Can't access SX3832 control interfaces from outside of subnet
Hi all,
For a project, our company setup a small IT environment with a limited amount of IP addresses available (XXX.XXX.XXX.160-190), with specific permissions that the rest of the company does not have.
We got one RJ45 port in the wall patched to this IT environment. We have connected our SX3832 (standalone) to this environment and set its fixed IP address to something matching the subnet mask of this environment and connected the different machines we need to our SX3832.
Our machines can indeed do what they need and connect to each other. We can also access the control interfaces (SSH and web page) of the switch from these machines. However, we can't access these control interfaces (SSH and web page) from other computers in our company network but outside of this IT environment (slightly different subnet).
We can access the machines within this environment, including SSH and the web control interface pages of two different devices in this env (also on http 8080) so there is in principle no problem due to company/environment firewall rules. The control interfaces of the SX3832 are the only thing we can't access.
Would anyone have any idea if I need to change some settings to make it reachable? I have not found anything obvious and my googling didn't yield relevant results.
Thanks!
Hi @op_pikachu,
It sounds like the switch is missing the default gateway. Get the default gateway from one of the other hosts and try adding that IP for the "Next Hop" in the steps below...
- Go to L3 FEATURES > Static Routing > IPv4 Static Routing
- Click
to load the following page. - Enter 0.0.0.0 as the Destination and Subnet Mask, and enter the IP address of the Next Hop (Default Gateway).
- Click Create.
- Click
to save the configuration.
Hi @op_pikachu,
It sounds like the switch is missing the default gateway. Get the default gateway from one of the other hosts and try adding that IP for the "Next Hop" in the steps below...
- Go to L3 FEATURES > Static Routing > IPv4 Static Routing
- Click to load the following page.
- Enter 0.0.0.0 as the Destination and Subnet Mask, and enter the IP address of the Next Hop (Default Gateway).
- Click Create.
- Click to save the configuration.
@D-C Thank you for your answer.
Unfortunately It looks like this didn't solve it. We still can't access the control interfaces from devices not directly connected to the switch.
This is now our IPv4 routing table:
The address ending in 161 is the default gateway for this environment.
The address ending in 165 is the static address of the switch.
@op_pikachu, can you ping the switch IP? If ping works...
If you're using multiple VLAN, it could be the traffic is not on the VLAN with admin status set, or maybe it's unchecked.
Or maybe an access control restriction...
Be careful changing these settings because it's easy to lock yourself out accidentally... not that I've ever done that.
op_pikachu wrote
@D-C Thank you for your answer.
Unfortunately It looks like this didn't solve it. We still can't access the control interfaces from devices not directly connected to the switch.This is now our IPv4 routing table:
The address ending in 161 is the default gateway for this environment.
The address ending in 165 is the static address of the switch.
Static routing is the right way. D-C is correct about this direction.
This might need more info about the diagram to determine the static routing.
Simply judging from this picture and the entries, it should work.
@Clive_A Thanks for the feedback.
Since this morning I can ssh into the switch, but still no access to the web page. Due to the fact that simply waiting changed something I am now suspecting that it might have to do with my company IT.
My interface (there's only one) does have the admin status enabled and we have not enabled access control.
Unless somebody else has a brilliant idea I think this is partially resolved and the remaining problem might be due to my company.
Does anyone know where to find a good up-to-date description/manual for the CLI? I might want to do most of the management of the switch there if if is the only interface conveniently available.
Thanks!
Yep, it might be a proxy config, which you may or may not be able to disable or bypass. You can also try using ssh/cli to change the https port to something other than 443.
The best CLI reference to use is usually found with the support documents links for your product.
https://support.omadanetworks.com/us/document/4943/
