IrritableTech Posted October 16, 2014 Posted October 16, 2014 Yeah, devices can only have one gateway. Ok, from reading things again, I think you are almost set. So your Smoothwalls IPs are 10.103.20.5 and 172.16.1.1 Your switches IPs are 10.103.20.133 and 172.16.1.2 Your DHCP servers IP is 10.103.20.11 and you can use your smoothwall as DNS - right? Leave your switches gateway as it is (10.103.20.5). Using the CLI (use PuTTY and telnet/shh into 10.103.20.133) conf t int vlan 2 name "byod" tagged (your list of tagged ports - I2,I4,etc.) ip address 172.16.1.2 255.255.255.0 ip helper-address 10.103.20.11 exit wr mem Ok, now to check your DHCP scope. Range 172.16.1.5-172.16.1.254 Scope options Router 172.16.1.1 DNS server 172.16.1.1 Ensure your ruckus wireless lan has vlan 2 set the ACCESS VLAN field. To explain. Your clients connecting to the BYOD vlan will broadcast asking for an IP address. Your switch (172.16.1.2) will relay this request to your DHCP server (10.103.20.11). Your DHCP server will chose a suitable IP address based on which network the original request came from (172.1.1.*) and send the address via your switch (there a bit more to it, but...) The client will receive the DHCP lease which will include a gateway - the IP you have already added to your smoothwall and created a transparent proxy. So the switches gateway is the smoothwalls curriculum IP address, as are your curriculum devices, but your BYOD devices are given an alternative gateway/router by your dhcp server. All devices routing where they should, but no device with more than one gateway set. Unless I've missed something (which is always entirely possible) I think that should do it?
JJonas Posted March 23, 2015 Author Posted March 23, 2015 and you can use your smoothwall as DNS - right? Can you just expand on what you mean by this? Our primary DNS server is one of our domain controllers and the secondary is one hosted by the LEA. At the moment when we connect to the BYOD network it says getting IP address but then fails to obtain one. I dont understand how traffic can get out to our DHCP server on 10.103.20.11 when everything is configured for this new range 172.16.1.*? Do we need to run another cable from a spare NIC from our DHCP server to the switch and tag it with the BYOD VLAN ID? Also what I don’t understand is we have a traditional star topology of cabinets with access points patched into different switches. Are they going to be able to route traffic from these too?
IrritableTech Posted March 23, 2015 Posted March 23, 2015 (edited) Someone with more hands on knowledge of Smoothwall today might give you a more complete answer, but I think you can use your smoothwall as both DHCP and DNS server for your BYOD network if you like? Otherwise you'll need ip-helper (or the equivalent) setting on the BYOD VLAN and a route to the DHCP server (not forgetting any ACLs which may be set) and DNS if that's your preferred plan. Edited March 23, 2015 by IrritableTech
JJonas Posted March 23, 2015 Author Posted March 23, 2015 We would not use Smoothwall for DNS if possible. This is what we have in our switch config so far, how does it look? ; J9626A Configuration Editor; Created on release #RA.15.08.0009 ; Ver #02:13.2d:3c hostname "HP-E2620-48" max-vlans 50 no stack ip default-gateway 10.103.20.5 snmp-server community "public" unrestricted spanning-tree vlan 1 name "DEFAULT_VLAN" untagged 1-52 ip address 10.103.20.99 255.255.252.0 exit vlan 2 name "Guest" tagged 20,22 ip address 172.16.1.2 255.255.255.0 ip helper-address 10.103.20.11 exit no dhcp config-file-update password manager
IrritableTech Posted March 23, 2015 Posted March 23, 2015 Looks ok at a glance assuming your ports are correct. Have you created a dhcp scope for 172.16.1.x on your server? Are addresses being leased out?
Davit2005 Posted March 23, 2015 Posted March 23, 2015 Didn't notice you had ip routing enabled?? Not sure but you may need that as well. 2
JJonas Posted March 24, 2015 Author Posted March 24, 2015 Looks ok at a glance assuming your ports are correct. Have you created a dhcp scope for 172.16.1.x on your server? Are addresses being leased out? We created a scope but addresses don’t appear to be being assigned. Didn't notice you had ip routing enabled?? Not sure but you may need that as well. How do I do this?
JJonas Posted March 25, 2015 Author Posted March 25, 2015 We seem so close, but just can't get this damn VLAN with Ruckus and our HP switch working. We connect to the Guest WLAN and it doesn't get an IP address. I'm going to explain in detail exactly what we have done in the hope that someone can spot was is wrong. Any replies would be greatly appreciated as soooo want to get this done! This is what we did : - Patched a Ruckus access point into our core switch. Created a guest WLAN called Guest within Ruckus and associated that access point only to it. We ticked the box for VLAN and set the ID as 2. Created a VLAN called Guest in the core switch with an ID of 2. Assigned it an IP address of 172.16.1.3 and it has the same gateway as all curriculum machines of 10.103.20.5 (can't be changed to anything else - we found that out the hard way!) We set up Smoothwall with a separate interface of 172.16.1.1 and patched this into the core switch and also tagged it to the Guest VLAN. Configured ip routing to point to the gateway of 10.103.20.5 and set IP address helper to our actual DHCP server of 10.103.20.11. Created a new scope on our DHCP server of 172.16.1.1 - 172.16.1.254 and excluded the first 30 addresses from distribution. We set the gateway as 10.103.20.5 and the DNS as our usual DNS of 10.103.20.11 & 10.99.240.11. That's it and it doesn't work! You try to connect to the WLAN and it just stalls on trying to get an ip address. Here is a copy of our switch config. Again, any help really appreciated! ; J8698A Configuration Editor; Created on release #K.15.02.0005 hostname "ProCurve Switch 5412zl" module 1 type J9537A module 2 type J9550A module 3 type J9550A module 4 type J9550A module 5 type J9550A module 6 type J9550A module 7 type J9550A module 8 type J9550A module 9 type J9550A module 10 type J9550A interface H18 speed-duplex 100-full exit interface J22 speed-duplex 100-full exit interface J24 speed-duplex 100-full exit ip default-gateway 10.103.20.5 ip routing vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24,J1-J24 ip address 10.103.20.133 255.255.252.0 exit vlan 2 name "Guest" ip helper-address 10.103.20.11 ip address 172.16.1.3 255.255.255.0 tagged I24,J24 exit snmp-server community "public" unrestricted spanning-tree no autorun no dhcp config-file-update no dhcp image-file-update password manager
Davit2005 Posted March 26, 2015 Posted March 26, 2015 Created a VLAN called Guest in the core switch with an ID of 2. Assigned it an IP address of 172.16.1.3 and it has the same gateway as all curriculum machines of 10.103.20.5 (can't be changed to anything else - we found that out the hard way!) We set up Smoothwall with a separate interface of 172.16.1.1 and patched this into the core switch and also tagged it to the Guest VLAN. Configured ip routing to point to the gateway of 10.103.20.5 and set IP address helper to our actual DHCP server of 10.103.20.11. Created a new scope on our DHCP server of 172.16.1.1 - 172.16.1.254 and excluded the first 30 addresses from distribution. We set the gateway as 10.103.20.5 and the DNS as our usual DNS of 10.103.20.11 & 10.99.240.11. That's it and it doesn't work! You try to connect to the WLAN and it just stalls on trying to get an ip address. Here is a copy of our switch config. Again, any help really appreciated! Just to get this correct, you have setup a scope on the DHCP for the guest which has a default gateway of 10.103.20.5 when the range is a 172.16.1.0/24. Would I be wrong in saying you need to setup the gateway for the scope as the gateway for that vlan i.e. that would be 172.16.1.3 ???? Otherwise how would the devices on that vlan get anywhere. I would also take a laptop and configure a port untagged for the guest vlan on the core switch and test you can then rule out any issues on wireless setup. For instance in our setup: All scopes on DHCP server have gateway set to the ip address of the vlan on the core switch. All vlans have the gateway set as the ip address of the vlan on the core switch (including the DHCP server) All vlans apart from vlan 1 have ip helper addresses pointing to DHCP server. Default ip route i.e 0.0.0.0 0.0.0.0 [ip address of Firewall/Router to Internet] Easter break coming up so with any luck you may get a bit of quiet time to get this sorted Don't forget to take plenty of backups . 1
IrritableTech Posted March 26, 2015 Posted March 26, 2015 @Davit2005 is correct. You DHCP scope needs to issue the gateway 172.16.1.3 (the IP assigned to your switch) as it will deal with where to route the traffic after this (either your default vlan, or your edge router). Unless.... How are you planning to filter your guest clients? Are you going setting a proxy on them or will the smoothwall become the router for the guest network? If so, once you've checked the network works, you'll need to change the gateway address in your DHCP scope to filter devices.
JJonas Posted March 26, 2015 Author Posted March 26, 2015 Thanks for all the help so far, we have added the ip address of the switch(VLAN) to the DHCP scope as the gateway (see picture) Good suggestion about plugging laptop straight into the tagged port(J24) to eliminate wireless problems. Still not picking up an IP address from the new scope. It was picking up an IP address from the 10.103.2X.X scope but we assume this was because we had J24 listed as untagged in the DEFAULT_VLAN. We have set to no untagged(see switch config below) What can we try next? vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24,J1-J23 ip address 10.103.20.133 255.255.252.0 no untagged J24 exit vlan 2 name "Guest" ip helper-address 10.103.20.11 ip address 172.16.1.3 255.255.255.0 tagged I24,J24 exit
IrritableTech Posted March 26, 2015 Posted March 26, 2015 (edited) I think you'll find J24 will need to be untagged in vlan 2 to test on the laptop. It was ok tagged on the AP, becuase the AP is tagging the traffic - your laptop wont be (unless you tell it too). The other thing which I remember from setting up our 5412 was that I had toruble getting routing working. Luckily I was doing this on a test network, and a simple reboot got routing working - It shouldn't have needed a reboot, but it did. Edited March 26, 2015 by IrritableTech
JJonas Posted March 26, 2015 Author Posted March 26, 2015 This is weird in the switch GUI J24 is listed as untagged on VLAN 2 but in Putty it shows up as tagged on VLAN 2? I have restarted Putty. also why does it need to be untagged?
Davit2005 Posted March 26, 2015 Posted March 26, 2015 I'd just try untagging a spare port to test the laptop on the guest vlan.
JJonas Posted March 26, 2015 Author Posted March 26, 2015 We have managed to get J24 untagged and it is not working. It now thinks that it is not plugged into the switch.
IrritableTech Posted March 26, 2015 Posted March 26, 2015 (edited) We have managed to get J24 untagged and it is not working. It now thinks that it is not plugged into the switch. Hang on what thinks it isn't plugged into the switch? You were trying the laptop right? Untagged = data which is not tagged with a vlan, tag it with this one. It's an odd term. Tagged = data tagged with this vlan may travel over this port. Where the laptop connects needs to be untagged. Where the AP connects needs to be untagged vlan 1, tagged vlan 2. Edited March 26, 2015 by IrritableTech 1
Davit2005 Posted March 26, 2015 Posted March 26, 2015 Hang on what thinks it isn't plugged into the switch? You were trying the laptop right? Untagged = data which is not tagged with a vlan, tag it with this one. It's an odd term. Tagged = data tagged with this vlan may travel over this port. Where the laptop connects needs to be untagged. Where the AP connects needs to be untagged vlan 1, tagged vlan 2. Exactly the way I had it set up with Ruckus at last place, we use HP here but the same applies. I'd just keep trying it as basic as possible so you know it's working with a laptop hard wired on the guest vlan.
JJonas Posted March 26, 2015 Author Posted March 26, 2015 We are only interested in getting the laptop working we have taken the AP out of the loop - until we can get IP addresses assigned to the laptop from the 172.x.x.x range. We managed to untag the laptop plugged into J24 and it still did not work. The laptop thought it was not cabled to the switch. What should the IP Address helper be on VLAN 2 should it be our school DHCP server 10.103.20.11?
Davit2005 Posted March 26, 2015 Posted March 26, 2015 What should the IP Address helper be on VLAN 2 should it be our school DHCP server 10.103.20.11? Exactly! Can you post your current running config so we can have a look at what it is now?
JJonas Posted March 26, 2015 Author Posted March 26, 2015 Exactly! Can you post your current running config so we can have a look at what it is now? Here it is Startup configuration: ; J8698A Configuration Editor; Created on release #K.15.02.0005 hostname "ProCurve Switch 5412zl" module 1 type J9537A module 2 type J9550A module 3 type J9550A module 4 type J9550A module 5 type J9550A module 6 type J9550A module 7 type J9550A module 8 type J9550A module 9 type J9550A module 10 type J9550A interface H18 speed-duplex 100-full exit interface J22 speed-duplex 100-full exit interface J24 speed-duplex 100-full exit ip default-gateway 10.103.20.5 ip routing vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24,J1-J23 ip address 10.103.20.133 255.255.252.0 no untagged J24 exit vlan 2 name "Guest" untagged J24 ip helper-address 10.103.20.11 ip address 172.16.1.3 255.255.255.0 exit snmp-server community "public" unrestricted spanning-tree no autorun no dhcp config-file-update no dhcp image-file-update password manager
ronnoco Posted March 27, 2015 Posted March 27, 2015 Rebooting the switch didn't work. How is the switch able to get to the DHCP server (10.103.20.11) when the laptop is connected to a different subnet (172.16.1.3)? I know we have the ip address helper command but I don't really understand how the traffic gets there? - Is this simply by the fact that ip-routing is enabled?
IrritableTech Posted March 27, 2015 Posted March 27, 2015 Rebooting the switch didn't work. How is the switch able to get to the DHCP server (10.103.20.11) when the laptop is connected to a different subnet (172.16.1.3)? I know we have the ip address helper command but I don't really understand how the traffic gets there? - Is this simply by the fact that ip-routing is enabled? Reboot - I was clutching at straws a little, sorry. It's magic. But really, the client broadcasts asking for a IP address. The switch acts as a proxy and knows the IP address of your DHCP server (the ip helper command). So it forwards the request (in simplistic terms): Request from MAC ADDRESS in this SUBNET. The DHCP obliges allocating an address from the correct subnet and sends the DHCP lease back and the switch deals with sending the info back to the client. A much better explanation that I googled... https://allaboutmylife.wordpress.com/2007/10/17/ip-helper-addresses-for-dhcp/ 1
ronnoco Posted March 27, 2015 Posted March 27, 2015 Thanks Adam, that makes sense. We're always clutching at straws, just restarted the DHCP service, lol Can you see anything wrong with our config? I downloaded a guide from HP and ours looks exactly the same. As soon as we get allocated an ip address from this new scope, I'll be happy!
IrritableTech Posted March 27, 2015 Posted March 27, 2015 No problem, lets keep trying... You and @JJonas both from the same establishment right? :-) Plug a laptop into J24 and give it a fixed IP. Lets say 172.16.1.100 SN 255.255.255.0 GW 172.16.1.3 Use this vlan config on your switch... ip default-gateway 10.103.20.5 ip routing vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24,J1-J23 ip address 10.103.20.133 255.255.252.0 exit vlan 2 name "Guest" untagged J24 ip helper-address 10.103.20.11 ip address 172.16.1.3 255.255.255.0 exit Ping 172.16.1.3 (switch) does it work? Ping 172.16.1.1 (smoothwall) does it work? Ping 10.103.20.11 (server) does this work? If all those work, then try setting your laptop to DHCP - does it get an address? Try those pings again just to be sure DHCP is sending out the right subnet and gateway. If everything is working up to now, replace your laptop connection (J24) with the AP, and change your config to the below. ip routing vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I24,J1-J24 ip address 10.103.20.133 255.255.252.0 exit vlan 2 name "Guest" tagged J24 ip helper-address 10.103.20.11 ip address 172.16.1.3 255.255.255.0 exit Ensure your ruckus is set to tag your guest wifi with VLAN 2. Does the AP show up as connected? Go through the same tests. Connect to the wifi network with a fixed IP. Ping the same devices. Then try to get a DHCP lease. Ping the same devices. If this doesn't work... where exactly did things break? 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now