ip forwarding issue

[Marlon]

we have summit x460 configured with 3 vlans. ipforwarding is disabled to all vlans but were still able to ping from one vlan to another. please see below the screenshot

we also have pc directly connected to vlan server and still can reached the other vlans even the ipforwarding is disabled. below is the screenshot

below are the iproutes from switch

is this correct? I am expecting if ipforwarding is disable vlan will not communicate with each other like layer 2.

thanks

[Marlon]

just the vlan interface

[JeremyClarkson]

but can you ping clients on the VLAN or just the VLAN interface?

[Marlon]

Hi Jeremy,

I can still ping the other vlan even the ipforwarding is disable globally and per vlan. thanks

[Matthew_Helm]

Without ipforwarding enabled, a switch will receive a packet on a VLAN interface and will respond if the packet is directed to an IP address assigned to one of its VLAN interfaces where that VLAN is enabled and up (either in loopback mode or has active port(s)). It will not forward that packet to another IP address on that subnet/VLAN even if present in the switch's IP ARP table. It will only forward if IP forwarding is enabled on both the receiving VLAN and enabled on the VLAN where the destination IP address is located.

[Mike_Lane]

Your input is almost complete, please show your PC's routing and arp tables to demonstrate that the PC is actually using this switch as its gateway.. I see you have successfully pinged an address for a VLAN that has no active ports in it. I expect this can only happen if there is another switch on your broadcast domain that is forwarding, You can also provide a "show ipstats" to prove that this switch was actually forwarding. - Mike