VLANs not seeing internet

[FragglePete]

They need their router to have the subnet changed and then 3 further static routing entries for the 3 other vlans usign the core as the next hop address. Simple stuff but LEA's don't like to do it.

 

We always used to hide behind our own firewall ( own internal IP ranges ) and just a single RBC address on the outside. Saved our bacon once when they got a virus out of control.

 

 

Proxy with upstream proxy will work for soem stuff but anythign trying non standard protcols will not work.

 

Rob

 

Recommendation on a firewall ?

 

Pete

[twin--turbo]

Recommendation on a firewall ?

 

Pete

 

back then it was a linux box, now we are on a cisco ASA5520 but you probably don't want one of them.

 

Free - pFsense would do the job if you have an old PC with 2 NICS .

 

Or you could use somethink like a Draytek 2830N which has a wan port ( well 3 actualy ) and 4 internal ports.

 

Your probably going to have to change your internal IP adressing away from a clash with the LEA though.

 

At least it gets you ready for teh day when you dump the LEA.

 

Rob

[ChrisH]

Can you do a route print on the switch and paste it, I have a suspicion about something but I can't quite picture it looking at your config.

[twin--turbo]

Can you do a route print on the switch and paste it, I have a suspicion about something but I can't quite picture it looking at your config.

 

 

I doubt it will make a difference, the LEA router is expecting all IP's to be on the same subnet/vlan. But 75% are now on other vlans and the LEA router has no idea that it needs a next hop IP to get to these other VLANS.

 

TT

[seawolf]

Just to take a step back, is your inter-VLAN routing working? There are some settings in your RIP config that appear unusual to me. Might want to go thought this doco just to double check:

 

http://www.hp.com/rnd/support/config_examples/5300xl_portbase.pdf

 

http://www.hp.com/rnd/support/config_examples/5300xl_rip_routing.pdf

 

Your core switch config overall looks rather unusual to me as well. any reason you are using both 172.x.x.x and 10.x.x.x. IP addressing in your network? The whole "INSIDE" and "OUTSIDE" VLAN configuration has me a bit confused about what you are trying to do with your VLAN segmentation.

 

Here is the config from our core switch and an endpoint switch. We use a lot of VLANs and routing and default gateway has worked perfectly for 4 years like this. You'll notice that the default gateway for the endpoint switch is the core switch IP address. The default gateway for the core switch is our firewall. We use an Ubuntu server as the DHCP server on our network and the only "ip helper-address" setting points to this server as you'll note.

 

p.s. the endpoint switch config is in a following post, I reached the maximum length of a post with both it appears.

 

; J4850A Configuration Editor; Created on release #E.11.10

 

hostname "a15-5304xl-01"

snmp-server contact "ICT Manager"

snmp-server location "Network Rack 1"

max-vlans 48

module 1 type J4907A

module 2 type J4907A

module 3 type J4878B

module 4 type J4878B

interface A1

name "Server Access"

exit

interface A2

name "User Access"

exit

interface A3

name "User Access"

exit

interface A4

name "User Access"

exit

interface A5

name "User Access"

exit

interface A6

name "User Access"

exit

interface A7

name "Server"

exit

interface A8

name "User Access"

exit

interface A9

name "User Access"

exit

interface A10

name "User Access"

exit

interface A11

name "User Access"

exit

interface A12

name "User Access"

exit

interface A13

name "To a20-2610-01 26"

exit

interface A14

name "User Access"

exit

interface A15

name "Trunk To a15-4208vl-01 C2"

no lacp

exit

interface A16

name "Trunk To a15-4208vl-01 C4"

no lacp

exit

interface B1

name "Server Access"

exit

interface B2

name "Server Access"

exit

interface B3

name "Server Access"

exit

interface B4

name "Server Access"

exit

interface B5

name "Server Access"

exit

interface B6

name "Server Access"

exit

interface B7

name "Server Access"

exit

interface B8

name "Server Access"

exit

interface B9

name "Server Access"

exit

interface B10

name "Server Access"

exit

interface B11

name "Server Access"

exit

interface B12

name "Server Access"

exit

interface B13

name "Server Access"

exit

interface B14

name "User Access"

exit

interface B15

name "Trunk To a15-4208vl-01 D22"

no lacp

exit

interface B16

name "Trunk To a15-4208vl-01 D24"

no lacp

exit

interface C1

name "To s11-2810g-01 24"

exit

interface C2

name "To b2-2520g-01 24"

exit

interface C3

name "To i8-2810g-01 24"

exit

interface C4

name "To d2-2520g-01 21"

exit

interface D1

name "To u1-2520g-01 24"

exit

interface D2

name "To elc-hp2520g-01 24"

exit

interface D3

name "To g1-hp2510g-01 48"

exit

interface D4

name "To vce-hp2520g-01 24"

exit

trunk A15-A16,B15-B16 Trk1 LACP

ip default-gateway 172.17.2.254

sntp server 172.17.3.35

sntp server 172.17.3.101

sntp server 172.17.3.102

ip routing

timesync sntp

sntp unicast

snmp-server community "public" Unrestricted

vlan 1

name "DEFAULT_VLAN"

untagged C1-C4,D1-D4,Trk1

no ip address

no untagged A1-A14,B1-B14

exit

vlan 2

name "NET"

ip address 172.17.2.240 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 3

name "SERVER"

untagged A1-A3,A5-A14,B1-B14

ip address 172.17.3.254 255.255.255.0

tagged C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 4

name "SECURITY"

ip address 172.17.4.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 10

name "A-LAN"

ip address 172.17.10.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 20

name "B-LAN"

ip address 172.17.20.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 22

name "B-VOIP"

ip address 172.17.22.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

voice

exit

vlan 30

name "D-LAN"

ip address 172.17.30.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 32

name "D-VOIP"

ip address 172.17.32.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

voice

exit

vlan 40

name "G-LAN"

ip address 172.17.40.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 50

name "I-LAN"

ip address 172.17.50.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 60

name "P-LAN"

ip address 172.17.60.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 62

name "P-VOIP"

ip address 172.17.62.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

voice

exit

vlan 70

name "S-LAN"

ip address 172.17.70.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 5

name "PRINTER"

ip address 172.17.5.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 9

name "ADMIN"

ip address 172.17.9.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 80

name "U-LAN"

ip address 172.17.80.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 82

name "U-VOIP"

ip address 172.17.82.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

voice

exit

vlan 90

name "VCE-LAN"

ip address 172.17.90.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 100

name "ELC-LAN"

ip address 172.17.100.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

ip igmp

exit

vlan 101

name "ELC-WIFI"

ip address 172.17.101.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 200

name "WIFI200"

ip address 172.17.200.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 52

name "I-VOIP"

ip address 172.17.52.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

voice

exit

vlan 208

name "WIFI208"

ip address 172.17.215.254 255.255.252.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 202

name "WIFI202"

ip address 172.17.205.254 255.255.254.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 206

name "WIFI206"

untagged A4

ip address 172.17.208.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 214

name "WIFI214"

ip address 172.17.216.254 255.255.255.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

vlan 216

name "WIFI216"

ip address 172.17.223.254 255.255.252.0

ip helper-address 172.17.3.100

tagged A13,C1-C4,D1-D4,Trk1

exit

fault-finder bad-driver sensitivity high

fault-finder bad-transceiver sensitivity high

fault-finder bad-cable sensitivity high

fault-finder too-long-cable sensitivity high

fault-finder over-bandwidth sensitivity high

fault-finder broadcast-storm sensitivity high

fault-finder loss-of-link sensitivity high

fault-finder duplex-mismatch-HDx sensitivity high

fault-finder duplex-mismatch-FDx sensitivity high

ip route 0.0.0.0 0.0.0.0 172.17.2.253

spanning-tree

spanning-tree A1 bpdu-protection

spanning-tree A2 bpdu-protection

spanning-tree A3 bpdu-protection

spanning-tree A4 bpdu-protection

spanning-tree A5 bpdu-protection

spanning-tree A6 bpdu-protection

spanning-tree A7 bpdu-protection

spanning-tree A8 bpdu-protection

spanning-tree A9 bpdu-protection

spanning-tree A10 bpdu-protection

spanning-tree A11 bpdu-protection

spanning-tree A12 bpdu-protection

spanning-tree A14 bpdu-protection

spanning-tree B1 bpdu-protection

spanning-tree B2 bpdu-protection

spanning-tree B3 bpdu-protection

spanning-tree B4 bpdu-protection

spanning-tree B5 bpdu-protection

spanning-tree B6 bpdu-protection

spanning-tree B7 bpdu-protection

spanning-tree B8 bpdu-protection

spanning-tree B9 bpdu-protection

spanning-tree B10 bpdu-protection

spanning-tree B11 bpdu-protection

spanning-tree B12 bpdu-protection

spanning-tree B13 bpdu-protection

spanning-tree B14 bpdu-protection

spanning-tree Trk1 priority 4

spanning-tree bpdu-protection-timeout 300 priority 4 force-version RSTP-operation

ip multicast-routing

ip ssh

router rip

exit

router pim

exit

vlan 3

ip pim all

exit

vlan 9

ip pim all

exit

vlan 10

ip pim all

exit

vlan 20

ip pim all

exit

vlan 30

ip pim all

exit

vlan 40

ip pim all

exit

vlan 50

ip pim all

exit

vlan 60

ip pim all

exit

vlan 70

ip pim all

exit

vlan 80

ip pim all

exit

vlan 90

ip pim all

exit

vlan 100

ip pim all

exit

loop-protect A1,A3,A5-A6,A8,A10-A14,B1-B14,C1-C4,D1-D4,Trk1

loop-protect disable-timer 300

password manager

password operator

 

 

------------------–-----------

[seawolf]

; J9299A Configuration Editor; Created on release #J.14.01

 

hostname "f2-2520-01"

max-vlans 32

interface 1

name "User Access"

exit

interface 2

name "User Access"

exit

interface 3

name "User Access"

exit

interface 4

name "User Access"

exit

interface 5

name "User Access"

exit

interface 6

name "User Access"

exit

interface 7

name "User Access"

exit

interface 8

name "User Access"

exit

interface 9

name "User Access"

exit

interface 10

name "User Access"

exit

interface 11

name "User Access"

exit

interface 12

name "User Access"

exit

interface 13

name "User Access"

exit

interface 14

name "User Access"

exit

interface 15

name "User Access"

exit

interface 16

name "User Access"

exit

interface 17

name "User Access"

exit

interface 18

name "User Access"

exit

interface 19

name "User Access"

exit

interface 20

name "User Access"

exit

interface 21

name "Diagnostic"

exit

interface 22

name "User Access"

exit

interface 23

name "User Access"

exit

interface 24

name "To e2-2520g-01 23"

exit

ip default-gateway 172.17.2.240

vlan 1

name "DEFAULT_VLAN"

untagged 23-24

no untagged 1-22

no ip address

exit

vlan 2

name "NET"

untagged 20-22

ip address 172.17.2.20 255.255.255.0

tagged 24

exit

vlan 3

name "SERVER"

tagged 24

no ip address

ip igmp

exit

vlan 4

name "SECURITY"

tagged 24

no ip address

ip igmp

exit

vlan 10

name "A-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 20

name "B-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 22

name "B-VOIP"

tagged 24

voice

no ip address

exit

vlan 30

name "D-LAN"

untagged 4,7,10-19

tagged 24

no ip address

ip igmp

exit

vlan 32

name "D-VOIP"

untagged 5,8

tagged 24

voice

no ip address

exit

vlan 40

name "G-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 50

name "I-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 60

name "P-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 62

name "P-VOIP"

tagged 24

voice

no ip address

exit

vlan 70

name "S-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 5

name "PRINTER"

untagged 6,9

tagged 24

no ip address

exit

vlan 9

name "ADMIN"

untagged 1-3

tagged 24

no ip address

ip igmp

exit

vlan 80

name "U-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 82

name "U-VOIP"

tagged 24

voice

no ip address

exit

vlan 90

name "VCE-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 100

name "ELC-LAN"

tagged 24

no ip address

ip igmp

exit

vlan 101

name "ELC-WIFI"

tagged 24

no ip address

exit

vlan 200

name "WIFI200"

tagged 20,24

no ip address

exit

vlan 204

name "WIFI204"

tagged 20,24

no ip address

exit

vlan 208

name "WIFI208"

tagged 20,24

no ip address

exit

vlan 212

name "WIFI212"

tagged 20,24

no ip address

exit

vlan 52

name "I-VOIP"

tagged 24

voice

no ip address

exit

fault-finder bad-driver sensitivity high

fault-finder bad-transceiver sensitivity high

fault-finder bad-cable sensitivity high

fault-finder too-long-cable sensitivity high

fault-finder over-bandwidth sensitivity high

fault-finder broadcast-storm sensitivity high

fault-finder loss-of-link sensitivity high

fault-finder duplex-mismatch-HDx sensitivity high

fault-finder duplex-mismatch-FDx sensitivity high

timesync sntp

sntp unicast

sntp server priority 1 172.17.3.101

sntp server priority 2 172.17.3.102

snmp-server community "public" Unrestricted

snmp-server location "F Block"

spanning-tree

spanning-tree 1 bpdu-protection

spanning-tree 2 bpdu-protection

spanning-tree 3 bpdu-protection

spanning-tree 4 bpdu-protection

spanning-tree 5 bpdu-protection

spanning-tree 6 bpdu-protection

spanning-tree 7 bpdu-protection

spanning-tree 8 bpdu-protection

spanning-tree 9 bpdu-protection

spanning-tree 10 bpdu-protection

spanning-tree 11 bpdu-protection

spanning-tree 12 bpdu-protection

spanning-tree 13 bpdu-protection

spanning-tree 14 bpdu-protection

spanning-tree 15 bpdu-protection

spanning-tree 16 bpdu-protection

spanning-tree 17 bpdu-protection

spanning-tree 18 bpdu-protection

spanning-tree 19 bpdu-protection

spanning-tree 20 bpdu-protection

spanning-tree 21 bpdu-protection

spanning-tree 22 bpdu-protection

spanning-tree 23 bpdu-protection

spanning-tree bpdu-protection-timeout 300

loop-protect 1-24

loop-protect disable-timer 300

password manager

password operator

[seawolf]

That is correct. I like Keeping It Simple and not have another box to worry about. I fully appreciate what people are saying though but I was just hoping to break up our allocation of addresses into subnets and use them. Our provision with SWGfL is a bit different from normal as the bearer goes to the LEA and is distributed by their network to each of the schools in the borough. I'll have to try and talk to the local network team at the borough, it's just getting in contact with them as I have to be seen to go through the proper channels. Grrrr.

 

Aw crap, you definitely need to be using IP address ranges OTHER than that used by your WAN provider, and a firewall. Use a completely different internal IP addressing range, set endpoint switches to default route to core switch, core switch to default route to firewall, and firewall to default route to your WAN provider (LEA?).

 

Yep that's a lot more changes than you were planning, but you're about to configure yourself into a bloody mess. I'd recommend backing it out, planning a network reconfiguration more carefully and breaking free from using the LEA IP addressing internally - that's not good to do from a security standpoint and MANY other reasons.

[localzuk]

If Wiltshire is anything like Somerset, it's rare for a school to break away from the LEA provided IP range. We get our SIMS and finance support via their remote support systems and expect direct access.

 

Moving away from their ranges introduces a big issue.

[seawolf]

If Wiltshire is anything like Somerset, it's rare for a school to break away from the LEA provided IP range. We get our SIMS and finance support via their remote support systems and expect direct access.

 

Moving away from their ranges introduces a big issue.

 

I don't see how it would as long as the default gateway is set right and the internal DNS server is set to forward lookups to the LEA DNS server(s).

[mrbios]

If Wiltshire is anything like Somerset, it's rare for a school to break away from the LEA provided IP range. We get our SIMS and finance support via their remote support systems and expect direct access.

 

Moving away from their ranges introduces a big issue.

 

We get support in the same way, but we did exactly what seawolf said 6 years ago and we've never had an issue with it. They can't directly VNC straight into our computers anymore (and rightfully so!) but we provided them other means of connecting in and walked them through it, which works just as well. You just might need to educate them, but i sent our sims support an idiot sheet for connecting in and that has worked perfectly for years.

[ChrisH]

I doubt it will make a difference, the LEA router is expecting all IP's to be on the same subnet/vlan. But 75% are now on other vlans and the LEA router has no idea that it needs a next hop IP to get to these other VLANS.

 

TT

 

I suspected that would be the case as it's the same for our setup but what I also thought is that there is no actual definition for the 48.x network on the switch but I have found it now

 

ip address 10.43.48.95 255.255.255.0

 

I use PFSense with LEA default gateway and then just use one supernetted static route to reach all my VLANs but that is possible in my case because of my network numbers ie 10, 20, 30, 40 etc.

 

Also I would like to know why a lot of you seem to have RIP configuration on your switches ? Do you have other routers to send routing updates to as well ?

[seawolf]

Also I would like to know why a lot of you seem to have RIP configuration on your switches ? Do you have other routers to send routing updates to as well ?

 

If you're using your Layer 3 core switch to route traffic and aren't using a standalone router for this instead, then you have to enable RIP or OSPF. RIP is simple, has low overhead and is perfect for small to medium size LANs. OSPF is harder to configure, can have high overhead, and in the case of the ProCurves you have to pay for a premium license to support OSPF (or at least that was the case last time I checked). You wouldn't want to use RIP with multiple routers though...

[ChrisH]

If you're using your Layer 3 core switch to route traffic and aren't using a standalone router for this instead, then you have to enable RIP or OSPF. RIP is simple, has low overhead and is perfect for small to medium size LANs. OSPF is harder to configure, can have high overhead, and in the case of the ProCurves you have to pay for a premium license to support OSPF (or at least that was the case last time I checked). You wouldn't want to use RIP with multiple routers though...

 

I know about RIP and OSPF but my point is such protocols are for sending routing updates for advertised networks to other routing devices and that people sometimes seem to have some RIP configuration when they only have one router/layer 3 switch.

 

I have had a Procurve 5406 routing my VLANs for 3-4 years now and it only needs

 

IP routing

 

Enabled. This is why I ask about what other devices people are using with RIP on their networks with their Procurve.

[localzuk]

Indeed, I don't have rip enabled on my 5406zl. It's been happily routing vlan traffic for 5 years.

[seawolf]

I know about RIP and OSPF but my point is such protocols are for sending routing updates for advertised networks to other routing devices and that people sometimes seem to have some RIP configuration when they only have one router/layer 3 switch.

 

I have had a Procurve 5406 routing my VLANs for 3-4 years now and it only needs

 

IP routing

 

Enabled. This is why I ask about what other devices people are using with RIP on their networks with their Procurve.

 

With IP routing enabled, you can't use ip default-gateway in the config. RIP is dynamic and IP routing is static. IP routing is fine for simple LAN configurations. We have two campuses joined via fibre link and a more complex network. Using static routes would be far more prone to error and misconfiguration. Most of the examples HP provide on inter-VLAN routing make use of RIP for this reason. It's simple and more flexible than static routes.

[FragglePete]

Firstly, thanks for everybody's input on this; really appreciated.

 

I backed out. Rolled things back and things are as they where with just so tidying up to do.

 

The 'INSIDE' and 'OUTSIDE' bits were geographical references purely for how I intended the VLANs to be, nothing to do with Routing as such, ie. 'INSIDE' for inside the main building, 'OUTSIDE' for the buildings outside main building, etc, etc. Sorry if this confused. The 172.17.50.0/24 is what we have our phone system running on, I wanted it running on its own VLAN and knew it couldn't reach the SWGfL network being on this subnet but talks happily to internal devices via the switch as a number of users use the soft phone features of our Splicecom Kit, this is why PIM Dense is in place also as it needs to multicast over the VLANs. The other range is our 'admin' range which we actually use for BYOD for staff at present. The setup did have the VLAN's routing nicely together and I had this working (logging in via AD, CSE stuff working and Prism deploying, etc) - just no access on the VLANs except for the first (ie. 10.43.48.0/24).

 

So, taking a step back, licking my wounds and preparing for introducing a firewall, router of some sort in the near future. I full appreciate the arguments of moving away from these Broadband Consortiums, and have indeed talked to other providers where the costs are about the same. Because of the unique way Swindon is routed via the LEA it obviously does have it's disadvantages, and this has highlight a big one, but on a plus side we are getting upgraded to 100Mbps in the near future with just an initial upfront cost to change a licence on our Point to Point uplink (dicussion for another day on that one).

 

Thing is, I want to put something reliable in as a firewall which would allow me to do this VLANs with my own private address ranges now so don't want to have something so important running on an old PC that I've botched together. I did something similar years ago elsewhere using things like PfSense, MonoWall and ipCop which were great fun to play with but want something robust, well supported and not going to cost the earth. We also have services like Exchange, Frog and RemoteApps routing to internal IP addresses from SWGfL so would want to ensure that these remain working so keep this range of address in use along with my own set of private addresses on the other VLANs - just need to understand how to work out the gateway and routing with that one!

 

Again, I really appreciate everyone's input and time taken on this; goes to prove just how useful this forum is and all those that take part. Thank you all!

 

Pete