MrJDH Posted June 25, 2014 Posted June 25, 2014 Hello, We're not having much success with implementing VLANs for a test walkthrough, which when proved as successful, will be rolled out to the rest of the network during this summer. The main issue is devices in one VLAN not being able to communicate with devices in other subnets. Now, there's a ton of information and queries on the same issue all over the web, mostly relating to different hardware vendors, or dissimilar scenarios. We've spent a couple of days troubleshooting everything, and have been through configuration steps many times, so I'll do my best to get down what we have so far (brain a little fried!) Firstly, we used a 2610 switch, and divided it up with 2 new VLANs (in addition to the DEFAULT_VLAN) which already resides. We created new new VLANs on the basis of isolation from the existing network. So, we issues the following telnet commands to the switch (untagged ports may not be exactly the same here...a lot has happened since we first ran through the config :-); config term ip routing VLAN 100 untag 10 ip address 10.50.8.0/24 VLAN 200 untag 11 ip address 10.50.9.0/24 write mem Devices connected to ports 10 and 11 were able to communicate with each other, with no issue. So inter-VLAN comms were good. We have also tried the same setup on the 5308XL core (once we had cleared down the 2610, so again, completely operating through one switch) This time, the following commands were issues against the 5308XL, as per instructions from http://www.hp.com/rnd/support/config_examples/5300xl_portbase.pdf. NOTE: We never bothered with creating the trunk (Cisco not HP I know) port, as we were just looking to test within the core itself, and to not involve additional switches at this point) HP ProCurve Switch 5308XL(config)# ip routing HP ProCurve Switch 5308XL(config)# router rip HP ProCurve Switch 5308XL(rip)# VLAN 100 HP ProCurve Switch 5308XL(vlan-100)# untag C6 HP ProCurve Switch 5308XL(vlan-100)# ip address 10.50.8.0/24 HP ProCurve Switch 5308XL(vlan-100)# ip rip v1-only HP ProCurve Switch 5308XL(vlan-100)# VLAN 200 HP ProCurve Switch 5308XL(vlan-200)# untag C7 HP ProCurve Switch 5308XL(vlan-200)# ip address 10.50.9.0/24 HP ProCurve Switch 5308XL(vlan-200)# ip rip v1-only HP ProCurve Switch 5308XL(vlan-200)# write mem This too was also successful, when we issued a ping from a device within one VLAN, to a device within the other VLAN. Then the fun started, when we decided to involve both the 5308XL and 2610, with the intention of using the core 5308XL for routing duties. We cleared down VLANs on both the core and 2610, and started from scratch with the following commands first being issued to the 2610; config term VLAN 100 untag 1 ip address 10.50.8.1/24 tag 25 VLAN 200 untag 2 ip address 10.50.9.1/24 tag 25 write mem With that sorted, we configured the core; config term VLAN 100 untag E8 (Port which IT Office PC is directly connected to) ip address 10.50.8.2/24 tag C6 VLAN 200 ip address 10.50.9.2/24 tag C6 write mem We only set one port on the core as being assigned to a VLAN (Port E8 to VLAN 100, as we opted to switch between VLAN 100 and 200 when required.) With everything in place, and trunk ports set as being C6 on the core and 25 on the 2610, we assigned the IT Office PC a 10.50.8.X IP address and configured its gateway IP as 10.50.8.2. We also connected a netbook to port 1 on the 2610, so that it was set as being in VLAN 100. We then issued the following from the IT office PC; 1. Ping the VLAN 100 interface of 10.50.8.2 on the core – Successful. 2. Ping the VLAN 100 interface of 10.50.8.1 on the 2610 – Successful. 3. Ping the netbook of 10.50.8.3 – Successful. 4. Ping the VLAN 200 interface of 10.50.9.1 on the 2610 – Successful. 5. Ping the VLAN 200 interface of 10.50.9.2 on the core – Unsuccessful. We can’t ping the interface of VLAN 200 on the core, despite the IT office being connected directly to the core – why can we successfully ping the VLAN 200 interface on the 2610? Can I also ask anyone to confirm, that if we want to use the 5308XL solely for routing, that 'ip routing' only needs to be issued against the core, and not the 2610 (as we have already done). Or do we need to issue the 'ip routing' command on the 2610 as well?
andyrite Posted June 25, 2014 Posted June 25, 2014 The IP routing only needs to be done on the core. It fact you don't even need to set an IP on the 2610 100/200 VLAN. I just setup an IP on the default VLAN to manage it. Try having a port untagged on vlan 200 on the core to sort the ping problem. 1
DMcCoy Posted June 25, 2014 Posted June 25, 2014 The 2610 does not need an ip in vlan 100 or 200 Are you setting the gateway on the clients to the ip of vlan that is it connected to (on the core) 1
MrJDH Posted June 25, 2014 Author Posted June 25, 2014 Guys, that's great! It's all come to life! Relief... VLAN IPs removed from 2610, all good.
MrJDH Posted June 27, 2014 Author Posted June 27, 2014 Andyrite, DMcCoy, thank you for all of your help the other day. I never actually thanked you at the time. I was hoping that you may be able to assist further, now that we have the VLAN basic down for a couple of switches. We use a Smoothwall box for filtering of internet traffic, which is set as the DG for all LAN PCs, with the exception of the IT office machines. Would anyone be able to take a look at the image I have below, to help us resolve some of the new issues, please? http://www.thedash.org.uk/VLANQuestions.png Many thanks.
andyrite Posted June 27, 2014 Posted June 27, 2014 You should have a ip-route 0.0.0.0 0.0.0.0 10.50.4.24 on your core. If it doesn't know what to do with the traffic(ie not a local IP) it will send it to the smoothwall. You need to have your vlans setup in your smoothwall too. 1
MrJDH Posted June 27, 2014 Author Posted June 27, 2014 Hi @andyrite, Thanks for this! So I was correct with implementing a static from the core to the SmoothWall box then...things are slowly starting to sink in! So the command is saying 'any IP, with any subnet mask, route to 10.50.4.24'? With regard to having the VLANs setup within SmoothWall, should we go along with the advice seen in this post, as simply dialling in the VLAN IPs, etc, as opposed to creating new interfaces? http://www.edugeek.net/forums/wired-networks/111145-internet-router-vlans.html#post951115 Many thanks.
andyrite Posted June 27, 2014 Posted June 27, 2014 Networking » Routing » Subnets Example Network 10.20.1.0 Subnet 255.255.255.0 Gateway (This is always 10.50.4.1 is your case) 10.0.0.1 1
MrJDH Posted June 27, 2014 Author Posted June 27, 2014 Am I correct in thinking that this solves the issue of devices in the 100 & 200 VLANs not being able to reach the internet, but not the issue of PCs using the 10.50.4.1 DG being unable to contact devices in VLANs 100 & 200?
localzuk Posted June 27, 2014 Posted June 27, 2014 You should have all machines use the core switch as the DG, and then the rule that @andyrite has mentioned as the default rule on your core.
andyrite Posted June 27, 2014 Posted June 27, 2014 Yes. The smoothwall wouldn't know what to have done with the traffic. but not the issue of PCs using the 10.50.4.1 DG being unable to contact devices in VLANs 100 & 200 The pc won't know how to get to the ip so will send it to you dg (the SA BOX) You'll need to add some static routes to your pc because you are not using the main switch for routing. What are you using the SA box for? 1
MrJDH Posted June 27, 2014 Author Posted June 27, 2014 but not the issue of PCs using the 10.50.4.1 DG being unable to contact devices in VLANs 100 & 200 The pc won't know how to get to the ip so will send it to you dg (the SA BOX) You'll need to add some static routes to your pc because you are not using the main switch for routing. Result! Added a persistent route to the table on my PC, using the core as the next hop, and BOOM! Hello VLANs!! That's wonderful for now. I'll no doubt be back once it comes to adding the subnets in SmoothWall.. Thanks both @andyrite and @localzuk
MrJDH Posted July 1, 2014 Author Posted July 1, 2014 (edited) We've got a spare bit of time this morning, to pick up on some VLAN work. So, after confirming with Smoothwall that adding the VLAN IP ranges into the Routing >> Subnets section is the way to go, we're running through how devices on either of the VLANs will be able route traffic through to the Smoothwall box on the DEFAULT_VLAN. The Smoothwall box is jacked straight into the core, which is obviously aware of the VLANs and their respective gateway IPs. Now referring to my previous query, where the IT office PCs were unable to ping any VLAN device, due to our DG being the SA box of 10.50.4.1, after adding persistent routes to our machines with the core IP of 10.50.6.14 as the next hop, we were in business. Do I now need to apply the same concept to the SW box, and create that link between itself and the core? I'm a bit confused, as doesn't adding the VLAN IP ranges into SW achieve the same thing? I know obviously not, as we still can't ping the SW box from a VLAN device. Does this routing within SW only come into play after we've created that initial static route to the core? Now, if this is the case, do I need to begin looking up equivalent Linux commands to add a persistent route on the SW box (being Linux based), or is there a reverse way to achieve this, say from entering the route on the core? Many thanks. Edited July 1, 2014 by MrJDH typo
andyrite Posted July 1, 2014 Posted July 1, 2014 Which Vlan can't your ping the SW from? Adding the VLAN ranges into the smoothwall is just creating a static route in the backgroud.
MrJDH Posted July 1, 2014 Author Posted July 1, 2014 Which Vlan can't your ping the SW from? Adding the VLAN ranges into the smoothwall is just creating a static route in the backgroud. Ah, so doing the config in Smoothwall is setting a static route between itself and the core? Pinging the SW on 10.50.4.24 from a device in either VLAN 100 or 200 fails.
andyrite Posted July 1, 2014 Posted July 1, 2014 Can you post sh run from the core. Screenshot of the SW vlan page. What's the IP you ar etrying to ping from?
andyrite Posted July 1, 2014 Posted July 1, 2014 And make sure Networking » Settings » Advanced is unticked on the SW.
MrJDH Posted July 1, 2014 Author Posted July 1, 2014 (edited) Can you post sh run from the core. Screenshot of the SW vlan page. What's the IP you are trying to ping from? The IP address of on eof the devices on VLAN 200 is 10.50.9.3. Pinging 10.50.4.24 fails. Here is the running config from the core - ; J4819A Configuration Editor; Created on release #E.11.10 hostname "Server Room - HP 5308xl" snmp-server location "Main Switch Server Room" module 2 type J4820B module 3 type J4820B module 4 type J4820B module 5 type J4907A module 6 type J4907A module 8 type J4878B module 7 type J4878B ip default-gateway 10.50.4.24 ip routing snmp-server community "public" Unrestricted snmp-server host 10.50.4.64 "public" snmp-server host 10.50.4.9 "public" snmp-server host 10.50.4.13 "public" vlan 1 name "DEFAULT_VLAN" untagged B1-B24,C1-C5,C7-C24,D1-D24,E1-E16,F1-F16,G1-G4,H1-H4 ip address 10.50.6.14 255.255.252.0 tagged C6 ip igmp exit vlan 100 name "VLAN100" ip address 10.50.8.1 255.255.255.0 tagged C6 exit vlan 200 name "VLAN200" ip address 10.50.9.1 255.255.255.0 tagged C6 exit ip route 0.0.0.0 0.0.0.0 10.50.4.24 ip route 10.50.8.0 255.255.255.0 10.50.4.24 ip route 10.50.9.0 255.255.255.0 10.50.4.24 router rip exit password manager password operator ree Here is the SW VLAN page - The local routing table on the SW box reflects these changes also. Edited July 1, 2014 by MrJDH
andyrite Posted July 1, 2014 Posted July 1, 2014 (edited) Wrong there. let me think. Edited July 1, 2014 by andyrite
andyrite Posted July 1, 2014 Posted July 1, 2014 (edited) ip default-gateway 10.50.4.24 should be 10.50.6.14. (the ip of the switch. We want the switch to do all the routing.) no need for ip route 10.50.8.0 255.255.255.0 10.50.4.24 ip route 10.50.9.0 255.255.255.0 10.50.4.24 as the switch already will have that in the routing table. The Gateway in the VLAN screen on the smoothwal needs to be 10.50.6.14 for every vlan. (the switch is doing the routing) sh ip route on the core should comfirm this. Edited July 1, 2014 by andyrite
MrJDH Posted July 1, 2014 Author Posted July 1, 2014 The Gateway in the VLAN screen on the smoothwal needs to be 10.50.6.14 for every vlan. (the switch is doing the routing) As 10.50.6.14 isn't local for either of the VLAN IP ranges, Smoothwall won't allow us to enter this as the DG..
DMcCoy Posted July 1, 2014 Posted July 1, 2014 You do not need and additional VLANs on the smoothwall, just the main interface and a route back for the relevant ip ranges. What are: ip route 10.50.8.0 255.255.255.0 10.50.4.24 ip route 10.50.9.0 255.255.255.0 10.50.4.24 for? The default route will send anything to unknown to smoothwall, the route on SW will send it back. SW needs only one default gateway, the internet.
andyrite Posted July 2, 2014 Posted July 2, 2014 As 10.50.6.14 isn't local for either of the VLAN IP ranges, Smoothwall won't allow us to enter this as the DG.. I've just tried it and it works.
localzuk Posted July 2, 2014 Posted July 2, 2014 Can I ask why you're implementing such a convoluted method of routing? The setup we have here is: All VLANS have the core as their DG (using the VLAN IP for the DG address). The core has the rule "ip route 0.0.0.0 0.0.0.0 10.5.143.254" in place, which is the default rule sending all unknown traffic to our edge router. In your case, this would point at your smoothwall box, which would have a DG of your edge router. From what I can tell, you're trying to route using your smoothwall box before the core router, meaning you have to bounce traffic back and forth. Is there a specific reason you need to do it that way?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now