X590 unable to ping certain host

[msuggs]

Hello, 

i really need some help here. i am replacing a x460 stack with a x590 stack, i cut in new 590 stack but was unable to ping some gear on a subnet. very odd issue here. i have 66 vlans, loaded with traffic, i am using OSPF. PIM  and L2 routing where and how we want network to run. so after cutting to the 590’s i notice my Adtran equipment a DSLAM could not respond to a Adtran Mgmt server in another exchange.

VR-Default    10.100.144.10    20:47:47:7a:82:54    3      NO  Adtran-Mdvl-Mgmt  144   4:6
VR-Default    10.100.144.50    00:a0:c8:7a:05:3e   13      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.51    00:a0:c8:78:47:09    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.60    00:a0:c8:81:56:46    3      NO  Adtran-Mdvl-Mgmt  144   2:20
VR-Default    10.100.144.70    00:a0:c8:7b:ad:f5    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.80    00:a0:c8:7a:02:5c    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.90    00:a0:c8:be:36:7d    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.100   00:a0:c8:d2:c8:40    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.110   00:19:92:e2:1a:d7    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.120   00:19:92:d4:d5:33    3      NO  Adtran-Mdvl-Mgmt  144   2:20
VR-Default    10.100.144.125   00:19:92:f2:6d:08    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.130   00:19:92:eb:f6:c8    3      NO  Adtran-Mdvl-Mgmt  144   2:24
VR-Default    10.100.144.135   00:19:92:eb:ed:6e    3      NO  Adtran-Mdvl-Mgmt  144   2:24
after modifying iproutes etc and trouble shooting, the end results is the cabinet with address 10.100.145.10 can’t ping 10.100.144.50.. very odd here that i can ping other host on 10.100.144.xx it is like the 10.100.144.50 was blacklisted. we dont have any ACL’s or any black list. when i cut back to the 460’s all traffic was fine. Ipforwarding is enabled globally. i worked at this pretty hard before cutting back to the 460’s. it makes no sense to me that the 590’s would not route the specific host address.  i just so happen to cut in another set of 590’s. there  i had to change my iproute from a mgmt subnet to a first hop subnet.. very odd. i also tried changing the route on this config and did not help any. i even just removed iprouting and went OSPF.

Adtran-NWAG-MGMT 145  10.100.145.1   /24  -f-------o-----------------

Adtran-Mdvl-Mgmt 144  10.100.144.1   /24  -f-------------

Meadville-8810.3 # sh iproute 10.100.145.0/24
Ori  Destination        Gateway         Mtr  Flags         VLAN       Duration
#oa  10.100.145.0/24    192.168.252.2   4    UG-D---um--f- Video-10Gig 14d:5h:23m:40s

in my network i have a 8806, 8810, 4 -460stacks.,, and a 590 stack all in a EAPS 10G ring.

590 sh switch

Primary ver:      31.1.1.3                     31.1.1.3
                  patch1-1                     patch1-1

8810 sh switch 

Primary ver:      16.2.5.4                     16.2.5.4
                  patch1-29                    patch1-29

460 sh switch

Primary ver:      22.7.3.5                     22.7.3.5
 

i have setup a LAB environment to duplicate the issue, from the ADTRAN to a PC sitting on a similar subnet i can ping the GW but not a PC.

MDVLHST-F01#ping 10.100.123.1
Pinging 10.100.123.1 (10.100.123.1):
Press ^C to Cancel
Reply from 10.100.123.1 (10.100.123.1): time=7ms
Reply from 10.100.123.1 (10.100.123.1): time=7ms
Reply from 10.100.123.1 (10.100.123.1): time=8ms
Reply from 10.100.123.1 (10.100.123.1): time=6ms

Ping statistics for 10.100.123.1 (10.100.123.1):
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 6ms, Maximum = 8ms, Average = 7ms
MDVLHST-F01#ping 10.100.123.2
Pinging 10.100.123.2 (10.100.123.2):
Press ^C to Cancel
Request timed out.
Request timed out.
Request timed out.
 

[AlexanderJ]

The other obvious thing is to check to see if the server is plugged in, and that it has an IP address, you are pinging the correct IP address and that there are no communication breakdowns between the server you are pinging, and yourself.To check the IP address of the server, go to Start > Run > CMD > ipconfig, and scroll through the IP addresses presented there and try each one, one by one.

CredibleBH

[msuggs · Accepted solution]

it turns out ,, i had the firewall disabled for private, but did not firewall disabled for Domain, the Domain would not allow ping across subnets. i still have a network issue, or atleast night of cut, i was trying reproduce the issue. seems i will just have to place the 590’s in service, if issue persist. and is same issue as before, i will engage TAC. thanks for chiming in, BTW, google solved this for me, sorta.. found others   not pinging across subnets.. using all kinds of equipment. 

[msuggs]

i opened a case with TAC will update when a solution is acquired. 

[msuggs]

i did have 2 interface, ethernet and wifi, i disabled wifi with no change, i had already added routes to go out IF 10.100.123.1 and i had enabled ICMP in firewall and turned off firewall on private IF.

still not able to ping from 8810 subnet 10.100.144.1 but i can ping PC from x590 10.100.123.1 

PC is 10.100.123.3,, what about this ACL, found on the HUB to do a synchronize. was talking about a 8800 product, but thought these 590’s stack could be a issue,

* Slot-1 X590.18 # synchronize
Do you want to save configuration changes to currently selected configuration
file (primary.cfg)? (y or n) Yes
Saving configuration primary.cfg  on master .. done!
Synchronizing configuration to backup ... done!
after sync still no ping from 8810. but i also see i have a ACL. must be default to config. not been able to remove. could this be a issue?

configure access-list zone SYSTEM application Mrp application-priority 2
configure access-list zone SYSTEM application IpSecurity application-priority 3
configure access-list zone SYSTEM application FIPSnooping application-priority 4
configure access-list zone SYSTEM application Dot1Ag application-priority 5
configure access-list zone SYSTEM application Dot1AgDefault application-priority 6
configure access-list zone SYSTEM application NetLogin application-priority 7
configure access-list zone SYSTEM application FDB application-priority 8
configure access-list zone SYSTEM application HealthCheckLAG application-priority 9
configure access-list zone SYSTEM application IdentityManager application-priority 10
configure access-list zone SYSTEM application VMTracking application-priority 11
configure access-list zone SYSTEM application PolicyManager application-priority 12
configure access-list zone SYSTEM application Policy application-priority 13
configure access-list zone SYSTEM application L2PT_PF application-priority 14