0

When I configure an ip address on a vlan interface from another vlan subnet, I can reach that other vlan subnet. But it should not be reachable.

For example:

  • On the switch, the port is configured as tagged with vlan id 500 only
  • On the Linux box the interface eth0.500 with ip address 192.168.10.30/24 can ping hosts in subnet 192.168.10.0/24, but those hosts are in vlan 3000

I can't figure out what I'm doing wrong. Can you help me troubleshoot this, please?

There is an error on the Linux box:

kernel: received packet on eth0.3000 with own address as source address (addr: f4:03:43:ba:ca:c1 vlan:0)

STP is disabled on both the switch and the Linux box.

What I've tried:

  • rp_filter=1 - no effect
  • arp_ignore=1 or 2 - no effect
  • arp_filter=1 - no effect

It doesn't matter if it's a normal interface or bond or bridge, the behavior is the same.

There is no errors on the Switch.

No default route is set both on the switch and the Linux box.

In Wireshark when capturing traffic on eth0 there is a vlan tag = 500 on the packets.

Thank you!

EDIT 1: Routing table on Linux box:

192.168.10.0/24 dev eth0.500 proto kernel scope link src 192.168.10.30

EDIT 2: Diagram diag1

EDIT 3: tracepath and ping

tracepath 192.168.10.31
1?: [LOCALHOST]  pmtu 1500
1:  ??? 0.714ms !H
1:  ??? 0.516ms !H
    Resume: pmtu 1500

ping -c 2 192.168.10.31
PING 192.168.10.31 (192.168.10.31) 56(84) bytes of data.
64 bytes from 192.168.10.31: icmp_seq=1 ttl=64 time=0.230 ms
64 bytes from 192.168.10.31: icmp_seq=2 ttl=64 time=0.197 ms

--- 192.168.10.31 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1059ms

rtt min/avg/max/mdev = 0.197/0.213/0.230/0.016 ms

EDIT 4: ip addresses

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether f4:03:43:ba:ca:c1 brd ff:ff:ff:ff:ff:ff
3: eth0.500@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether f4:03:43:ba:ca:c1 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.30/24 scope global eth0.500@eth0
       valid_lft forever preferred_lft forever
4: eth0.3000@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether f4:03:43:ba:ca:c1 brd ff:ff:ff:ff:ff:ff
14
  • Are the packages routed somewhere else? Nov 22, 2021 at 11:38
  • Can you add the routing table?
    – eKKiM
    Nov 22, 2021 at 11:50
  • Default route not set on Linux box, and no additional routes as well. The Switch is Mellanox SN2010M, on this switch routing is enabled, but only management interface in use, even no ip addresses on VLAN interfaces. Can it be Cisco ASA with same-security-traffic permit intra-interface enabled?
    – jsplat_
    Nov 22, 2021 at 11:52
  • @eKKiM added at the end of post
    – jsplat_
    Nov 22, 2021 at 11:56
  • 1
    @vidarlo the problem is that i can reach other hosts in different vlan with same subnet, so i can configure ip address from subnet in vlan 3000 on interface with vlan 500 and reach subnet in vlan 3000. tracepath at the end.
    – jsplat_
    Nov 22, 2021 at 12:18

0

You must log in to answer this question.

Browse other questions tagged .