200E - Setting up a port to plug into a vSwitch port for isolated management

[thepip3r]

remote firewall config

[ul]

config system settings   set allow-subnet-overlap enable[/ul]

vSwitch config

[ul]

interface-address: 10.1.2.1/29

member ports:  2, 3, 4, 5[/ul]

Port 6 config

[ul]

plugged into port 2 (vswitch)

type: LAN

interface-address:  10.1.2.3

services-checked:  ping, ssh, http, https[/ul]

I can ping 10.1.2.1 and 10.1.2.3 from the CLI on the remote firewall.  I can ping 10.1.2.1 from the local firewall CLI but cannot ping 10.1.2.3.  Is the problem related to 10.1.2.3 not having a default gateway pointed to 10.1.2.1?

My routing encompasses 10.1.2.3 on the 10.1.2.0/29 network so I'm not sure what's wrong.  Any assistance would be appreciated.

Ultimately, I'm trying to set up a dedicated 'management port' without using the OOB Management-named port.  If I'm going about this the wrong way, please let me know.

Thanks!

[thepip3r]

In an effort to make this a little bit more clear, I'm trying to set up an isolated management interface (not the OOB Management interface) on a 'management' network.  

With a physical layout, this does work:  

[ul]

Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port on the physical switch

Port2 (Black Network Gateway), ping, 192.168.0.1/29, plugged into a port on the physical switch

Admin Laptop, 192.168.0.3/29, plugged into a port on the physical switch[/ul]

From the admin laptop, I can ping both 0.1 and 0.2 and https into 0.2.

With a virtual layout, it does not work:

[ul]

Port1 (Isolated Management interface), ping+ssh+http+https, 192.168.0.2/29, plugged into a port2 on the virtual switch

Port2 + Port3 (joined as a vSwitch), ping, 192.168.0.1/29

Admin Laptop, 192.168.0.3/29, plugged into port3 on the virtual switch[/ul]

From the firewall CLI, I can ping 192.168.0.2.  Even if I change to 'exec ping-options source 192.168.0.1', I can still ping 192.168.0.2.  

From the laptop, I can ping 192.168.0.1 but I cannot ping 192.168.0.2.  If I put a network tap between the laptop and port3, I can see the workstation ARP for the MAC of 192.168.0.2 but it doesn't get a response.

I thought maybe the interfaces didn't use AutoSense technology, so the cable that connects Port1 to Port2, I replaced with a crossover cable and even though the firewall still showed the port as green and I could still ping 192.168.0.2 from the CLI, I could not ping from the workstation.  

It's almost as if the vSwitch isn't maintaining a MAC Address table... can anyone provide any insight into this?

TIA!