Cisco Meraki VLAN creation Issue in MS 250

[Durai]

Hi All,

Good evening.

Recently we have bought MS250 Switch and MX105 firewall.

Here we need to keep all VLANs in MS250 instead of MX105.

In firewall we are keeping default VLAN 1 (192.168.128.0/24).

I have created 5 VLANs in MS250. But its not working.

VLANs are not able to reach firewall.

VLAN Details below.

192.168.10.0/24 Interface IP 192.168.10.1

192.168.12.0/29 Interface IP 192.168.12.1

192.168.12.8/29 Interface IP 192.168.128.9

172.24.100.0/24 Interface IP 172.24.100.1

* InterVLAN communication is not working.

But i have two end points in 192.168.12.5 1 / 92.168.128.6. I am able to access this end points from 192.168.12.1.

Do we need to enable OSPF for interVLAN communication?

Can some one help me to resolve this case since i am new to cisco meraki Environment.

[alemabrahao]

Do you have routes configured on Switch and Firewall?

[alemabrahao]

https://documentation.meraki.com/MS/Layer_3_Switching/MS_Layer_3_Switching_and_Routing

Can you share your MS and MX interfaces and routes configuration?

https://documentation.meraki.com/Architectures_and_Best_Practices/Recommended_Topologies/MX_and_MS_B...

Basically, you need to create a default route in MS pointing to MX as the next hop and routes in MX to the subnets you created in MS pointing to MS IP as the next hop.

[Durai]

Hi Alemabrahao,

Thank you for your response.

MS 250 Routing: 

Default route  0.0.0.0/0  192.168.128.1  No Not preferred

Note : 192.168.128.1 is firewall IP address. (VLAN1 Which is in Firewall)

MX105

Default 0.0.0.0/0 192.168.128.5 always

192.168.128.5 is my switch IP address

Note : Switch is in Stack

[alemabrahao]

Your route on the MX is wrong.

Take a look at this example:

[alemabrahao · Accepted solution]

Just to be clear, the way it's configured in MX you're causing route asymmetry every time packets are forwarded.

What you need to do is create a summary route or specific routes for each subnet.

[Durai]

Hi Alemabrahao,

Thank you for response and solution.

after changing the configuration as per your correction, Its working fine.

But i have one more query from this,

I am able to reach firewall from MS250

Also able to reach MS250 from switch.

But in MS250 switch,

i am not able to reach one VLAN gateway to Another VLAN.

Example:

192.168.10.1 to 192.168.12.1 is not communicating.

192.168.12.1 to 172.24.100.1 is not communicating.

Do we need to enable OSPF for all VLANs.

[alemabrahao]

No, OSPF is not necessary. Do you have any ACL configured?

[Durai]

Hi Alemabrahao,

There is no ACL configured. But when i enable OSPF , i am able to ping the end devices which is connected within VLANs.

[alemabrahao]

Probably you are missing some configuration, I'm pretty sure that OSPF is not a requirement. 😉

It would be ideal to check your settings, but this is not the place to do that.

But remember that although things are a little different with Meraki, the routing concepts are the same, just remember the concepts and apply them in practice and it will work.

[Durai]

I will check it out and let you know.

Thanks for your swift response and making me correct.

let me try 

Have a good day alemabrahao

[alemabrahao]

Some Considerations:

Switch Management IP and Layer 3 Interfaces

The management IP is treated entirely different from the layer 3 routed interfaces and must be a different IP address. It can be placed on a routed or non-routed VLAN (such as the case of a management VLAN independent from client traffic). Traffic using the management IP address to communicate with the Cisco Meraki Cloud Controller will not use the layer 3 routing settings, instead using its configured default gateway. Therefore, it is important that the IP address, VLAN, and default gateway entered for the management/LAN IP still provide connectivity to the internet.

The management interface for a switch (stack) performing L3 routing cannot have a configured gateway of one of its own L3 interfaces

For switch stacks performing L3 routing, ensure that the management IP subnet does not overlap with the subnet of any of it's own configured L3 interfaces. Overlapping subnets on the management IP and L3 interfaces can result in packet loss when pinging or polling (via SNMP) the management IP of stack members.

 

Pings Destined for a Layer 3 Interface

MS Switches with Layer 3 enabled will prioritize forwarding traffic over responding to pings. Because of this, packet loss and/or latency may be observed for pings destined for a Layer 3 interface. In such circumstances, it's recommended to ping another device in a given subnet to determine network stability and reachability.