Use of default gateway on switch

hi,
there is option to specify default gateway on switch.
what is the purpose of it?
Regards
skrao

Hi,
Layer 2 switches have to be configured like IP hosts, which are not capable of routing. In the same manner that you assign default gateways to hosts, you need to assign a default gateway to such a L2 switch so that management traffic from the switch can be routed to the gateway router.
Pls do remember to rate posts.
Paresh

Similar Messages

Management port for management switch(2960x) / IP default-gateway for L2 management switch

1)
I am going to connect all mgmt ports of server to this access switch (L2; 2960x) like below. Then I have a management port in 2960x (FastEthernet / L3 port). As you can see below, even though one of Core switch is down, I am able to access through the other Core switch for mgmt SW. Do I need this FastEthernet port of 2960X?
Core Pri ------- Core Sec   (Core Pri 192.168.1.2 / Sec 192.168.1.3 / HSRP VIP 192.168.1.1)
            mgmt SW ----- (FastEthernet0) ------ Goes to where? I don't have RAS (Remote Access Server)
                  |
                  |
      servers' mgmt ports
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swint.html#wp2220949
2) From server side, server put default gateway (192.168.0.1) so if destination is not known, it dumps all to default gateway. This is L3. I understand this. What about L2 default gateway from switch itself? The L2 access switch supports "ip default-gateway" command. I know that without this command still servers do not have any problems to connect to network. Then this command is for switch (2960x) itself? i.e I log into the switch and ping google.com then switch will try to resolve through DNS, but if DNS is not set up in the switch, it sends all traffic to "ip default-gateway"? Is it right?
3) If L2 (Access) switch has multiple data vlans and mgmt vlan (10.0.0.0/24 10.0.10.0/24 192.168.0.1). Then what will be the "ip default-gateway" for this switch?
Thanks for your time and knowledge.
======================== Reference from Cisco regarding ip default-gateway --------------------------------------
How to configure the ip default-gateway command on a Cisco 3550 series switch
VERSION 2
Resolution
To define a default gateway when IP routing is disabled, issue the ip default-gateway global configuration command. Then, enter the IP address of the next-hop router interface that is directly connected to the switch where a default gateway is being configured.
The default gateway receives IP packets with unresolved destination IP addresses from the switch. Once the default gateway is configured, the switch has connectivity to the remote networks with which a host needs to communicate.
Note: When the switch is configured to route with IP, it does not need to have a default gateway set.
For more information, refer to Assigning the Switch IP Address and Default Gateway.
ip default-gateway
https://supportforums.cisco.com/docs/DOC-5090

Vlan 99 is management port. This is an access switch. I am accessing this swtich through SSH remotely (10.1.2.x)
WirelessSWLab#sh ip int b
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  unassigned      YES NVRAM administratively down down
Vlan99                 10.1.99.35      YES manual up                    up
GigabitEthernet0/1     unassigned      YES unset up                    up
GigabitEthernet0/2     unassigned      YES unset down                  down
GigabitEthernet0/3     unassigned      YES unset down                  down
GigabitEthernet0/4     unassigned      YES unset down                  down
GigabitEthernet0/5     unassigned      YES unset down                  down
GigabitEthernet0/6     unassigned      YES unset down                  down
GigabitEthernet0/7     unassigned      YES unset down                  down
GigabitEthernet0/8     unassigned      YES unset down                  down
GigabitEthernet0/9     unassigned      YES unset down                  down
GigabitEthernet0/10    unassigned      YES unset down                  down
GigabitEthernet0/11    unassigned      YES unset down                  down
GigabitEthernet0/12    unassigned      YES unset down                  down
GigabitEthernet0/13    unassigned      YES unset down                  down
GigabitEthernet0/14    unassigned      YES unset down                  down
GigabitEthernet0/15    unassigned      YES unset down                  down
GigabitEthernet0/16    unassigned      YES unset down                  down
GigabitEthernet0/17    unassigned      YES unset down                  down
GigabitEthernet0/18    unassigned      YES unset down                  down
GigabitEthernet0/19    unassigned      YES unset down                  down
GigabitEthernet0/20    unassigned      YES unset down                  down
GigabitEthernet0/21    unassigned      YES unset down                  down
GigabitEthernet0/22    unassigned      YES unset down                  down
GigabitEthernet0/23    unassigned      YES unset down                  down
GigabitEthernet0/24    unassigned      YES unset up                    up
WirelessSWLab#

Cisco 4000 & 3000 series ip route & ip default gateway

Dear all ;
I have Enterprise Network Contain :
- Foundry Big Iron work on layer 3 , and Combination of 4000 and 3000 and 2000 cisco switches work on layer 2;
management network for the switches is 192.168.100.0
Foundry Big Iron is 192.168.100.1
i use ip default-gateway 192.168.100.1 on all cisco switches.
all other subnets route through the foundry.
but when i ping from any subnet (192.168.15.0) to any 3000 or 2000 switches series it replay and when i ping to 4000 series it don't replay.
when i use default route command on 4000 series it replay.
i need some explanation
Kind Regards

In the original post it describes the Cisco switches as operating as layer 2 switches and I assume that in terms of how they are configured to forward traffic all the Cisco switches including the 4000 are configured only for layer 2 forwarding. But with IP routing enabled (as seems to have been the case on the 4000) the behavior of the switch becomes a bit different. In particular is the difference in how you identify the default route. For a switch that is layer 2 only you use the default-gateway command (which apparently worked fine for the 2000 and 3000 switches). But when you enable IP routing then the switch does not use the default-gateway to learn its default route and would look for some other mechanism to learn its default route. I am assuming that there was not any other mechanism and so the 4000 basically did not have a default route. When you configure no ip routing (which was good advice from Paul) then the 4000 stops working as layer 2 switch and at that point will use default-gateway to determine its default route.
HTH
Rick

Default gateways and zones

This may be related to a thread that is currently out there. However in the interest of not hijacking it, I created my own. Please pardon my ignorance on the zoning stuff since I am in the process of learning.
We are currently running into a default gw issue on a 480R that is configured as follows:
bge0 interface: connected to the public routable network and used by the global zone. The defaultrouter file contains the gateway for this address.
bge1:1 and bge1:2 interfaces: connected to zones 1 and 2 respectively. These reside on the same private subnet behind our firewall appliance. The gateway for these is NOT on the defaultrouter of the global zone.
On the routing table of the global zone, we have 2 default gw's (one for the global/public zone and 1 for the local zones).
The problem:
When a user tries to connect via the public interface (they are connecting from a point not on the same subnet as the public interface of the box), they are sometimes able to connect (i.e. SSH) and sometimes not. My system is on the same subnet as the box and does not have any problems connecting via the public interface.
Is this the result of having multiple gw's on the global zone routing table?
Suggestions?

you can have multiple gateway entries in deafultrouter file but the default gateway for global zone can be only one but you can specify different gateways for different zones..
using this default gateway, you should be able to connect via different network...!

Default gateways and zones in a multihomed system

We do have some problems concerning default routes and zones in a multihomed system.
I found several posts in this forum, most of them referring to a domument of meljr, but my feeling ist that the paper is either not correct or not applicable to our situation?! Perhaps somebody can give me a hint.
Let me sketch our test environment. We have a multihomed Solaris 10 system attached to three different DMZ's using three different network adapters. We set up two local zones with IP's of the DMZ's of adapter 1 and 2, leaving adapter 0 for the IP of the global zone.
Now we set up default routes to ensure that network traffic from the local zones is routed in the corresponding DMZ's. That makes three different default routes on the global zone. On startup of the local zones, netstat reports the expected default routes to the correct DMZ gateways inside each zone.
Now what happens... My ssh to the global zone sometimes breaks. When this happens, no pings are possible to the IP of the global zone. Meanwhile, pings from other machines in our network (even from different subnets) might produce replies, some don't. By now, I can't tell you if there's is anything deterministic about it... More interesting: the local zone connections aren't affected at all!
So we did some more testing. Binding an IP address to the DMZ interfaces where the zones are tied to makes no difference (we tried both, with or without dedicated addresses for the adapter in the global zone). So the setup we're using right now is made of 5 IP addresses.
IP1, subnet 1: adapter 0, global zone
IP2, subnet 2: adapter 1, global zone
IP3, subnet 2; adapter 1. local zone 1
IP4, subnet 3; adapter 2, global zone
IP5, subnet 3; adapter 2, local zone 2
In the global zone there are three default gateways defined, one in each DMZ subnet. Inside the local zones, at startup you'll find the corresponding gateway into the DMZ. Everything looks fine...
I opened five ssh connections to the different IP's. Now what happened... After approx. half an hour, the connections to two IPs of the global zone (adapter 0 and adapter 1) broke down, while the connections to all other IP's were still open. This behaviour can be reconstructed!
So perhaps anybody has a explaination for this behaviour. Or perhaps anybody can answer me some qustions:
1. How are the three default gateways handled? Is there still some kind of "round robbin" implemenation? How can I guarantee that network traffic from outside isn't routed inside the DMZ's without preventing the local zones from talking to each other (actually we only need to communicate on some ports, but the single IP-stack concept only gives us all or nothing...).
2. If I do a ping from local zone 1 to the default gateway of local zone 2, this route is added as additional default gateway inside local zone 1! So does this mean, the routing decision is made only inside the global zone not taking into account where the packet is sent from?
3. After all, how are the IP packets routed from the different zone and the global zone, and how are they routed back to calling systems from the various DMS's and other networks, routed via these DMS's???
The scenario seems to be covered by http://meljr.com/~meljr/Solaris10LocalZoneDefaultRoute.html, but configuring the machine like stated in the paper leaves me with the problems described.
I'd be happy for any helpful comment!

you can have multiple gateway entries in deafultrouter file but the default gateway for global zone can be only one but you can specify different gateways for different zones..
using this default gateway, you should be able to connect via different network...!

Routing with more than one default gateway

Hi,
here is my problem:
usually I'm using Internet with WLAN-connection. Sometimes I want to connect my mac additionally with the LAN on work. As soon as I plug in the ethernet, there is a new item in the routing table, so I have two default-gateways - one to the WLAN-router and one to the standard-gateway of my work's LAN.
So for example I cannot take new mails from my private pop-account and for using internet I have to register a proxy-server. That's circuitous!
My idea is to create a plist-file in launchDaemons-directory, that deletes the default-gateway-item to my work's standard-gateway and adds a net-route to this only for my work's network.
Is it really a good idea or nonsens? What's a better way?
Thank you for your help!

So you want to do dual-homing.
First remember that Macs really are setup, out of the box, to be a one connection at time machine. And, there is a service order for interfaces. Which you can set in Systems Prefs Network.
However, I think this is what you are looking for:
open a terminal and do:
sudo sysctl -w net.inet.ip.forwarding=1
This command will allow the Mac to use two defaults gateways. Then it will be up to you to populate the routing table with what route goes to what gateway.
To add a static route every time you boot (taking from Dr. V on techarena)
http://forums.techarena.in/operating-systems/1187193.htm
Code:
sudo route -nv add -net 192.168 -interface en0
To avoid having to do this everytime you reboot:
Code:
cd /System/Library/StartupItems sudo cp -R NetworkExtensions NetworkLocal cd NetworkLocal sudo mv NetworkExtensions NetworkLocal sudo vi NetworkLocal
- replace the startup section with the comand above:
Code:
#!/bin/sh ## # Load network kernel modules ## . /etc/rc.common StartService () { ConsoleMessage "Loading Network Local" route -nv add -net 192.168 -interface en0 } StopService () { return 0 } RestartService () { return 0 } RunService "$1" sudo vi StartupParameters.plist
-- edit it to get
Code:
{ Description = "Network Local"; Provides = ("NetworkLocal"); Requires = ("Network"); OrderPreference = "None"; } cd Resources/English.lproj sudo vi Localizable.strings
-- edit it to get:
Code:
(?xml version="1.0" encoding="UTF-8"?) (!DOCTYPE plist SYSTEM "file://localhost/System/Library/DTDs/PropertyList.dtd") (plist version="0.9") (dict> (key>Loading Network Local(/key) (string>Loading Network Local(/string) (/dict) (/plist)
You could also edit the Network startup file and add the single line but that could get replaced if system is upgraded.

Incorrect Default Gateway for Clients using a Concentrator

Hey all,
Hopfully an easy one - I'm trying to configure a VPN Concentrator for use with the old VPN Client for an IPSec CVPN.
The clients connect fine, but they are getting the incorrect default gateway during the address assignment.
My address pool is 192.168.0.128/25. The client correctly picks up the first address in the range, 192.168.0.129, but the default gateway for the VPN adapter is assigned as the next address in the range, 192.168.0.130.
I need the gateway address to be 192.168.0.254 (the SVI of the L3 switch connected to the Concentrator), but I can't for the life of me fine a configuration option anywhere in the pool assignment. I've set the tunnel default gateway to this 192.168.0.254, but this makes no difference.
Any ideas where I can find this config option?
Thanks!

Andrew
In the chart that you posted about the routing setup it refers to a DMZ network and DMZ gateway. Can you clarify what these are since I do not see them in the drawing that is in that post?
I agree with Herbert that it is cleaner to have the address pool on the concentrator use addresses that do not overlap with the concentrator subnet connecting to the layer 3 switch. And as long as the layer 3 switch has a route to that address pool, and the next hop in the route is the address of the concentrator interface then the separate pool addressing should work just fine.
I have re-read this thread and want to make sure that after some changes that you have made that the problem symptoms are still the same. You told us earlier that: "Now the client can ping the interfaces on its local LAN (concentrator interface 192.168.0.253, and the L3 switch, 192.168.0.253), but it cannot reach the rest of our internal LAN behind the layer 3 switch." Is this still an accurate statement of the problem?
As Herbert said earlier this could either be caused by the concentrator not have a correct route for the inside or it could be because the inside does not have a correct route to the client. In re-reading your description of the routing set up it looks like the concentrator has a default route configured but not the tunnel default route. May I suggest that you try configuring a tunnel default route (in addition to the normal default route) and see whether that makes any difference?
If that does not help the problem then I would suggest that you verify that the devices on the inside do have their default gateway set correctly and that the layer 3 switch does have a route for the VPN address pool with the concentrator interface address as the next hop.
HTH
Rick
[edit] I just focused on the question that you asked about the concentrator possibly needing a route for the address pool. The concentrator does not need any route statements for the address pool - it knows its own address pool, pretty much like having a connected interface subnet. The layer 3 switch is what needs a route for the address pool.

Windows 8.1 Pro Need command to disable "Use default gateway on remote network" option on VPN connection"

Hello!
I want to create bat script to create several VPN connection.
There is powershell command to create vpn connection:
add-vpnconnection -name "Test VPN" -serveraddress "vpn.example.com" -splittunneling -tunneltype "pptp"
And I need to create VPN connection without the option "Use default gateway on remote network" option on VPN connection"
Or modify this option on existent VPN connection with command.
Please help me to find command option or other command to disable "Use default gateway on remote network" option on VPN connection" feature.

http://technet.microsoft.com/nl-nl/library/ee431701%28v=ws.10%29.aspx RouteIPv4TrafficOverRAS True – Add a default gateway on the VPN connection False – Do not add default gateway on the VPN connection

Hi, i wanted to resize my windows partion. I was thinking of using the default backup system for windows. Then switching to mac partion, deleting the bootcamp and then restoring a new enlarged partion from the backup. Is this possible?

hi,
i wanted to resize my windows partition. I was thinking of using the default backup system for windows. Then switching to mac partion, deleting the bootcamp and then restoring a new enlarged partition from the backup. Is this possible?

I see youhave gotten recommendatons for using WinClone or CampTune. I have used both and they both work well.
You have asked about using the WIndows 7 utility to backup your drive and restor it onto a larger partition. I will tell you fro experience that this will probably not do what you want, and may do something that you don't want. You can use the Windows 7 native backup tool to make a backup of your Windows 7 partition. It will most liekly end-up making a dive image of the whole drive. When yourestore that backup, it will try to re-create teh partitions of exactly the same size as they were when the backup was taken, so it won't increase your partition size for you. Worse, since Windows doesn't natively know how to read./write HFS+ volumes, the backup will make a partition for your MacOS (replacing any you may have now), except that the copy restored by WIndows will be totally worthless, and you will not be able to boot MacOS from it, or even read it under MacOS.
Now I will tell you that I've also had some fairly good success working with the free tool CloneZilla. Since it hasn't been mentioned yet, and everything else mentioned does cost you money, I thought I would throw it out. CloneZilla is not as easy to use as the tools mentioned, but it has worked for me int hte past, so it is something to consider. I tend to use CampTune myself, but that was because I purchased a bundle deal for them and it was included in that deal.

ACE30, bridging using default gateway

Good afternoon,
I have a strange behaviour with some ACE30 running A5 release :
Setup is in bridge mode, working correctly with a default gateway set in the context.
For some reason, some return traffic is being routed on the ACE instead of being bridged.
On what conditions would the ace decide to route the traffic of simply bridge it from the server vlan to the client vlan.
Regards,
Luc

interface vlan 337
description Vip Lan
ip address 10.32.5.4 255.255.255.0
peer ip address 10.32.5.5 255.255.255.0
no normalization
access-group input Any
nat-pool 1 10.32.5.254 10.32.5.254 netmask 255.255.255.0 pat
service-policy input L4_LB_VIP_337
no shutdown
interface vlan 171
bridge-group 17
no normalization
mac-sticky enable
no icmp-guard
access-group input Any
service-policy input Administration
service-policy input PM_MM_171_VIP
no shutdown
interface vlan 173
bridge-group 17
no normalization
mac-sticky enable
no icmp-guard
access-group input Any
no shutdown
what we see is the a server in vlan 173 has return traffic getting droppped on the first firewall next to vlan 337
what is even more strange is that the user isn't complaining....
On the context we used to see 100K concurrent connections, nows that we migrated the routed services to another context we are at 1/10 of the connections
sadly no capture as we migrated the services.

Can I enable "Use default gateway on remote network" on VPN connection using Group Policy?

Hi,
First timer here so please bear with me!
Environment: Domain Windows 2003, Clients: Windows 7 and Windows XP (with Client Side Extensions pushed out)
When creating a VPN connection on a client machine manually with default settings the "Use default gateway on remote network" found in [Connection Properties - Networking - IPv4 - Advanced] is enabled, which is good as we don't allow split-tunneling.
I have a test GPO that creates a new VPN Connection [Computer Config - Preferences - Control Panel - Network Options], but the above setting is unticked.
Am I missing something on the options for the GP preference to set this automtically?
I can write a script to directly change the C:\Users\All Users\Microsoft\Network\Connections\Pbk\rasphone.pbk file but would prefer if I could sort it all out using Group Policy.
Any help would be greatly appreciated!
Thanks a lot!
David

Shane,
There is actually a way to set the "Use default gateway on remote network" through Group Policy Preferences. And this may even be a better way to do it, because you may change this flag without touching any other settings, or other VPN connections.
(All VPN connections are stored in the same .pbk file.)
Here's the trick: Opening the .pbk file in notepad, I realized that this is actually an oldstyle ini-structured file. And Group Policy Preferences can update ini files! In the .pbk file the section names are the VPN connections names, like [My VPN],
and the property IpPrioritizeRemote is the flag "Use default gateway on remote network".
So, in Group Policy Management Editor, go to Preferences / Windows Settings / Ini Files.
Create a new object with Action = Update, and File Path =
C:\ProgramData\Microsoft\Network\Connections\pbk\rasphone.pbk
(If this is where your file is located, I guess it is in c:\users if the VPN connection is made for a single user.)
Section Name should be the display name of your VPN connection, without the brackets.
Property Name = IpPrioritizeRemote
Property Value = 1
Peter, www.skov.com, Denmark
Peter :-)
This is great, but just one question. I also want to append a list of DNS Sufixes in order (when viewing a VPN properties, this is buried in
"Networking --> IPv4/6 --> Advanced --> DNS --> Append these DNS Suffixes (in order)". However, for the VPNs I have manually created with this list populated, I can't see any entries in the rasphone.pbk. Does anyone know
where these are stored?
Cheers.

Change default gateway using *netipaddress* cmdlet

Hi, is there a way to change the DFG after the IP is assigned to an adapter?
I am using Server 2012. I created a new IP using "new-netipaddress -Ipaddress 1.2.3.4 -prefixlength 24 -interfaceindex 10". I have forgotten to add the -defaultgateway parameter in the command. IP address was sucessfully assigned, but I cannot figure out
a way to change/add a default gateway.
Does anyone know how to do it via native powershell cmdlets (no gwmi, functions or scripts)?
Cheers

I am having a similar problem and using Remove-NetIPAddress does not really help. Remove-NetIPAddress does not affect gateway settings and gateways remain assigned to the net adapter. Furthermore, after I use RemoveNetIPAddress cmdlet, the NetTCPIP\Get-NetIPConfiguration
cmdlet starts producing a non-terminating error. Here is a repro script:
PS C:\> $IPAddress = '192.168.0.1'
PS C:\> $DefaultGateway = '192.168.0.1'
PS C:\>
PS C:\> # Enumerate NIC configurations.
PS C:\> $networks = NetTCPIP\Get-NetIPConfiguration
Exception setting "NetProfile": "Cannot convert the "System.Object[]" value of type "System.Object[]" to type
"Microsoft.Management.Infrastructure.CimInstance"."
At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetTCPIP\NetIPConfiguration.psm1:128 char:13
+             $IPConfig.NetProfile = Get-NetConnectionProfile -InterfaceAlias $IfA ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], SetValueInvocationException
    + FullyQualifiedErrorId : ExceptionWhenSetting
PS C:\> # Look for NIC that is not on corpnet.
PS C:\> $privateNetwork = $networks | ? { $_.IPv4Address.PrefixOrigin -ne 'Dhcp'}
PS C:\> $privateNetworkName = $privateNetwork.InterfaceAlias
PS C:\> $privateNic = NetAdapter\Get-NetAdapter -Name $privateNetworkName
PS C:\> $privateNic | NetTCPIP\Set-NetIPInterface -Dhcp Disabled
PS C:\> $privateNic | NetTCPIP\Remove-NetIPAddress -Confirm:$false
PS C:\> $privateNic | NetTCPIP\New-NetIPAddress -IPAddress $IPAddress -PrefixLength 24 -DefaultGateway $DefaultGateway
NetTCPIP\New-NetIPAddress : Instance DefaultGateway already exists
At line:1 char:15
+ $privateNic | NetTCPIP\New-NetIPAddress -IPAddress $IPAddress -PrefixLength 24 - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (MSFT_NetIPAddress:ROOT/StandardCimv2/MSFT_NetIPAddress) [New-NetIPAddr
   ess], CimException
    + FullyQualifiedErrorId : Windows System Error 87,New-NetIPAddress

Host with same IP of default gateway. How to prevent?

Hi,
I had a problem this week in the network. A host was plugged in the network with the same IP address of the default gateway of that Vlan.
Is there someway to prevent it? I know with 802.11x I could know who is doing that, but it would not avoid the problem to occur.
Is there anyway to force the hosts to use DHCP or something?

Hey there. You want to look at DHCP snooping ;-) Make sure you have a DHCP server configured, and DHCP snooping enabled on your switch. If a device tries to use any static assigned IP addresses, the switch interface will block it (it must be DHCP assigned). For your router interface, make sure you trust the interface (as you will have a static IP address assigned).
Hope this helps, good luck
Dazzler

Duplicate IP on a default gateway interface = Bad

I just had an entire VLAN drop out due to a host being brought onto the network that had been erroneously configured with a static IP that happened to be in conflict with the HSRP default gateway IP of the core switch; fortunately, we were able to remove the offending host and reconfigure default gateways as a workaround until the core switch's ARP table updated.
Is there any way to configure a 6500 running IOS to inhibit or block a conflicting IP (especially one with a gateway IP) by using a static ARP entry or other authoritative command?
Thanks,
Marc

Hi,
You may use the following.
enable Unicast Reverse Path Forwarding on an interface. Unicast RPF guards against IP spoofing (a packet uses an incorrect source IP address to obscure its true source) by ensuring that all packets have a source IP address that matches the correct source interface according to the routing table.
Normally, the FWSM only looks at the destination address when determining where to forward the packet. Unicast RPF instructs the FWSM to also look at the source address; this is why it is called Reverse Path Forwarding. For any traffic that you want to allow through the FWSM, the FWSM routing table must include a route back to the source address. See RFC 2267 for more information.
For outside traffic, for example, the FWSM can use the default route to satisfy the Unicast RPF protection. If traffic enters from an outside interface, and the source address is not known to the routing table, the FWSM uses the default route to correctly identify the outside interface as the source interface.
If traffic enters the outside interface from an address that is known to the routing table, but is associated with the inside interface, then the FWSM drops the packet. Similarly, if traffic enters the inside interface from an unknown source address, the FWSM drops the packet because the matching route (the default route) indicates the outside interface.
Unicast RPF is implemented as follows:
?ICMP packets have no session, so each packet is checked.
?UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent packets arriving during the session are checked using an existing state maintained as part of the session. Non-initial packets are checked to ensure they arrived on the same interface used by the initial packet.
To enable Unicast RPF, enter the following command:
hostname(config)# ip verify reverse-path interface interface_name
http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_chapter09186a0080577c66.html#wp1042625
It may be useful..
Rgrds
Rajeev.S

Can there be two active default gateways of same cost

I have two links at my setup, ISDN and lease. Presently ISDN is configured as a backup to lease link. There are two default gateways on my router, default gateway for lease link has a higher priority than ISDN link.
Will it be possible to make both the lines work simultaneously?

Yes, You can use both the links and there is no rocket science involved.
Just define 2 static routes to same destination using 2 links,the process switching will automatically send packets on 2 links in round robin fashion.BUt you dont have to use then fast switching.In case you are using fast switching then this load balancing won't work.The answer to that is yo have to use CEF(Cisco express forward) switching which is the best switching available in terms of load balacing and speed.
In case you are using dynamic routing protocols then u dont need to worry like EIGRP does equal cost and both unequal cost load balancing.
The condition is that both the links are active same time or you have to define load on ur leased link sayin that is traffic goes more than x% activate ISDN .

Use of default gateway on switch

Similar Messages

Maybe you are looking for