HP 2920 Inter-Vlan Routing

[MarcAlle]

I'm stumped on this and don't know what I'm doing wrong here! I just replaced the Cisco switches that were very old with brand new HP 2920s at work. Below is the config.

 

What I'm trying to do is allow users to talk to the Dev network (vlan 18) from the default vlan (1) (all ports). I've been here a long time now, so maybe my brain is just fried.

Also, I would like specific users (2 ports) to be on the default vlan, but be able to communicate with vlan 100. Still unable to do this as well.

 

Any thoughts would be very helpful. Right now, everything I've tested has been from just the primary (core) switch, there are additional switches down the line, but I want to get the core going first obviously. The vlans work for the machines in them.

config.txt

Edited March 16, 2015 by MarcAlle

[themightymrp]

Not 100% but aren't these 2 lines in direct conflict with each other?

 

ip default-gateway 172.18.0.1
ip route 0.0.0.0 0.0.0.0 172.16.0.1

[MarcAlle]

172.18.0.1 is the virtual interface on the firewall (which is 172.16.0.1) I initially set it up that way so the firewall would see the IP addresses utilizing the internet.

 

The default gateway should really be the 16.0.1 - not sure how I messed that up or how to fix it. I tried to change it, it says ip routing must be disabled.

Edited March 16, 2015 by MarcAlle

[themightymrp]

If you do a 'show ip route', what is it coming up with? I think it's conflicted over where to send the traffic...

[MarcAlle]

Destination Gateway VLAN Type Sub-Type Metric Dist.

------------------ --------------- ---- --------- ---------- ---------- -----

0.0.0.0/0 172.16.0.1 1 static 1 1

127.0.0.0/8 reject static 0 0

127.0.0.1/32 lo0 connected 1 0

172.16.0.0/16 DEFAULT_VLAN 1 connected 1 0

172.18.0.0/16 DevNetwork 18 connected 1 0

192.168.100.0/24 Universal 100 connected 1 0

[themightymrp]

I'm guessing the machines on the Dev network can communicate with the default vlan but not he other way round?

[MarcAlle]

Exactly. They all have the default gateway of the core router (18.10.1)

[themightymrp]

I think its because the switches default gateway sits on the same ip range as the 172.16.x.x network. Everything coming in is being routed through the default gateway address (hence the dev network can get through) but when traffic on the default vlan wants to communicate with the dev network, its being shovelled towards the default gateway.

 

Can you create a smaller IP range just for switch to firewall communication e.g. 172.19.1.1 and 172.19.1.2 subnet 255.255.255.252. Then set the switches default gateway to be the IP of the firewall?

[MarcAlle]

So, if I understand properly.

 

1) Firewall is set to 172.1.1.1/30

2) Core's default ip route for 0.0.0.0 0.0.0.0 is now 172.1.1.1

[themightymrp]

Yep, and make sure the switch has an IP in that small range (so 172.1.1.2/30 in your example). I think that will sort it.

 

Are you doing this on a live or test network? Just back up that config first!

Edited March 16, 2015 by themightymrp

[MarcAlle]

So, I'm a bit confused when you say add the IP to the switch? Whats the best way to approach this? Pardon my ignorance, I may just be not thinking properly.

[themightymrp]

It depends on how your switch connects to the firewall. Do you have a patch lead connecting them directly?

 

If so, it would probably be best to add a new vlan to the config and tag it purely on the port used to connect to the firewall, for example:

 

vlan 99

name "firewall uplink"

tagged 1/??? (enter the port your switch uses to connect to firewall)

ip address 172.1.1.2 255.255.255.252

exit

 

Then set your default gateway using

 

ip default-gateway 172.1.1.1

 

Obviously you would need to have a different IP on the firewall at this point, not the 172.16.0.1 address

 

Are you making these changes on the live network? I don't want to be responsible for bringing down the whole thing!!!!

[MarcAlle]

Yes its the "live" network...kinda. Its not going to be user-affecting at all at this point. My firewall is connected "directly" through an inline web filter. It goes Port41 on Switch -> Barracuda Filter -> LAN Side of Firewall.

 

I ended up doing this:

 

Secondary IP on VLAN1 of 172.1.1.2

Secondary IP on Firewall of 172.1.1.1

ip route 0.0.0.0/0 172.1.1.1

 

It looks like I'm able to get to the .18 range now and everything works as intended. Thanks for your help.

[MarcAlle]

Sorry...1 more question. Vlan100 isnt working for some reason. I had mentioned before about I want it (192.168.100.0/24) to be able to see the 172.16.0.0/16 network, but only select ports see the Vlan 100 network.

 

Any ideas there. I've done this before, its just been a few years since and it was on older 3com equipment. Still a small learning curve here with the HP stuff and I'm very tired from working all weekend ha!

[themightymrp]

Oh I got so excited from the first post too

 

Can you not see the VLAN 100 from any machine on the 172.16.0.0/16 network?

[MarcAlle]

Sorry to get you too excited haha!

 

Can you not see the VLAN 100 from any machine on the 172.16.0.0/16 network?

 

That is correct, I'm not able to.

[MarcAlle]

Oh...wait a moment. I forgot to put the default gateway into the machines on the VLAN network! Everything is working properly now.

 

Now I just have to figure out HP's ACL's and I'll be all set haha!

[themightymrp]

Way-hey!! Awesome, glad you're sorted with that part.

 

I'm not 100% if the ACL's on HP stuff work the same as on Cisco gear? I would assume so. Going to dredge up some ACL knowledge as I don't do those often at all!

[themightymrp]

I know this isn't perfect but its been near 2 years since I last did these.

 

You would create an access list looking something similar to this:

 

access-list 1 permit host 172.16.?.1 192.168.100.0
access-list 1 permit host 172.16.?.2 192.168.100.0
access-list 1 deny 172.16.0.0 0.0.255.255

 

Then you would apply this to the interface of the VLAN 100 using something akin to

 

ip access-group 1 in

 

It will need tweaking but it should point you in the right direction (I hope)