet1/0/50
 shutdown
!
interface GigabitEthernet1/0/51
 shutdown
!
interface GigabitEthernet1/0/52
 description trunk to switch3-1/45
 switchport mode trunk
!
interface Vlan1
 ip address 10.191.2.61 255.255.255.0
!
no ip http server
no ip http secure-server
logging source-interface Vlan1
logging 10.191.4.65
snmp-server community NOPE RO 3
snmp-server community NOPE RO 23
snmp-server trap-source Vlan1
snmp-server contact NOPE
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server enable traps config
snmp-server enable traps envmon fan shutdown supply temperature status
snmp ifmib ifindex persist
tacacs-server host 10.191.5.102
tacacs-server directed-request
tacacs-server key 7 NOPE
!
line con 0
 session-timeout 120
 privilege level 15
 password 7 NOPE
 logging synchronous
 transport output none
 stopbits 1
line vty 0 4
 session-timeout 120
 privilege level 15
 password 7 NOPE
 logging synchronous
 transport input ssh
line vty 5 15
 session-timeout 120
 privilege level 15
 password 7 NOPE
 logging synchronous
 transport input ssh
!
ntp clock-period 22518669
ntp source Vlan1
ntp server 10.191.4.39
end

An example of a ping out of subnet:

           ping 10.191.4.39

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.191.4.39, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/6 ms
5
  • Reach other subnets from where? On a workstation plugged into the switch? Sounds like you are simply using it as a Layer 2 switch with a management IP.
    – TheCleaner
    Aug 21, 2013 at 13:40
  • no from the switch itself. When logged into the switch I can ping hosts from other subnets. I can also reach the TACACS+ server, syslog server, and NTP server all which reside on other subnets
    – oooooo3333
    Aug 21, 2013 at 14:01
  • 4
    what is the output of sh ip route?
    – longneck
    Aug 21, 2013 at 14:11
  • Not a command. It is not a layer3 switch.
    – oooooo3333
    Aug 21, 2013 at 17:49
  • Can you post the config?
    – GerryEgan
    Aug 22, 2013 at 8:36

2 Answers 2

1

A router attached to one of the switch's active interfaces is probably performing Proxy ARP. Lacking a routing configuration, your switch is broadcasting an ARP request for 10.191.4.39. That address isn't on the local segment, but your router knows how to reach it. The router running Proxy ARP replies to the switch to say, "I can reach that for you; send packets for that address to me." You can confirm this by examining the configuration on the router.

1
  • A device doesn't ARP for ip addresses not in it's own subnet, it ARPs for it's DG. A device without a DG should do nothing when attempting to ping a device outside of it's own subnet.
    – joeqwerty
    Aug 23, 2013 at 19:31
1

tl;dr: Cisco switch sending out ARP requests for hosts in other subnets, Cisco router having proxy ARP enabled by default.

I know I'm late to the party, but I recently stumbled upon that problem, did some research, and found this question in the process. The first answer is actually correct. Unfortunately I don't have enough reputation to add a comment, so I have to add my own answer.

I used a Cisco WS-C2960G-8TC-L switch running IOS 12.2(35r)SE2 and a Cisco 1812W router running IOS 12.4(15)T6 to reproduce and investigate the problem.

The relevant part of the router configuration is (remaining configuration is default):

interface FastEthernet0
 ip address 10.1.1.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet1
 ip address 10.1.2.2 255.255.255.0
 duplex auto
 speed auto

Fa0 is connected to the switch, Fa1 to a computer. Both devices are configured with other IP addresses in the respective subnet. The computer has a routing table entry to the Fa0 network via the router (10.1.1.0/24 via 10.1.2.2 dev eth1). The relevant part of the switch configuration is:

interface Vlan1
 ip address 10.1.1.1 255.255.255.0
 no ip route-cache

The remaining configuration is default, i.e. all ports in VLAN 1 and no default gateway. Also:

Switch#sh ip default-gateway
0.0.0.0

Now I try to ping the computer from the switch:

Switch#ping 10.1.2.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.2.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms
Switch#sh ip arp
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  10.1.2.1               25   0021.d8c8.6b36  ARPA   Vlan1
Internet  10.1.1.2               33   0021.d8c8.6b36  ARPA   Vlan1
Internet  10.1.1.1                -   0022.0cea.1540  ARPA   Vlan1

Using Wireshark I confirmed that the switch is indeed sending out an ARP request for the computer's IP address even though it is in another subnet. It then gets an ARP reply for the IP address from the router and thus sends all packets destined for the computer's IP address to the router which then forwards the packet.

This works because Cisco routers have proxy ARP enabled by default:

The interface of the Cisco must be configured to accept and respond to proxy ARP. This is enabled by default.

(http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html)

Also:

Router#sh ip int fa0
FastEthernet0 is up, line protocol is up
  Internet address is 10.1.1.2/24
  [...]
  Proxy ARP is enabled
  [...]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .