200E - Setting up a port to plug into a vSwitch port for isolated management

Question

remote firewall config[ul]config system settings   set allow-subnet-overlap enable[/ul]vSwitch config[ul]interface-address: 10.1.2.1/29member ports:  2, 3, 4, 5[/ul]Port 6 config[ul]plugged into port 2 (vswitch)type: LANinterface-address:  10.1.2.3services-checked:  ping, ssh, http, https[/ul]  I can ping 10.1.2.1 and 10.1.2.3 from the CLI on the remote firewall.  I can ping 10.1.2.1 from the local firewall CLI but cannot ping 10.1.2.3.  Is the problem related to 10.1.2.3 not having a default gateway pointed to 10.1.2.1? My routing encompasses 10.1.2.3 on the 10.1.2.0/29 network so I'm not sure what's wrong.  Any assistance would be appreciated. Ultimately, I'm trying to set up a dedicated 'management port' without using the OOB Management-named port.  If I'm going about this the wrong way, please let me know. Thanks!

thepip3r · Answer

In an effort to make this a little bit more clear, I'm trying to set up an isolated management interface (not the OOB Management interface) on a 'management' network.

With a physical layout, this does work:

[ul]

Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port on the physical switch

Port2 (Black Network Gateway), ping, 192.168.0.1/29, plugged into a port on the physical switch

Admin Laptop, 192.168.0.3/29, plugged into a port on the physical switch[/ul]

From the admin laptop, I can ping both 0.1 and 0.2 and https into 0.2.

With a virtual layout, it does not work:

[ul]

Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port2 on the virtual switch

Port2 + Port3 (joined as a vSwitch), ping, 192.168.0.1/29

Admin Laptop, 192.168.0.3/29, plugged into port3 on the virtual switch[/ul]

From the firewall CLI, I can ping 192.168.0.2. Even if I change to 'exec ping-options source 192.168.0.1', I can still ping 192.168.0.2.

From the laptop, I can ping 192.168.0.1 but I cannot ping 192.168.0.2. If I put a network tap between the laptop and port3, I can see the workstation ARP for the MAC of 192.168.0.2 but it doesn't get a response.

I thought maybe the interfaces didn't use AutoSense technology, so the cable that connects Port1 to Port2, I replaced with a crossover cable and even though the firewall still showed the port as green and I could still ping 192.168.0.2 from the CLI, I could not ping from the workstation.

It's almost as if the vSwitch isn't maintaining a MAC Address table... can anyone provide any insight into this?

TIA!

Sign up

Login with SSO

Login to the community

Login with SSO