Involved Products and Versions
All products and versions
Networking
As shown in Figure 1-1, a VRRP group is configured on SwitchA and SwitchB. SwitchA is the VRRP master device and SwitchB is the VRRP backup device. The network segment where the PC resides is 10.0.0.0, and the network segment where the gateway SwitchC resides is 10.36.0.0.
To enable communication between the network segments 10.36.0.0 and 10.0.0.0, a user configures ACL-based packet filtering on SwitchB to allow only the traffic from 10.0.0.0 to 10.36.0.0 to pass. In addition, this rule is applied to the outbound direction of VLAN 322.
Figure 1-1 Networking diagram for the failure of a gateway to ping a PC connected to the VRRP backup device
Fault Symptom
SwitchC fails to ping the PC.
Cause Analysis
1. Check the configuration on SwitchC.
The ACL named Vlan322Out and numbered 3022 allows all traffic from network segment 10.0.0.0 to network segment 10.36.0.0 to pass. Therefore, the PC can ping SwitchC. When SwitchC pings the PC, the traffic from network segment 10.36.0.0 to network segment 10.0.0.0 is not allowed to pass.
#
acl name Vlan322Out 3022
rule 10 permit ip source 10.0.0.0 0.15.255.255 destination 10.36.0.0
0.0.255.255
rule 30 permit ip source 10.36.0.0 0.0.255.255 destination 224.0.0.0
0.0.0.255
rule 40 permit ip source 10.38.0.0 0.0.255.255 destination 10.36.0.0
0.0.255.255
rule 50 permit ip source 10.100.5.0 0.0.0.255 destination 10.36.0.0
0.0.255.255
rule 60 permit ip source 10.100.246.0 0.0.0.255 destination 10.36.0.0
0.0.255.255
rule 1000 deny ip
#
acl number 3144
rule 10 deny tcp destination-port eq 5554
rule 15 deny tcp destination-port eq 9995
rule 20 deny tcp destination-port eq 9996
rule 25 deny udp destination-port eq 445
rule 30 deny udp destination-port eq 1434
rule 35 deny ip source 10.0.0.0 0.255.255.255 destination 99.0.0.0
0.255.255.255
rule 40 permit ip source 10.0.0.0 0.255.255.255 destination 10.0.0.0
0.255.255.255
rule 45 permit ip source 10.36.0.0 0.0.255.255 destination 224.0.0.0
0.0.0.255
rule 1000 deny ip
#
interface GigabitEthernet1/0/7
port link-type access
port default vlan 322
#
traffic-filter vlan 322 inbound acl 3144
traffic-filter vlan 322 outbound acl name Vlan322Out
2. SwitchB connected to the PC is the VRRP backup device, and therefore Layer 2 forwarding is performed. In this case, the ping is successful only when traffic is allowed to pass in both directions. If the PC is connected to the VRRP master device, you only need to configure unidirectional traffic.
Troubleshooting Procedure
Step 1 Add the following rule to the ACL named Vlan322Out and numbered 3022: rule 20 permit ip source 10.36.0.0 0.0.255.255 destination 10.0.0.0 0.255.255.255. Then SwitchC can ping the PC, and the fault is rectified.
----End
