ccadit Posted February 20, 2014 Posted February 20, 2014 We are just setting up a new Meraki Wireless setup, so far Created a new VLAN 10 on edge and core switch, tagged the AP with VLAN 10 on the edge switch. Created a new DHCP scope. Put an IP helper for the core with IP of DHCP server. Tagged the port that the edge swicth goes to the core on VLAN 10. Client gets a DHCP IP, however can't access the internet, don't see it registering on the firewall when trying to access the Internet. All of our servers are on a different VLAN. A colleague has suggested the issue is to do with the clients not able to connect to our DNS servers. Any help would be very much appreciated.
pantscat Posted February 20, 2014 Posted February 20, 2014 Do they have a route to your router? (and does the router know a route back to the client?!)
ccadit Posted February 20, 2014 Author Posted February 20, 2014 the core switch is our router if that answers your question, sorry not that clued up on networking if it doesn't. I can ping and remote onto the core switch as its configured as the gateway for the VLAN. vlan 10 name "Wireless" ip helper-address 172.16.99.140 ip address 172.15.0.1 255.255.248.0 tagged A1,E12 exit
FN-GM Posted February 20, 2014 Posted February 20, 2014 (edited) What firewall are you using? Have you set that to allow traffic from the new subnet? I assume you have a static route on your core switch? By the way that IP address you are using for the VLAN is not in the private range. You should use a private address this will also cause you issues. Private ranges you can use - Verio Knowledgebase :: What is the difference between public and private IP addresses? Edited February 20, 2014 by FN-GM 1
pantscat Posted February 20, 2014 Posted February 20, 2014 Ok - that's all good then, make perfect sense. Does the core switch have a route out to the internet? (or your proxy / firewall etc.). I'm guessing by your config above that it's an HP switch - so you'd have something along the lines of: ip route 0.0.0.0 0.0.0.0 1.2.3.4 Where 1.2.3.4 is the ip address of your edge firewall/proxy.
ccadit Posted February 20, 2014 Author Posted February 20, 2014 yes HP switch and this is in the config too ip route 0.0.0.0 0.0.0.0 firewall address
pantscat Posted February 20, 2014 Posted February 20, 2014 (edited) Excellent - ok then next step is to see if the firewall knows about the VLAN. E.g. Does the firewall have a route back to VLAN 10? I suspect that the firewall just needs a route configuring so it knows how to get back to 172.15.0.0/21. Also - just read @FN-GMs post - he's quite right... Edited February 20, 2014 by pantscat not looking properly.
ccadit Posted February 20, 2014 Author Posted February 20, 2014 Cisco ASA. I have created an inside rule from 172.15 network on http to outside world. I have a static route but not for this range could that be the problem? I wasn't aware that 172.15 wasn't private, could that be the issue?
ccadit Posted February 20, 2014 Author Posted February 20, 2014 We currently have a Braford NAC in and I tried to include my new DHCP range everywhere where the Bradford NAC wireless range was. What wodul I be looking for a firewall inside rule? I do have one which 172.15.0.0 network to any on HTTP allow.
FN-GM Posted February 20, 2014 Posted February 20, 2014 I wasn't aware that 172.15 wasn't private, could that be the issue? - Yep when you try to get to a web service hosted in the range of 172.15.0.1 - 172.15.7.254 it simply won't work. I have created an inside rule from 172.15 network on http to outside world. - Don't forget https. I have a static route but not for this range could that be the problem? - Shouldn't be. Static routes look at the destination IP not the source IP. Before you do anything change your IP range. By the way do you need that range to be so large?
ccadit Posted February 20, 2014 Author Posted February 20, 2014 edge config vlan 10 name "Wireless" ip address 172.30.0.254 255.255.248.0 ip helper-address 172.16.99.140 tagged 24,28 exit Core config vlan 10 name "Wireless" ip helper-address 172.16.99.140 ip address 172.30.0.254 255.255.248.0 tagged A1,A5,E12 exit still no difference though :-(
ccadit Posted February 20, 2014 Author Posted February 20, 2014 anyother bit of info it maybe important with my issue A1 is the port on the core that the firewall is plugged in to.
FN-GM Posted February 20, 2014 Posted February 20, 2014 Is there any reason why you have done that config on both core and edge? I would have thought the IP and stuff is only needed on the core.
ccadit Posted February 20, 2014 Author Posted February 20, 2014 as suggested just changed edge config to: vlan 10 name "Wireless" tagged 24,28 exit everything is now working but too well in the sense I can cross to our 172.16 flat vlan which we wanted to avoid.
FN-GM Posted February 20, 2014 Posted February 20, 2014 (edited) Right to confirm you can get access to the internet? So the main issue is solved? Just want to make sure we are on the same page. When you setup a Layer 3 Vlan by default it will be able to route to all other vlans. To prevent this you can use Access Control Lists. Can you confirm you are using HP kit? Does your core switch support Access Control Lists / ACLS? On your main network, your .16 range, what do you want the wireless to access? DHCP and DNS i assume? Can anyone with HP experience tell me if the ACL's work similar to Cisco please? If it does i have some tried and tested ACL's that will work. Thanks Edited February 20, 2014 by FN-GM
pantscat Posted February 21, 2014 Posted February 21, 2014 (edited) Can anyone with HP experience tell me if the ACL's work similar to Cisco please? If it does i have some tried and tested ACL's that will work. Thanks Yep - they certainly do. The proper procurve HP switches (and not the rebranded 3Com stuff) will happily use Cisco style ACLs. For example: remark "Allow access from iPad VLAN-120 to DHCP and DNS" 10 permit udp 10.120.0.0 0.0.0.255 10.1.10.1 0.0.0.0 eq 68 20 permit udp 10.120.0.0 0.0.0.255 10.1.10.0 0.0.0.3 eq 53 30 permit tcp 10.120.0.0 0.0.0.255 10.1.10.0 0.0.0.3 eq 53 40 permit udp 10.120.0.0 0.0.0.255 10.1.10.8 0.0.0.0 eq 53 50 permit tcp 10.120.0.0 0.0.0.255 10.1.10.8 0.0.0.0 eq 53 Edited February 21, 2014 by pantscat
seawolf Posted February 21, 2014 Posted February 21, 2014 Do you have a default route configured anywhere for this VLAN? The default route should be within the subnet range of your VLAN. For instance if you're using 172.17.10.0 with 255.255.255.0, then default route might be 172.17.10.254.
ccadit Posted February 21, 2014 Author Posted February 21, 2014 (edited) With the suggested changes from yesterday by removing the ip settings from the edge switch i'm able to browse the internet via ip not dns, even the dns settings are in the scope, but they dont seem to be getting propogate via DHCP any ideas anyone? If I manually put in googles DNS server name resolution works. Edge: vlan 10 name "Wireless" no ip address tagged 24,28 exit Core: vlan 10 name "Wireless" ip helper-address 172.16.99.140 ip address 172.17.0.254 255.255.248.0 tagged A1,A5,E12 exit Edited February 21, 2014 by ccadit
seawolf Posted February 21, 2014 Posted February 21, 2014 With the suggested changes from yesterday by removing the ip settings from the edge switch i'm able to browse the internet via ip not dns, even the dns settings are in the scope, but they dont seem to be getting propogate via DHCP any ideas anyone? If I manually put in googles DNS server name resolution works. Edge: vlan 10 name "Wireless" no ip address tagged 24,28 exit Core: vlan 10 name "Wireless" ip helper-address 172.16.99.140 ip address 172.17.0.254 255.255.248.0 tagged A1,A5,E12 exit How do you have your DHCP settings configured for this VLAN? It doesn't seem that you have either a default gateway or DNS servers set in DHCP. All I see above are the switch VLAN settings. This is only half the solution.
ccadit Posted February 21, 2014 Author Posted February 21, 2014 using ip helper address 172.16.99.140 which is the DHCP server
ccadit Posted February 21, 2014 Author Posted February 21, 2014 Gateway is 172.17.0.254 the ip of our core
seawolf Posted February 21, 2014 Posted February 21, 2014 using ip helper address 172.16.99.140 which is the DHCP server [ATTACH=CONFIG]22969[/ATTACH] I don't understand your name server settings. Is your router (172.17.0.254) a DNS server? And why is Google DNS your primary DNS server? You don't need to resolve internal DNS names?
ccadit Posted February 21, 2014 Author Posted February 21, 2014 I don't understand your name server settings. Is your router (172.17.0.254) a DNS server? And why is Google DNS your primary DNS server? You don't need to resolve internal DNS names? I only put in 172.17.0.254 and yes thats our core switches IP, just to see if it would show up when I did ipconfig /all on client as its on the same subnet, I have put Googles DNS as its for BYOD wireless clients who don't need to know about internal names and idealy we would prefer if BYOd didnt touch our servers, if at all possible. Hope that makes sense now.
seawolf Posted February 21, 2014 Posted February 21, 2014 I only put in 172.17.0.254 and yes thats our core switches IP, just to see if it would show up when I did ipconfig /all on client as its on the same subnet, I have put Googles DNS as its for BYOD wireless clients who don't need to know about internal names and idealy we would prefer if BYOd didnt touch our servers, if at all possible. Hope that makes sense now. Can you show me the scope for the 172.16.0.0 VLAN?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now