dastrix Posted February 27, 2014 Posted February 27, 2014 Hey guys I have inherited a procurve network and have had a problem this week that has caused me to wipe out the configuration, and start again now we have approx 10 vlans that are used but I'm trying to simplify the setup for ease of management. Some questions I have are do I need every vlan on every switch? Should I have an admin vlan for the techies. If you want to get in contact I can give more details. Das
Techie-v2 Posted February 27, 2014 Posted February 27, 2014 Well it depends on your network of course but 10 does sound a bit much. Ive been looking a setting vlans up on ours and have deduced on 1 management, 1 for main network and 1 each for different wireless lans (student byod, staff byod etc)
Tallwood_6 Posted February 27, 2014 Posted February 27, 2014 It depends on what each VLAN is for i.e. If some of the vlans are designed for stations in geographical locations then obviously you won't need all of these on each edge switch. That said it certainly does no harm to add them all.
burgemaster Posted February 27, 2014 Posted February 27, 2014 We currently have zero vlans. We are shortly having WAN installed site wide. Would it be a good time now to learn and set this up ourselves? Or leave it to the install guys? All procurves too. Will be Interested in how you get on!
dastrix Posted February 27, 2014 Author Posted February 27, 2014 We have 10 different vlans for workstations ie each location But they are all pushed out from the core switch have been told this is a bad idea? Voice vlan Printers vlan Server vlan Then 3 different wifi vlans and lots of unused Sent from my iPad using EduGeek
Tallwood_6 Posted February 27, 2014 Posted February 27, 2014 I'm not sure what you mean by pushed out by the core switch, but 10 vlans for workstations by location seems a bit much unless your running hundreds of workstations from each location?
dastrix Posted February 27, 2014 Author Posted February 27, 2014 I guess I mean they are dynamic vlans was told this is a bad idea thoughts?
adamf Posted February 27, 2014 Posted February 27, 2014 Depends on how your network is setup, size etc... I wouldn't say 10 is too many if the number of clients, setup warrants it. I have 19 VLANs on my Core Switch... (HP 5406zl), I'm working from a /20 address range (4096 addresses), firstly split into 2x /21 ranges, one of those /21 is solely for wireless clients, the other /21 is subnetted further, broken down (as logically as possible) into areas of the school. I don't necessarily have all VLANs on every edge switch, only those edge switches that need to serve multiple VLANs for whatever reason.
Roberto Posted February 27, 2014 Posted February 27, 2014 This isn't a x is the right number of vlans type of thing. It very much depends on your infrastructure, design philosophy, and goals. We have quite a few vlans defined (and they're defined on each switch too) but then we're a college with a large number of workstations, a complex set of requirements and 44 managed switches to look after, plus the usual assortment of extra dumb ones tucked here and there. Do you require separation of a group of network devices for security reasons? Then (while a VLAN isn't exactly a hard security boundary) they probably need to be in their own vlan. Do you need to route traffic around a large network? Do you need to provide alternate routes for site interlinks? Do you need to keep Ethernet broadcast domains to a manageable size? These are all questions that a VLAN might be at least part of the answer to. Have you considered getting Procurve Manager Plus? This makes managing a number of HP switches much easier.
dastrix Posted February 27, 2014 Author Posted February 27, 2014 Yeah we did look at it but in the end got device expert from manage engine
howartp Posted February 27, 2014 Posted February 27, 2014 We have 7 VLANs for PCs per location, plus say another 6 for other seperation/security purposes. Only have each VLAN presented on the switches where they are needed. Been trying HP PCM over 12 months but it's crashed my network every time without fail, so definitely interested in Device Expert - not come across that.
dastrix Posted February 28, 2014 Author Posted February 28, 2014 Here is my problem, HP support is as near as useless. I have scrubbed the problem switch and built a complete new config. 4 VLANS Default Voice 1 2 port 48 is connected to the core via fibre and the port is set to untagged if i set it to tagged for all the vlans i lose connectivity to it from admin pc's should ports that need voice and vlan 1 have these both tagged? or do i just set it to tagged vlan 1 Thanks in advance.
localzuk Posted February 28, 2014 Posted February 28, 2014 The VLANs need to match at both ends of a link. If you have a fibre link tagged with all VLANs at one end, they need to be tagged with all VLANs at the other end too. If you have the default VLAN untagged and the rest tagged, it has to be the same both ends.
Tallwood_6 Posted February 28, 2014 Posted February 28, 2014 (edited) Uplinks carry tagged traffic for all the vlans you wish to be available at the connected switch (although you can probably leave the default vlan untagged), the ports connected to client workstations will need to be untagged for the correct vlan. VOIP phones can usually handle tagged traffic as in some instances you will have a client PC running off the same connection. Edited February 28, 2014 by Tallwood_6
Oaktech Posted February 28, 2014 Posted February 28, 2014 We have 6 static vlans and these are only on the switches they are required at. Vlan1 is our default broadcast domain Vlan2 is the incoming tunnel between our primary school and the core switch for routing Vlan3 is our test domain Vlan4 is our Printers Vlan Vlan5 is our restricted guest wireless Vlan6 is our unrestricted guest wireless. All switches have Vlan 1, 4,5 and 6 on them as the utility is required on all of them. Only the incoming switch, and the intervening switches between it and the core have vlan2 (2 switches), along with all intervening switches between our office and the core (also 2 switches) so we can plug into their network in our office. Only the core and intervening switches (2 switches) between there and our office have Vlan 3. This is to do with the tagging on the interconnecting links/trunks.
dastrix Posted March 1, 2014 Author Posted March 1, 2014 1 last question then, having problems with wol across vlans what do I need to set? Ip forward protocol is it?
howartp Posted March 2, 2014 Posted March 2, 2014 Unfortunately I've not done routing commands on Procurve as our core switch is Cisco. On Cisco it's an Access-List rule such as: access-list 101 permit udp 7 all (That's off top of my head) I'm sure someone else will have done Procurve version.
Tallwood_6 Posted March 2, 2014 Posted March 2, 2014 Enable on the switch: ip directed-broadcast ip udp-bcast-forward And then on the VLAN the wake on lan broadcast is originating from, i.e. Server VLAN specify the broadcast address the stations are on. ip forward-protocol udp 10.0.5.255 7
dastrix Posted March 2, 2014 Author Posted March 2, 2014 So the second spec do I just do on the core switch or for each vlan on the switch nearest the client too?
Tallwood_6 Posted March 2, 2014 Posted March 2, 2014 You configure this just on the core switch. You may need to double check the udp port your wol is using. I think port 7 or 9 most common but it could use another port I.e cc4 remote start uses udp 10000
dastrix Posted March 2, 2014 Author Posted March 2, 2014 We use port 9, Ok so have added this to the core and its not working
dastrix Posted March 2, 2014 Author Posted March 2, 2014 Running configuration: ; hpStack Configuration Editor; Created on release #KA.15.10.0022 ; Ver #05:08.00.63.1f.ef:9e stacking member 1 type "J9584A" mac-address 082e5f-690d00 member 2 type "J9584A" mac-address 082e5f-69bc40 member 3 type "J9576A" mac-address b4b52f-a8d1c0 exit hostname "SR1-3800-STACK" mirror 1 port 3/10 no dhcp-relay hop-count-increment trunk 3/33 trk5 trunk trunk 3/37-3/40 trk10 lacp trunk 3/41-3/44 trk11 lacp gvrp logging 10.0.30.35 logging facility local3 timesync sntp sntp unicast sntp server priority 1 10.0.0.25 telnet-server listen data web-management listen data ip access-list extended "dmz" exit ip default-gateway 10.0.0.25 ip dns server-address priority 1 10.0.30.1 ip dns server-address priority 2 10.0.30.2 ip ssh listen data ip route 0.0.0.0 0.0.0.0 10.0.0.25 ip route 0.0.0.0 0.0.0.0 192.168.120.1 ip route 10.1.0.0 255.255.255.0 10.0.30.11 ip route 10.2.0.0 255.255.255.0 10.0.30.11 ip route 10.5.40.0 255.255.252.0 vlan 150 ip route 192.168.0.0 255.255.255.0 10.0.0.25 ip route 192.168.0.0 255.255.255.0 10.0.30.11 ip routing ip udp-bcast-forward ip multicast-routing interface 1/1 lacp active name "b4-2910-14" exit Removed the interface config for space snmp-server community "spanky" unrestricted snmp-server community "public" operator snmp-server host 10.0.30.35 community "public" trap-level not-info snmp-server listen data snmp-server contact "Chris" location "ServerRoom1" oobm disable ip address dhcp-bootp member 1 ip address dhcp-bootp exit member 2 ip address dhcp-bootp exit member 3 ip address dhcp-bootp exit exit router pim enable exit vlan 1 name "DEFAULT_VLAN" no untagged 3/11-3/12,3/17 untagged 1/1-1/26,2/1-2/26,3/1-3/10,3/13-3/16,3/18-3/32,3/34-3/36,3/45-3/52,Trk5,Trk10-Trk11 ip address 10.0.0.1 255.255.0.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip forward-protocol udp 10.0.30.11 ntp ip forward-protocol udp 10.0.30.255 9 ip forward-protocol udp 10.5.31.255 2050 ip forward-protocol udp 10.5.39.255 2050 ip forward-protocol udp 10.5.3.255 2050 ip forward-protocol udp 10.5.7.255 2050 ip forward-protocol udp 10.5.11.255 2050 ip forward-protocol udp 10.5.15.255 2050 ip forward-protocol udp 10.5.19.255 2050 ip forward-protocol udp 10.5.23.255 2050 ip forward-protocol udp 10.5.27.255 2050 ip forward-protocol udp 10.5.35.255 2050 ip igmp ip igmp forward 1/1-1/26,2/1-2/26,3/1-3/4,3/8-3/24,3/29-3/32,3/34,3/45-3/52,Trk5 ip pim-dense ip-addr any exit exit vlan 2 name "mitel" ip address 10.5.88.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp voice exit vlan 10 name "VLAN10" no ip address exit vlan 50 name "mirror_vlan" no ip address exit vlan 100 name "admin" tagged 1/1-1/26,2/1-2/26,3/1-3/4,3/8-3/24,3/29-3/32,3/34,3/45-3/52,Trk5 ip address 10.5.48.1 255.255.252.0 ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp exit vlan 101 name "wksblock1" tagged 1/1-1/26,2/1-2/26 ip address 10.5.1.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip forward-protocol udp 10.0.30.41 9 ip igmp ip pim-dense ip-addr any exit exit vlan 102 name "wksblock2" tagged 1/1-1/26,2/1-2/26 ip address 10.5.4.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip forward-protocol udp 10.0.16.1 3000 ip igmp ip pim-dense ip-addr any exit exit vlan 103 name "wksblock3" tagged 1/1-1/26,2/1-2/26 ip address 10.5.8.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 104 name "wksblock4" tagged 1/1-1/26,2/1-2/26 ip address 10.5.12.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 105 name "wksblock5" tagged 1/1-1/26,2/1-2/26 ip address 10.5.16.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 106 name "wksblock6" tagged 1/1-1/26,2/1-2/26 ip address 10.5.20.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 107 name "wksblock7" tagged 1/1-1/26,2/1-2/26 ip address 10.5.24.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 108 name "wksblock8" tagged 1/1-1/26,2/1-2/26 ip address 10.5.28.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 109 name "wksblock9" tagged 1/1-1/26,2/1-2/26 ip address 10.5.32.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 110 name "wksblock10" tagged 1/1-1/26,2/1-2/26 ip address 10.5.36.1 255.255.252.0 ip proxy-arp ip directed-broadcast ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 150 name "workstations" tagged 1/1-1/26,2/1-2/26,3/15 ip address 10.5.40.1 255.255.252.0 ip bootp-gateway 10.5.40.1 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.30.1 ip helper-address 10.0.43.11 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp exit vlan 200 name "voip" tagged 1/1-1/26,2/1-2/26 ip address 10.5.44.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 250 name "office" tagged 1/1-1/26,2/1-2/26 ip address 10.5.76.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 300 name "wifiadmin" untagged 3/11-3/12 tagged 1/1-1/26,2/1-2/26 ip address 10.5.84.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.43.11 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp exit vlan 310 name "wifiguest" tagged 1/1-1/26,2/1-2/26,3/11-3/12 ip address 10.5.100.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.43.11 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp exit vlan 320 name "wifistudent" tagged 1/1-1/26,2/1-2/26,3/11-3/12 ip address 10.5.104.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.43.11 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp exit vlan 330 name "wifistaff" tagged 1/1-1/26,2/1-2/26,3/11-3/12 ip address 10.5.108.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.43.9 ip helper-address 10.0.43.11 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 350 name "BYOD-Staff" tagged 1/1-1/26,2/1-2/26,3/11-3/12 no ip address ip helper-address 10.0.30.1 ip helper-address 10.0.30.2 exit vlan 500 name "server" tagged 1/1-1/26,2/1-2/26 ip address 10.5.52.1 255.255.252.0 ip proxy-arp ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp ip igmp ip pim-dense ip-addr any exit exit vlan 600 name "dmz" tagged 1/1-1/9,1/11-1/26,2/1-2/9,2/11-2/26,3/21,3/23 ip address 192.168.30.220 255.255.255.0 ip forward-protocol udp 10.0.30.11 ntp exit vlan 700 name "slg" tagged 1/1-1/26,2/1-2/26 ip address 10.5.56.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 800 name "backup" tagged 1/1-1/26,2/1-2/26 ip address 10.5.60.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 900 name "cluster" tagged 1/1-1/26,2/1-2/26 ip address 10.5.64.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 1000 name "unknown" tagged 1/1-1/26,2/1-2/26 ip address 10.5.68.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 1100 name "tun" tagged 1/1-1/26,2/1-2/26 ip address 10.5.72.1 255.255.252.0 ip helper-address 10.0.43.9 ip helper-address 10.0.30.160 ip helper-address 10.0.30.161 ip helper-address 10.0.43.11 ip forward-protocol udp 10.0.30.11 ntp exit vlan 1200 name "gateway" ip address 10.5.80.2 255.255.252.0 ip address 192.168.120.2 255.255.255.0 exit vlan 2000 name "foo" no ip address exit spanning-tree spanning-tree Trk5 priority 4 spanning-tree Trk10 priority 4 spanning-tree Trk11 priority 4 no tftp server tftp server listen data no autorun no dhcp config-file-update no dhcp image-file-update trunk-load-balance L4-based password manager password operator
Tallwood_6 Posted March 2, 2014 Posted March 2, 2014 Blimey a bit much to properly scan through but what have you go on what I.e are the servers on the default VLAN now not the one labeled servers vlan 500? You have what looks like the broadcast address of the range you have the servers on not the stations I.e you need ip forward-protocol udp 10.5.31.255 9 ip forward-protocol udp 10.5.39.255 9 ip forward-protocol udp 10.5.3.255 9 Etc
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now