Can't ping VLAN 1 from VLAN 10, please help

[Sysxp]

Hello!

I have an ESXi host with dvSwitch and two dvPortGroups:

1. Prod (VLAN type set to "none"). 192.168.255.0/24

2. VLAN10 (VLAN type set to VLAN 10). 192.168.100.0/24

vmk0 Management of the ESXi is connected to VLAN10. (IP 192.168.100.3)

vCenter is connected to Prod (no VLAN). (IP 192.168.255.199)

Everything is connected to L3 Cisco stacked switch with VLAN1 (int 192.168.255.250) and VLAN10 (int 192.168.100.254).

I can perfecly ping the ESXi from vcenter (no VLAN 192.168.255.199 ->> VLAN10 192.168.100.3) or any PC - it works just fine. But when I'm trying to ping the vCenter from an ESXi (VLAN10 192.168.100.3 ->> no vlan 192.168.255.199) - it is not working. In fact I can't ping anything, but my VLAN10 cisco GW, so I can ping 192.168.100.254 and nothing else. Can you please advice why this is happening and how to fix it? I really need to be able to ping everyting from VLAN10->> no vlan.

BIG thanks in advance!

[Kinnison · Accepted solution]

Hi,

Polite guessing, Incorrect network settings, rules related to a firewall or ACL.
You've tried pinging the IP address you set up as the gateway of the other VLAN, which if that doesn't work either somewhere you haven't set things up properly.

Regards,
Ferdinando

[Sysxp]

Even impolite guessing is totally OK, I'm stuck and really need to fix this. 🙂

Network settings are probably fine, because they are as simple as possible. No ACL involved, also no firewall.

I can ping GW and VMs in VLAN 20 no problem (gw for VLAN20 192.168.120.254) and vice versa.

I can also ping 2 mikrotik routers in VLAN1 but nothing else, PCs and VMs are not responding.

Maybe there is a way to remove the vlan tag from the packets if the destination is in Vlan 1? Not sure how to do it.

[Kinnison]

Hi,

Stop for a moment,

You talked about VLAN 1 and VLAN 10, now introduce VLAN 20, about a stack made by CISCO Layer 3 machines and then you talk about "Router" MicroTik.
Somewhere you used wrong settings, if they are not the ESXi HOSTs, virtual machines or singer company, review the settings of your network devices, starting with those that deal with routing between VLANs (and all the rest).

Regards,
Ferdinando

[Sysxp]

VLAN 20 is for vMotion traffic, does not leave the blade cage. 

Here are all the vlans in cisco:

Both the vCenter VM and ESXi ping traffic does not leave the blade cage, everything is up to cisco this ESXi is plugged into. My guess is that it is somehow connected with "Native VLAN". Ping between Vlan10 <<->> Vlan20 work fine. But ping between Vlan1 and Vlan10 only works from Vlan1=>>vLan10. No complicated settings involved, and it 'should' work, but it does not.

[Sysxp · Accepted solution]

I found why it was not working as it should on a Cisco forum - someone had the exact same problem. And the issue is: the default GW for the PCs or VMs in Vlan1 must be the ip of the cisco router that does all Vlan routing (in my case 192.168.255.250). After setting the correct GW everything begin to work as intended.

Thank you Kinnison! Your initial assumption about incorrect network settings was somewhat right. 🙂

[Kinnison]

Hi,

I just read your reply, let me get this straight,

In practice, in the context of your network infrastructure you have more than one object that acts as a "router" both between different IP networks living on different VLANs and also within the context of the same IP network. If no one tells it or instructs it to look for them, a router doesn't know (and doesn't even care) that there were also others referred to as gateway by your devices located on the so-called "VLAN 1", That's why I asked "what you do" with those MicroTik "Router" objects.

I also see that you have set up a network dedicated to the vMotion service, is there any specific reason why you decided to make it "routable" and which TCP/IP stack you used to set it up, usually when you configure an IP network dedicated to the vMotion service there is no many reason to make it accessible "to the world" (I mean to every other IP network) and usually many also tends to use its dedicated TCP/IP stack.

Regards,
Ferdinando

[Sysxp]

"Should work" I meant if we have 3 Vlans with ip interfaces on them and L3 cisco with ip routing 'on' they should 'see' each other no problem. I had Vlan20 trunked outside of the cage solely for testing purposes - to find WHY the blasted Vlan1 is not working properly.

I have multi-nic vMotion with 4 vmk in VLan20, once I remove this vlan from trunk ports this traffic will not leave the bladecage.

Thank you for your help!

[Kinnison]

Hi,

Of course routing in the context of your CISCO stack works fine since you have it enabled, but you didn't tell me that your devices on VLAN 1 used a different router as their gateway, set up I don't know how. However what matters is that you have solved the problem, everything else matters little. 😀

Good things,
Ferdinando