Default Gateway on VLAN - Procurve

[dastrix]

Hello All,

 

I am hitting a brick wall at the moment, we have multiple VLAN's and i want the traffic to go to a different filtering system, however i am unable to change the default gateway for a separate VLAN I have to change it for all vlans.

 

Is there a way i can achieve what i am trying to do.

 

Regards

 

Chris

[IanT]

Hello,

 

Are you doing this via the Web GUI or CLI, if you want to change the default gateway for a particular VLAN see below via CLI (example):

 

conf t

vlan 201

no ip address

 

then input your new default gateway for your vlan:

 

ip address 10.52.200.254 255.255.255.0

wr mem

 

maybe do a show ip

 

test | Manual 10.52.200.254 255.255.255.0 No

Edited July 3, 2015 by IanT

[dastrix]

Ok maybe im not explaining properly we have all the Vlans setup etc but i need to tell the vlan to use a different ip for getting on the internet not using the default gateway on the switch

 

how do i tell it to use a different gateway on a vlan basis

[Marshall_IT]

Ok maybe im not explaining properly we have all the Vlans setup etc but i need to tell the vlan to use a different ip for getting on the internet not using the default gateway on the switch

 

how do i tell it to use a different gateway on a vlan basis

 

Do you mean a completely different system, as in hardware not just have a different policy applied?

 

I think you need a second router(layer3 switch) for this.

 

I'd set vlan 1 to go to router 1 and its default gw will be filter 1.

Vlan 2 can then go to router 2 and its default gw will bite filter 2.

[dastrix]

Well we have a layer 3 core and 2 filtering systems, i just want to get a vlan to access the new filtering system so that i can test it out before going live in the holidays.

[Marshall_IT]

Set the d gw to of the vlan to be the new filter rather than the layer 3 switch?

[dastrix]

tryed that wont let me it changes the default gateway for all vlans

[Marshall_IT]

Not on the layer 3 switch. On the clients. Change the option in DHCP.

[dastrix]

tried that and the traffic seems to be going though old filtering for some reason

[Marshall_IT]

Is the new filter on the same vlan as the test vlan? If not then the layer 3 switch will detect that the traffic is not local and send it down is default route.

[IanT]

I think we need a bit more information on this, if you change the default gateway in the DHCP Settings for that scope should be good.

 

Can we have some screenshots, wireshark logs, filtering system in use?

[dastrix]

i have specified a route for the vlan to send to traffic to the new filtering system.

[Marshall_IT]

i have specified a route for the vlan to send to traffic to the new filtering system.

 

Could you post the route table of the layer 3 switch?

[dastrix]

ip route 0.0.0.0 0.0.0.0 10.0.0.25 (this is current firewall and filter)

ip route 0.0.0.0 0.0.0.0 192.168.120.1

ip route 10.1.0.0 255.255.255.0 10.0.30.11

ip route 10.5.32.0 255.255.252.0 10.0.30.16 (this is new filter)

ip route 192.168.0.0 255.255.255.0 10.0.0.25

 

The current firewall is staying its just having the filtering turned off.

[Marshall_IT]

Okay, so are all these addresses on the switch apart from the 2 filters? Which I'm assuming are

Old 10.0.0.25

New 10.0.30.16

 

The subnet you want to go through the new filter is 10.5.32.0

 

That route table shouldn't work as traffic which is not bound for local traffic has to choose between the two 0.0.0.0 routes.

[dastrix]

So are you saying I need to add 0.0.0.0 0.0.0.0 10.0.30.16

[Marshall_IT]

I'm saying you shouldn't have to 0.0.0.0 0.0.0.0 routes on one router unless one is a backup route and has a higher cost to it. Otherwise it'll get confused.

[dastrix]

So if I remove both that should be enough

[dastrix]

 

I think its more to do with this default gateway that i cant change

[GeekyPete]

Your DFG has to be in the vlan you are setting it for. Think about is as "which door to use to get out of the house". It has to be a door that's actually in the house, you can't use next door's front door to leave your house. Where it goes to after that is a routing issue. So set up a static route between your DFG and the Filtering device on your layer three switch. Alternatively assign an interface on your filtering device an IP address in your vlan and set that as the DFG.

[dastrix]

The device doesn't allow multiple interfaces, we have static routes in place as i can ping etc from all the vlans and reach the management console

[GeekyPete]

The device doesn't allow multiple interfaces, we have static routes in place as i can ping etc from all the vlans and reach the management console

So you keep the same DFG as all traffic passes through it anyway. All the routing points all externally bound traffic to the internal interface of the filtering device which you also set as your proxy server whether you set it up transparent or otherwise.

[dastrix]

Not sure I follow what you are saying