tl;dr: Tried setting up an untagged vlan with router interface, client can't reach switch, and definitely can't reach upstream firewall. Routing table suggests that everything should be fine... I think?
Hi everyone, thanks for the wealth of knowledge in this thread (especially to fohdeesha for the detailed documentation!). I'm running into what I think is a basic problem with a new (to me) ICX7250-48P, and I hope someone may have some advice.
I'd like the ICX7250 to be the "core" router for my home network (all inter-vlan routing happening on the switch), with traffic to the internet going out an OpnSense firewall. My complete running config is
here; here are what I think are the relevant parts:
First, define vlan 10 and corresponding router interface ve 10 (with IP 192.168.10.1/24), and plug a computer into port eth1/1/1:
Code:
vlan 10 by port
untagged ethe 1/1/1
router-interface ve 10
spanning-tree 802-1w
!
interface ve 10
ip address 192.168.10.1 255.255.255.0
Next, define vlan 253 and corresponding router interface ve 253 (with IP 192.168.253.1/24), and plug the LAN port of the OpnSense box into port eth 1/1/48:
Code:
vlan 253 by port
untagged ethe 1/1/48
router-interface ve 253
spanning-tree 802-1w
!
interface ve 253
ip address 192.168.253.1 255.255.255.0
Set the default route to towards the OpnSense box, whose LAN interface has a static IP of 192.168.253.10:
Code:
ip dns server-address 192.168.253.10
ip route 0.0.0.0/0 192.168.253.10
And finally, because a search suggested that OpnSense doesn't like being a DHCP server for subnets that aren't directly attached, use the DHCP server on the router:
Code:
ip dhcp-server enable
!
ip dhcp-server pool vlan10_corenet_pool
excluded-address 192.168.10.1 192.168.10.19
excluded-address 192.168.10.250 192.168.10.254
lease 1 0 0
network 192.168.10.0 255.255.255.0
option 3 ip 192.168.10.1
option 6 ip 192.168.253.10
option 15 ascii corenet.home.my-domain-redacted.com
deploy
As far as I can tell (from reading documentation and watching a few YouTube videos), this should work. And I have evidence that I'm on the right track: the VE's are up when I connect a PC to eth1/1/1 and the OpnSense box to eth1/1/48:
Code:
sw1#sh ip int
Interface IP-Address OK? Method Status Protocol VRF
Ve 1 192.168.1.1 YES manual down down default-vrf
Ve 253 192.168.253.1 YES manual up up default-vrf
Ve 10 192.168.10.1 YES manual up up default-vrf
The routing table looks as I'd expect it to:
Code:
sw1#sh ip route
Total number of IP routes: 3
Destination Gateway Port Cost Type Uptime
1 0.0.0.0/0 192.168.253.10 ve 253 1/1 S 46m43s
2 192.168.10.0/24 DIRECT ve 10 0/0 D 4m57s
3 192.168.253.0/24 DIRECT ve 253 0/0 D 46m44s
I also know that I can reach the internet from the switch (running traceroute 8.8.8.8 on the serial console works as expected).
However, the PC connected to eth1/1/1 is not having a good time. Wireshark confirms that my PC is sending out a DHCP Discover, and the switch assigns an IP:
Code:
sw1#sh ip dhcp-server binding
Bindings from all pools:
IP Address Client-ID/ Lease expiration Type
Hardware address
192.168.10.20 2cf0.5d7f.cc03 000d:23h:59m:41s Automatic
The log shows that we never heard back from the PC (`No ARP-PING reply from client 192.168.10.20`). Okay, that's fine, I can assign that as a static IP on the interface on my PC. I'm still not able to ping the the router interface IP (192.168.10.1) even though it's set as the default gateway and my PC's routing table confirms that the default route is correct.
Does anyone happen to have any hints about getting past this?
