I'm having problem for some days trying to make a correct configuration

Right now I have a Cisco Catalyst switch, a Cisco Router 2811 and a VMware ESXi node with 4-8 VM (Linux,BSD, Windows), each one of those are configure to use 802.1q and they are group in 5 vlans .

Next, the Node connect to a Cisco Catalyst 2964 to the Interface port 0/1 with this configuration:

switchport trunk allowed vlan 1-11
switchport mode trunk
switchport nonegottiate

Plus "Interface vlan" for each vlan, at this point the Virtual hosts with ipv4 static address are able to ping to the Switch (Host of vlan 2 can ping Interface Vlan2 of the Switch , etc).

Next I configure the Interface of the switch which will be connect to a Cisco 2811 Router

switchport trunk allowed  vlan 1-11, 99 
switchport mode trunk 
switchport nonegottiate 
switchport mode trunk native 99

In the Cisco 2811 Router I created one dhcpv4 pool for each Vlan (Except 99) and begin to make the work on the interface

interface FastEthernet0/0.1
 encapsulation dot1Q 1 
 ip address
 ipv6 address 2001:DB8:C0CA:1::1/64
interface FastEthernet0/0.2
 encapsulation dot1Q 2
 ip address
 ipv6 address 2001:DB8:C0CA:2::1/64
interface FastEthernet0/0.3
 encapsulation dot1Q 3
 ip address
 ipv6 address 2001:DB8:C0CA:3::1/64
interface FastEthernet0/0.4
 encapsulation dot1Q 4
 ip address
 ipv6 address 2001:DB8:C0CA:4::1/64
interface FastEthernet0/0.5
 encapsulation dot1Q 5
 ip address
 ipv6 address 2001:DB8:C0CA:5::1/64
interface FastEthernet0/0.99
encapsulation dot1Q 99 native
ip address

With this I removed the static IPv4 address and restart the virtual host. To my surprise they have IPv6 address well configured but not IPv4. My next big surprise come when I try to ping the Default Gateway with IPv6 of each host: I can't , but I can ping the remote hosts.

Next, I pick 2 different virtual hosts and put static IPv4 address on them, they can ping their local gateway without problem and even remote nodes, however the DHCP is still failing.

At some point I enable the "debug ip dhcp server packet" I find something very peculiar: All the broadcast messages are getting to the Router Interface fa 0/0.1 ** (and that interface is answering the DHCPOFFER) . With that I remembered another thing: **Before sending a local ping IPv6 check first with NDP using a Multicast message but is no the case when you try to send a remote packet.

At this point, I'm very sure the VMware ESXi has the Vlan well configured, the switch seem to be the same case because the router is able to deliver the "IPv6 Router advertisement" correctly to the virtual host. BUT the router is getting a wrong delivery with Broadcast (and seem) multicast and because that his answer are send in the wrong vlan (or never answer the NDP Neighbour Solicitation).


-- Added 25/03

Something I'm seeing is the next:

The CDP the VMWare ESXi node is getting from the Switch state that the Vlan is 1 and show the ip address range for that vlan. After some test I removed the Vlan1 from the port to the ESXi host and check again the CDP, the new range of IP address now was from the Vlan 2, but the VLAN is still mark as "1" and now the broadcast of the nodes aren't getting to the router.

-- Added 25/03 (Second part)

With the suggestion of @JelmerS this is what VMWare display:

 esxcfg-vswitch -l
Switch Name      Num Ports   Used Ports  Configured Ports  MTU     Uplinks
vSwitch0         128         4           128               1500    vmnic0

  PortGroup Name        VLAN ID  Used Ports  Uplinks
  VM Network            0        0           vmnic0
  Management Network    0        1           vmnic0

Switch Name      Num Ports   Used Ports  Configured Ports  MTU     Uplinks
vSwitch1         128         13          128               1500    vmnic1

  PortGroup Name        VLAN ID  Used Ports  Uplinks
  Vlan5                 5        2           vmnic1
  Vlan4                 4        3           vmnic1
  Vlan2                 2        3           vmnic1
  Vlan3                 3        2           vmnic1

The switch I'm working is the vSwitch1 which has all his nodes separated from the Internet (the other is used for remote connection to the nodes)

  • I try my Ciscos configuration first on the Cisco Packet Tracer and they work well there (That made me spend a good time thinking the VMware ESXi was the cultript). But now I'm not sure where can be the problem. – RFuentess Mar 22 '13 at 17:13
  • The ESXi host is seeing all untagged frames as belonging to VLAN 1. I think you will find that the switch will have a native VLAN of 2 on that trunk now, and is sending all VLAN 2 traffic untagged. Do you have separate port groups configured per VLAN on the ESXi host? – JelmerS Mar 25 '13 at 11:02
  • @JelmerS now I'm confused, the Vmware ESXi is told me the nodes are well configured, but still the broadcast are jus no passed... – RFuentess Mar 25 '13 at 22:55

I would check your configuration in ESX.

A simple way to tell if your ESX config is broken would be to add vlan 99 onto Gi0/1 (towards your host) and set it as the native vlan (like you did towards your router). This will prevent untagged packets from ending up on a vlan that connects to Fa0/1.1 of your router and confirm that your vSwitch config needs examining.

  • But here I'm little confuse because the VMware FAQ say that native vlan isn't support, If I do this will not happen more problems? – RFuentess Mar 25 '13 at 10:03
  • Sorry, but I'm a little lost with this, you are saying that I should add a extra connection from switch to Vmware ESXi host and that one have the native Vlan ID? – RFuentess Mar 25 '13 at 22:44
  • Native vlan is the vlan that untagged packets get put into. If your ESX config doesn't tag an outbound packet, that packet will end up placed into vlan 1 on the Cisco switch. – cpt_fink Mar 26 '13 at 1:05

Since all DHCP requests are coming in over VLAN 1, which is also the default VLAN on the trunk towards the ESXi host, I would guess that ESXi isn't tagging the traffic at all. Make sure each host is connected to a different port group in the vswitch and set each port group to the appropiate tag. Check out this KB from VMware.

As an aside: it is general best practice to not use VLAN 1.

  • Many thanks, the link I had already checked before posting here but after re-reading find I was missing a line for the switch configuration, however this didn't solve my problem. After make the correction my switch have this configuration: switchport trunk allowed vlan 1-11 switchport mode trunk switchport nonegottiate spanning-tree portfast trunk !The missing line About the Vmware ESXi host Vlan's configuration, the "Networking" tab show me the Vland ID are the correct one and even the CDP seem to find the Cisco switch (Though only display the IP address of vlan 1) – RFuentess Mar 25 '13 at 10:02
  • Could you do a Show Mac Address Table on the switch, to see if you have all MAC addresses are in VLAN 1, or if the clients are in their correct VLANs? If they are in VLAN 1, then you can be sure ESXi isn't sending the correct tags, if they are in the right VLANs, the fault is on the Cisco side. – JelmerS Mar 25 '13 at 10:09
  • Okis dookis, many thanks, after seeing the mac addres table I confirm the problem is the ESXi node, as you say all the nodes are listed on the Vlan 1 and only the Router sub-interface are on their correct Vlan. But now I'm very confused because the ESXi Host on the tab "configuration"on the "Networking" area is saying to me that the vlan ID of each Virtuam Machine Portgroup are with the correct vlan ID. – RFuentess Mar 25 '13 at 12:18
  • Can you log into ESXi and run "esxcfg-vswitch -l" to see which portgroup is on which VLAN? See kb.vmware.com/selfservice/microsites/… for more info. – JelmerS Mar 25 '13 at 12:24
  • I edited my original message for display the output of the command but is the same, the ESXi host is saying the nodes are well configured ... – RFuentess Mar 25 '13 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.