У меня есть хост 192.168.2.182, который я настраиваю для мониторинга snmp, netflow и syslog... Хост подключается к коммутатору, который имеет vlan3 и может без проблем подключаться к Интернету. У меня есть vlan100 10.0.8.0, который подключает коммутатор [10.0.8.1] к ISR [10.0.8.2]. Хост может пинговать 10.0.8.1, но не 10.0.8.2, а мне нужна связь, чтобы мой мониторинг журналов работал. Ничто из того, что я делаю, не позволяет этого. У меня есть несколько возможных нестабильных конфигураций, но на данный момент мне просто нужно, чтобы хост мог обмениваться данными с ISR. Вот мои сокращенные конфигурации ISR/SWITCH... Возможно, я упускаю что-то очевидное. ISR version 17.18 flow record MY_RECORD match ipv4 source address match ipv4 destination address match ipv4 protocol collect counter bytes long collect counter packets long
!
!
flow exporter EXPORTER source Vlan100
!
!
flow exporter MY_EXPORTER destination 192.168.2.182 source Vlan100 transport udp 2055 template data timeout 60
!
!
flow monitor MY_MONITOR exporter MY_EXPORTER cache timeout active 60 record MY_RECORD
!
parameter-map type inspect PRM_TCP_UDP_ICMP udp idle-time 300 tcp finwait-time 30 tcp window-scale-enforcement loose tcp max-incomplete host 10 block-time 0
!
vlan 99 name MGMT
!
vlan 100 name INSIDE_VLAN
!
!
class-map type inspect match-any CM_ALLOWED_INBOUND match access-group name TCP_ISP1_TO_INSIDE match access-group name UDP_ISP1_TO_INSIDE
class-map type inspect match-all CM_MGMT_ICMP match protocol icmp
class-map type inspect match-any CM_ICMP_ONLY match protocol icmp
class-map match-any COPP-MGMT-CRITICAL match access-group name COPP-CRITICAL-ACL
class-map match-any COPP-CRITICAL match access-group name COPP-CRITICAL-ACL
class-map match-any COPP-ICMP match access-group name COPP-ICMP-ACL
class-map type inspect match-any CM_TCP_UDP_ICMP match protocol tcp match protocol udp match protocol icmp match protocol dns
class-map type inspect match-any CM_MGMT_TRAFFIC match protocol ssh match protocol https match protocol snmp match protocol dns match protocol icmp match protocol syslog
class-map match-any COPP-DEFAULT match any
!
policy-map COPP-ENFORCED class COPP-MGMT-CRITICAL police 64000 conform-action transmit exceed-action drop class COPP-ICMP police 64000 conform-action transmit exceed-action drop class COPP-DEFAULT police 256000 conform-action transmit exceed-action drop
policy-map type inspect PM_SELF_TO_INSIDE class type inspect CM_MGMT_TRAFFIC pass class class-default drop
policy-map type inspect PM_MGMT_TO_INSIDE class type inspect CM_MGMT_ICMP inspect class class-default drop log
policy-map type inspect PM_INSIDE_TO_MGMT class type inspect CM_MGMT_TRAFFIC inspect class class-default drop log
policy-map type inspect PM_TO_SELF class type inspect CM_MGMT_TRAFFIC inspect class type inspect CM_ICMP_ONLY pass class class-default drop
policy-map type inspect PM_ISP1_TO_INSIDE class type inspect CM_ALLOWED_INBOUND inspect class COPP-MGMT-CRITICAL class COPP-ICMP class class-default drop log
policy-map type inspect PM_INSIDE_TO_ISP1 class type inspect CM_TCP_UDP_ICMP inspect class class-default drop log
policy-map type inspect PM_INSIDE_TO_ISP2 class type inspect CM_TCP_UDP_ICMP inspect PRM_TCP_UDP_ICMP class class-default pass
!
zone security INSIDE
zone security ISP1
zone security ISP2
zone security MGMT
zone-pair security INSIDE_TO_ISP1 source INSIDE destination ISP1 service-policy type inspect PM_INSIDE_TO_ISP1
zone-pair security INSIDE_TO_ISP2 source INSIDE destination ISP2 service-policy type inspect PM_INSIDE_TO_ISP2
zone-pair security INSIDE_TO_MGMT source INSIDE destination MGMT service-policy type inspect PM_INSIDE_TO_MGMT
zone-pair security INSIDE_TO_SELF source INSIDE destination self service-policy type inspect PM_TO_SELF
zone-pair security ISP1_TO_INSIDE source ISP1 destination INSIDE service-policy type inspect PM_ISP1_TO_INSIDE
zone-pair security ISP1_TO_SELF source ISP1 destination self service-policy type inspect PM_TO_SELF
zone-pair security MGMT_TO_INSIDE source MGMT destination INSIDE service-policy type inspect PM_MGMT_TO_INSIDE
zone-pair security MGMT_TO_SELF source MGMT destination self service-policy type inspect PM_TO_SELF
zone-pair security SELF_TO_INSIDE source self destination INSIDE service-policy type inspect PM_SELF_TO_INSIDE
!
interface Loopback99 description *** ISR MANAGEMENT IDENTITY *** ip vrf forwarding management ip address 10.255.99.1 255.255.255.255
!
interface GigabitEthernet0/0/0 description WAN_ISP1_PPPoE no ip address no ip redirects no ip unreachables no ip proxy-arp negotiation auto pppoe enable group global pppoe-client dial-pool-number 1
!
interface GigabitEthernet0/0/1 description WAN_ISP2_STATIC ip flow monitor MY_MONITOR input ip address 100.122.91.181 255.192.0.0 ip nat outside zone-member security ISP2 ip tcp adjust-mss 1460 negotiation auto
!
interface GigabitEthernet0/1/0 switchport access vlan 100 switchport mode access
!
interface GigabitEthernet0/1/7 description Physical_Management_Port switchport switchport access vlan 99 switchport mode access spanning-tree portfast
!
interface Vlan99 description MANAGEMENT_ONL ip vrf forwarding management ip address 192.168.99.205 255.255.255.0 secondary ip address 192.168.99.2 255.255.255.0 no ip redirects no ip unreachables zone-member security MGMT
!
interface Vlan100 description Link ip address 10.0.8.2 255.255.255.252 ip nat inside zone-member security INSIDE ip tcp adjust-mss 1412 ip policy route-map PBR
!
interface Dialer1 mtu 1492 ip flow monitor MY_MONITOR input ip address negotiated no ip redirects ip nat outside zone-member security ISP1 encapsulation ppp ip tcp adjust-mss 1412 dialer pool 1 ppp mtu adaptive ppp authentication chap pap callin ppp chap hostname ppp chap password ppp pap sent-username ppp ipcp route default
!
no ip forward-protocol nd
ip forward-protocol udp
no ip http server
ip http authentication local
ip http secure-server
ip http secure-trustpoint HTTPS-TP
!
ip nat translation tcp-timeout 3600
ip nat translation udp-timeout 300
no ip nat service dns tcp
no ip nat service dns udp
no ip nat service gatekeeper
ip nat pool P_VLAN2 207.108.121.180 207.108.121.180 prefix-length 29
ip nat pool P_VLAN3 207.108.121.181 207.108.121.181 prefix-length 29
ip nat pool P_VLAN5 207.108.121.178 207.108.121.178 prefix-length 29
ip nat pool P_VLAN6 207.108.121.182 207.108.121.182 prefix-length 29
ip nat pool P_VLAN7 207.108.121.177 207.108.121.177 prefix-length 29
ip nat pool P_VLAN4 207.108.121.179 207.108.121.179 prefix-length 29
ip nat inside source static tcp 192.168.2.181 31578 100.122.91.181 31578 extendable
ip nat inside source static tcp 192.168.1.180 25 207.108.121.180 25 extendable
ip nat inside source static tcp 192.168.1.180 80 207.108.121.180 80 extendable
ip nat inside source static tcp 192.168.1.180 993 207.108.121.180 993 extendable
ip nat inside source static tcp 192.168.1.180 2280 207.108.121.180 2280 extendable
ip nat inside source static tcp 192.168.2.181 80 207.108.121.181 80 extendable
ip nat inside source static tcp 192.168.2.181 443 207.108.121.181 443 extendable
ip nat inside source static tcp 192.168.2.181 3670 207.108.121.181 3670 extendable
ip nat inside source static udp 192.168.2.181 51820 207.108.121.181 51820 extendable
ip nat inside source list NAT_ACL_VLAN2 pool P_VLAN2 overload
ip nat inside source list NAT_ACL_VLAN3 pool P_VLAN3 overload
ip nat inside source list NAT_ACL_VLAN4 pool P_VLAN4 overload
ip nat inside source list NAT_ACL_VLAN5 pool P_VLAN5 overload
ip nat inside source list NAT_ACL_VLAN6 pool P_VLAN6 overload
ip nat inside source list NAT_ACL_VLAN7 pool P_VLAN7 overload
ip nat inside source list NAT_ACL_VLAN8 interface GigabitEthernet0/0/1 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1 100.64.0.1
ip route 192.168.1.0 255.255.255.0 10.0.8.1
ip route 192.168.2.0 255.255.255.0 10.0.8.1
ip route 192.168.3.0 255.255.255.0 10.0.8.1
ip route 192.168.4.0 255.255.255.0 10.0.8.1
ip route 192.168.5.0 255.255.255.0 10.0.8.1
ip route 192.168.6.0 255.255.255.0 10.0.8.1
ip route 192.168.7.0 255.255.255.0 10.0.8.1
ip route vrf management 0.0.0.0 0.0.0.0 192.168.99.1
ip route vrf management 192.168.0.0 255.255.248.0 192.168.99.1
ip ssh bulk-mode 131072
ip ssh time-out 60
!
ip access-list standard NAT_ACL_VLAN2 10 permit 192.168.1.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN3 10 permit 192.168.2.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN4 10 permit 192.168.3.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN5 10 permit 192.168.4.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN6 10 permit 192.168.5.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN7 10 permit 192.168.6.0 0.0.0.255
ip access-list standard NAT_ACL_VLAN8 10 permit 192.168.7.0 0.0.0.255
!
ip access-list extended COPP-CRITICAL-ACL 10 permit tcp any any eq 22 20 permit udp any any eq snmp 30 permit tcp any any eq 443
ip access-list extended COPP-ICMP-ACL 10 permit icmp any any
ip access-list extended ISP1 10 permit ip 192.168.1.0 0.0.0.255 any 20 permit ip 192.168.2.0 0.0.0.255 any 30 permit ip 192.168.3.0 0.0.0.255 any 40 permit ip 192.168.4.0 0.0.0.255 any 50 permit ip 192.168.5.0 0.0.0.255 any 60 permit ip 192.168.6.0 0.0.0.255 any
ip access-list extended ISP2 10 permit ip 192.168.7.0 0.0.0.255 any
ip access-list extended TCP_ISP1_TO_INSIDE 10 permit tcp any host 192.168.1.180 eq smtp 20 permit tcp any host 192.168.1.180 eq www 30 permit tcp any host 192.168.1.180 eq 993 40 permit tcp any host 192.168.1.180 eq 2280 50 permit tcp any host 192.168.2.181 eq www 60 permit tcp any host 192.168.2.181 eq 443 61 permit tcp any host 192.168.2.181 eq 3670
ip access-list extended UDP_ISP1_TO_INSIDE 10 permit udp any host 192.168.2.181 eq 51820
logging source-interface Vlan100
logging source-interface Vlan99 vrf management
logging host 192.168.2.182
ip access-list standard 10 10 permit 192.168.0.0 0.0.7.255 20 permit 10.0.8.0 0.0.0.255 30 permit 172.25.0.0 0.0.0.255 40 permit 108.147.0.0 0.0.255.255 60 deny any log
ip access-list standard 99 10 permit 192.168.2.181 30 permit 172.25.0.0 0.0.0.255 40 deny any log
route-map PBR permit 10 match ip address ISP1 set interface Dialer1
!
route-map PBR permit 20 match ip address ISP2 set ip next-hop 100.64.0.1 set interface GigabitEthernet0/0/1
!
snmp-server group MONITOR-GROUP v3 priv read MONITOR-VIEW access 99
snmp-server view MONITOR-VIEW iso included
snmp-server trap-source Vlan100
snmp-server host 192.168.2.182 version 3 priv MySnmpUser
! SWITCH version 16.12
!
ip routing
!
ip name-server vrf Mgmt-vrf 1.1.1.1
ip dhcp excluded-address 192.168.1.0 192.168.1.1
!
ip dhcp pool fbeye network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server 1.1.1.1
!
ip dhcp pool fhc network 192.168.2.0 255.255.255.0 default-router 192.168.2.1 dns-server 1.1.1.1
!
ip dhcp pool ceyea network 192.168.3.0 255.255.255.0 default-router 192.168.3.1 dns-server 1.1.1.1
!
ip dhcp pool 4.0 network 192.168.4.0 255.255.255.0 default-router 192.168.4.1 dns-server 1.1.1.1
!
ip dhcp pool 5.0 network 192.168.5.0 255.255.255.0 default-router 192.168.5.1 dns-server 1.1.1.1
!
ip dhcp pool 6.0 network 192.168.6.0 255.255.255.0 default-router 192.168.6.1 dns-server 1.1.1.1
!
ip dhcp pool starlink network 192.168.7.0 255.255.255.0 default-router 192.168.7.1 dns-server 192.168.3.5 1.1.1.1
!
no device-tracking logging theft
!
flow record NETFLOW-RECORD match ipv4 source address match ipv4 destination address match ipv4 protocol match transport source-port match transport destination-port collect counter bytes long collect counter packets long
!
flow exporter NETFLOW-EXPORTER destination 192.168.2.182 source Vlan99 transport udp 2055 template data timeout 60
!
flow monitor NETFLOW-MONITOR exporter NETFLOW-EXPORTER cache timeout active 60 record NETFLOW-RECORD
!
class-map match-any system-cpp-police-topology-control description Topology control
class-map match-any system-cpp-police-sw-forward description Sw forwarding, L2 LVX data, LOGGING
class-map match-any system-cpp-default description EWLC control, EWLC data, Inter FED
class-map match-any system-cpp-police-sys-data description Learning cache ovfl, High Rate App, Exception, EGR Exception, NFL SAMPLED DATA, RPF Failed
class-map match-any system-cpp-police-punt-webauth description Punt Webauth
class-map match-any system-cpp-police-l2lvx-control description L2 LVX control packets
class-map match-any system-cpp-police-forus description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station description MCAST END STATION
class-map match-any system-cpp-police-multicast description Transit Traffic and MCAST Data
class-map match-any system-cpp-police-l2-control description L2 control
class-map match-any system-cpp-police-dot1x-auth description DOT1X Auth
class-map match-any system-cpp-police-data description ICMP redirect, ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-stackwise-virt-control description Stackwise Virtual
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control description Routing control and Low Latency
class-map match-any system-cpp-police-protocol-snooping description Protocol snooping
class-map match-any system-cpp-police-dhcp-snooping description DHCP snooping
class-map match-any system-cpp-police-system-critical description System Critical and Gold Pkt
!
policy-map system-cpp-policy
policy-map port_child_policy class non-client-nrt-class bandwidth remaining ratio 10
!
interface GigabitEthernet0/0 vrf forwarding Mgmt-vrf ip address dhcp negotiation auto
!
interface GigabitEthernet4/0/1 description SYSLOG-FORCE switchport access vlan 100 switchport mode access
!
interface GigabitEthernet4/0/2 no switchport ip address 10.0.2.2 255.255.255.0
!
interface Vlan2 ip flow monitor NETFLOW-MONITOR input ip address 192.168.1.1 255.255.255.0
!
interface Vlan3 ip flow monitor NETFLOW-MONITOR input ip address 192.168.2.1 255.255.255.0
!
interface Vlan4 ip flow monitor NETFLOW-MONITOR input ip address 192.168.3.1 255.255.255.0
!
interface Vlan5 ip flow monitor NETFLOW-MONITOR input ip address 192.168.4.1 255.255.255.0
!
interface Vlan6 ip flow monitor NETFLOW-MONITOR input ip address 192.168.5.1 255.255.255.0
!
interface Vlan7 ip flow monitor NETFLOW-MONITOR input ip address 192.168.6.1 255.255.255.0
!
interface Vlan8 ip flow monitor NETFLOW-MONITOR input ip address 192.168.7.1 255.255.255.0
!
interface Vlan99 ip address 192.168.99.1 255.255.255.0
!
interface Vlan100 ip address 10.0.8.1 255.255.255.252
!
ip route 0.0.0.0 0.0.0.0 10.0.8.2
!
logging source-interface Vlan99
logging host 192.168.2.182
ip access-list standard 99 10 permit 192.168.2.182 20 deny any log
!
!
snmp-server group V2C-GROUP v2c read V2C-VIEW access 99
snmp-server view V2C-VIEW iso included
snmp-server community MONITOR RO
snmp-server community NETMON RO 99
snmp-server host 192.168.2.182 version 2c MONITOR

]]>https://sla247.ru/forum/topic/887/хост-не-может-выполнить-команду-ping-isr-через-коммутатор-для-мониторинга-возможностейRSS for NodeFri, 15 May 2026 14:48:14 GMTFri, 13 Feb 2026 19:57:49 GMT60Все отлично сработало, спасибо. Я также внес изменения в policy-maps.

]]>https://sla247.ru/forum/post/5680https://sla247.ru/forum/post/5680Fri, 13 Feb 2026 19:57:51 GMTПривет, @TheGoob
Вам необходимо убедиться, что трафик не соответствует вашей политике PBR, которая в настоящее время является причиной сбоя. Убедитесь, что весь ваш управленческий трафик, предназначенный для маршрутизатора, исключен из сопоставления PBR, а также, в конце, переупорядочьте ACL (необязательно, но рекомендуется): ip access-list extended ISP1 1 deny icmp any host 10.0.8.2 2 deny tcp any host 10.0.8.2 eq 22 3 deny tcp any host 10.0.8.2 eq 443 4 deny udp any host 10.0.8.2 eq 53 5 deny udp any host 10.0.8.2 eq 514 6 deny udp any host 10.0.8.2 eq 161
!
ip access-list resequence ISP1 10 10 Кроме того, не имея отношения к вашей проблеме, но влияя на другие случаи использования, ваша конфигурация
типа policy-map inspect PM_TO_SELF
и
типа policy-map inspect PM_SELF_TO_INSIDE
должна быть изменена на: policy-map type inspect PM_TO_SELF class type inspect CM_MGMT_TRAFFIC inspect class class-default drop
!
policy-map type inspect PM_SELF_TO_INSIDE class type inspect CM_MGMT_TRAFFIC inspect class class-default drop
!
no class-map type inspect match-any CM_ICMP_ONLY Спасибо, Кристиан.

]]>https://sla247.ru/forum/post/5679https://sla247.ru/forum/post/5679Fri, 13 Feb 2026 19:57:50 GMT