IrritableTech Posted August 4, 2015 Posted August 4, 2015 Normally you'd set every device on your network to use your core switch as its gateway. You've already set the switches gateway (10.122.204.49 - your smoothwall). So your client wants to send a packet to an IP address out of it's network - it sends it to it's gateway (your switch). Your switch decides if it knows about the network (one of it's other vlans) or not. If it does - it should retag it and send it to the right network /device, if not it sends the packet to its gateway (your smoothwall) for it to deal with it. Lets go back to early steps again... Plug a device into an untagged VLAN1 port - give it a fixed IP with the gateway of 10.122.204.81. Plug a device into an untagged VLAN50 port - again, give it a fixed IP with the gateway of 10.122.201.129 Can the devices ping each other? If so, your switch is routing between the networks and you can think about your DHCP server. If not - the switch config is at fault. 2
foofighterjim Posted August 4, 2015 Author Posted August 4, 2015 Plug a device into an untagged VLAN1 port - give it a fixed IP with the gateway of 10.122.204.81. Plug a device into an untagged VLAN50 port - again, give it a fixed IP with the gateway of 10.122.201.129 Can the devices ping each other? If so, your switch is routing between the networks and you can think about your DHCP server. If not - the switch config is at fault. The two devices are unable to ping each other.
IrritableTech Posted August 4, 2015 Posted August 4, 2015 Ok - so your config isn't working as yet. I know it seems daft, but i had the same issue with our 5412zl. I ended up rebooting it and routing worked. When I looked at your config earlier nothing shouted at me as an issue.
FN-GM Posted August 4, 2015 Posted August 4, 2015 The two devices are unable to ping each other. Just to confirm what are you default gateways on your devices?
foofighterjim Posted August 5, 2015 Author Posted August 5, 2015 Ok - so your config isn't working as yet. I know it seems daft, but i had the same issue with our 5412zl. I ended up rebooting it and routing worked. When I looked at your config earlier nothing shouted at me as an issue. Ok, just got in and I have done the following: Reboot switch Tested Ping - no change Updated Firmware to K.15.17.0007 Tested Ping - no change Rebooted again Tested ping - no change Just to confirm what are you default gateways on your devices? I have the VLAN 1 device set to IP 10.122.206.55, Subnet 255.255.252.0, Default Gateway 10.122.204.81. VLAN 50 device is set to IP 10.122.201.130, Subnet 255.255.255.128, Default Gateway 10.122.201.129
FN-GM Posted August 5, 2015 Posted August 5, 2015 Ok, just got in and I have done the following: Reboot switch Tested Ping - no change Updated Firmware to K.15.17.0007 Tested Ping - no change Rebooted again Tested ping - no change I have the VLAN 1 device set to IP 10.122.206.55, Subnet 255.255.252.0, Default Gateway 10.122.204.81. VLAN 50 device is set to IP 10.122.201.130, Subnet 255.255.255.128, Default Gateway 10.122.201.129 Thanks, When you say these pings fail, is this when a static IP is assigned. By the way take out your ip default-gateway command. It will cause a loop. It should be the next device up, IE your firewall or router.
foofighterjim Posted August 5, 2015 Author Posted August 5, 2015 Thanks, When you say these pings fail, is this when a static IP is assigned. By the way take out your ip default-gateway command. It will cause a loop. It should be the next device up, IE your firewall or router. Yes, the laptops are set statically. The ip default-gateway command on the switch? This is currently set to the Smoothwall IP (10.122.204.49) the router after the Smoothwall I do no control and would need to find its IP.
FN-GM Posted August 5, 2015 Posted August 5, 2015 Yes, the laptops are set statically. The ip default-gateway command on the switch? This is currently set to the Smoothwall IP (10.122.204.49) the router after the Smoothwall I do no control and would need to find its IP. Sorry ignore me then, not sure what I was thinking then. I am not that familiar with HP so there might be a config error I am missing, in principle it should work. I am Cisco certified instead so might be a HP thing. Someone else might be able to help 1
foofighterjim Posted August 5, 2015 Author Posted August 5, 2015 So I have been doing some digging on this and I can't even ping the VLAN 50 default gateway from the switch, strange as the IP should belong to it. I have run the following: show ip route IP Route Entries Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 10.122.204.0/22 DEFAULT_VLAN 1 connected 1 0 127.0.0.0/8 reject static 0 0 127.0.0.1/32 lo0 connected 1 0 As you can see there is no route defined to my VLANs could this be causing the problem, if so what do I do about it?
simpsonj Posted August 5, 2015 Posted August 5, 2015 I've been following this thread with interest, and definitely picked up one or two helpful tips! I've not quite got there yet, but I've gathered some other information from other sites that might help, and if I put my thoughts down it might help the both of us? General info: Router is a Palo Alto PA500, IP address 10.104.150.1, and is our current Default Gateway. I have limited management of the switch, so couldn't use it as the layer 3 device. It should be setup to allow any address in 10.104.x.x range to access the internet. Main Switch is a HP 5308xl, IP address 10.104.150.220 One flat network, 10.104.148.0/22, with the idea of splitting this up with vLans once I get the hang of them! For a long time I was trying to use a HP v1910, which seemed like it was up to the job, but I think sent me down a fair few blind alleys. The setup So, I wanted just one more vLan to dump guest WiFi users onto, like foofighterjim we use Aerohive, so hopefully once the vLan is setup, setting up Aerohive to use it shouldn't be an issue. I wanted it to be a large scope (512 addresses), so created a 10.104.10.1/23 dhcp scope, putting the HP Switch's vLan10 address in as the default gateway. I've created a small spreadsheet noting the IP address ranges and IP address of the switch for that address range. In this case, the switch IP address for vLan 10 is 10.104.10.250. On the switch, I created vLan 10 using the web interface and set a manual ip of 10.104.10.250 255.255.254.0 keeping the default gateway of 10.104.150.1. I then followed http://www.hp.com/rnd/support/config_examples/5300xl_dhcp_relay.pdf to set the IP helper address. Essentially telnet onto the switch using Putty, and add ip helper-address 10.104.150.24 (my dhcp server) to vLan 10. I started testing but didn't really get anywhere. If I untagged a port and attached a laptop, it didn't get an IP address from the dhcp server. If I set one manually, I could ping the switch, but that was it. I needed to do two things. One, set a route for 0.0.0.0/0 to go to 10.104.150.1 so that the switch would know to direct any unknown traffic to the router, as per this discussion: New VLAN & Router Setup on 5308xl - HP Enterprise Business Community And then, after testing on a standard laptop, set the default gateway on the dhcp server to be the switch's IP address (10.104.151.220). Then, finally, the laptop set on vLan 10, could get a IP address from the dhcp server! Now my only issue is that the laptop hasn't got internet access, which I suspect is something to do with the routing table, but I can't seem to add another 0.0.0.0/0 10.104.150.1 for vLan 10... 1
simpsonj Posted August 5, 2015 Posted August 5, 2015 Just for reference, my routing table is: IP Route Entries Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 0.0.0.0/0 10.104.150.1 1 static 1 1 10.104.10.0/23 Guest 10 connected 0 0 10.104.148.0/22 DEFAULT_VLAN 1 connected 0 0 127.0.0.0/8 reject static 0 250 127.0.0.1/32 lo0 connected 0 0
foofighterjim Posted August 5, 2015 Author Posted August 5, 2015 Now that is interesting your VLAN is showing in the routing table, I'm guessing that you did not need to add it manually? I needed to do two things. One, set a route for 0.0.0.0/0 to go to 10.104.150.1 so that the switch would know to direct any unknown traffic to the router, as per this discussion: New VLAN & Router Setup on 5308xl - HP Enterprise Business Community And then, after testing on a standard laptop, set the default gateway on the dhcp server to be the switch's IP address (10.104.151.220). Then, finally, the laptop set on vLan 10, could get a IP address from the dhcp server! Now my only issue is that the laptop hasn't got internet access, which I suspect is something to do with the routing table, but I can't seem to add another 0.0.0.0/0 10.104.150.1 for vLan 10... So we are in the same boat up until this point, I haven't looked at the DHCP server or internet connection just yet as I appear to have something rather more fundamental wrong. Or are you saying my inability to ping may be a red herring? Your internet issue may be resolved in this video: 1
IrritableTech Posted August 5, 2015 Posted August 5, 2015 (edited) So I have been doing some digging on this and I can't even ping the VLAN 50 default gateway from the switch, strange as the IP should belong to it. I have run the following: show ip route IP Route Entries Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 10.122.204.0/22 DEFAULT_VLAN 1 connected 1 0 127.0.0.0/8 reject static 0 0 127.0.0.1/32 lo0 connected 1 0 As you can see there is no route defined to my VLANs could this be causing the problem, if so what do I do about it? Yeah, you should have an entry per VLAN here... I think I may have found an (the?) issue... fingers crossed... You've got a default-gateway setup - I think that is wrong when you're doing inter vlan routing. Try this in the CLI... no default-gateway ip route 0.0.0.0 0.0.0.0 10.122.204.49 Edited August 5, 2015 by IrritableTech
simpsonj Posted August 5, 2015 Posted August 5, 2015 Now that is interesting your VLAN is showing in the routing table, I'm guessing that you did not need to add it manually? So we are in the same boat up until this point, I haven't looked at the DHCP server or internet connection just yet as I appear to have something rather more fundamental wrong. Or are you saying my inability to ping may be a red herring? Your internet issue may be resolved in this video: No, it came up automatically, I assume after I gave the HP switch an IP address on that vLan... I wasn't trying to ping anything except the switch (as I assumed it needed to be able to ping it's own default gateway!) and the DHCP server (as I assumed it needed to be able to ping it to get an IP address, though that might not necessarily be true). Basically, my first big goal was to be able to set up a vLan that would get a correct IP address from the DHCP server, which I've (finally) managed! I would be slightly worried about the lack of acknowledgement of the vLans existence on your routing table, but @irritable_tech seems to have an idea!
foofighterjim Posted August 5, 2015 Author Posted August 5, 2015 (edited) Yeah, you should have an entry per VLAN here... I think I may have found an (the?) issue... fingers crossed... You've got a default-gateway setup - I think that is wrong when you're doing inter vlan routing. Try this in the CLI... no default-gateway ip route 0.0.0.0 0.0.0.0 10.122.204.49 I just get Invalid input: default-gateway in the CLI, the new IP route has taken in the route table though. The two laptops still can't ping each other though. How do I go about getting VLAN 50 in the routing table if it is not populating automatically? Is it worth at this point factory resetting the switch and starting from scratch? The config would only take about 20 minutes at this point. Edit: I have just re-run show ip route and VLAN 50 is now showing in the routing table, still unable to ping a device in VLAN 1 though. Edited August 5, 2015 by foofighterjim
simpsonj Posted August 5, 2015 Posted August 5, 2015 The only devices I could ping in VLAN 1 from vlan10 (or 50 in your case) were devices that had the switch set to be the default gateway... Your video has slightly confirmed by worst fear that I'm going to need to do some configure work on the router so that it recognises the different vLans I'm setting up. I'll have to spend more time on this tomorrow, but can you setup vLans on your Smoothwall? If not, you may end up in my current predicament. Just wondering if there's anyway to tell the switch to strip any vLan 'flags' when sending information down the port the router is connected to, or whether I can configure something else that doesn't involve me talking to Virgin media's rather 'school unfriendly' tech support.
IrritableTech Posted August 5, 2015 Posted August 5, 2015 Now you've entered the IP route 0.0.0.0 0.0.0.0 line, can you remove the default-gateway?
FN-GM Posted August 5, 2015 Posted August 5, 2015 Just wondering if there's anyway to tell the switch to strip any vLan 'flags' when sending information down the port the router is connected to, or whether I can configure something else that doesn't involve me talking to Virgin media's rather 'school unfriendly' tech support. If it is an access port there will be no VLAN tags. The only thing that will show there is something different going on is the source IP address. If this is an issue you could setup NAT but I would avoid this. - - - Updated - - - Yeah, you should have an entry per VLAN here... I think I may have found an (the?) issue... fingers crossed... You've got a default-gateway setup - I think that is wrong when you're doing inter vlan routing. Try this in the CLI... no default-gateway ip route 0.0.0.0 0.0.0.0 10.122.204.49 That default gateway is used for the management of the switch, not for the routing of the traffic. It shouldn't make a difference.
foofighterjim Posted August 6, 2015 Author Posted August 6, 2015 (edited) The only devices I could ping in VLAN 1 from vlan10 (or 50 in your case) were devices that had the switch set to be the default gateway... This is my problem at the moment, I cant even get that far by using two laptops. Now you've entered the IP route 0.0.0.0 0.0.0.0 line, can you remove the default-gateway? No, same error. I have also tried through the web UI, I can change it but not remove it. Here is my current running config, I have removed the other VLANs for now. Running configuration: ; J8698A Configuration Editor; Created on release #K.15.17.0007 ; Ver #08:02.ff.f7.fc.7f.ff.3f.ef:ae hostname "HP-5412zl" module 1 type j9534a module 2 type j9536a module 3 type j9534a module 4 type j9534a module 5 type j8706a module 6 type j9309a trunk F1-F2 trk1 trunk timesync sntp sntp unicast sntp server priority 1 10.122.204.69 time daylight-time-rule western-europe ip route 0.0.0.0 0.0.0.0 10.122.204.49 ip routing interface F1 disable exit snmp-server community "public" unrestricted snmp-server location "Server Room" vlan 1 name "DEFAULT_VLAN" untagged A1-A23,B1-B22,C1-C24,D1-D24,E1-E24,F3-F4,Trk1 tagged A24 ip address 10.122.204.81 255.255.252.0 exit vlan 50 name "Wireless Mgmt" untagged A24 tagged B9 ip address 10.122.201.129 255.255.255.128 ip helper-address 10.122.204.69 exit spanning-tree spanning-tree Trk1 priority 4 no spanning-tree bpdu-throttle no autorun no dhcp config-file-update no dhcp image-file-update password manager Edited August 6, 2015 by foofighterjim
foofighterjim Posted August 6, 2015 Author Posted August 6, 2015 (edited) Possible development, or more information at least. I can now ping the VLAN 50 default gateway from the switch (10.122.201.129), this is probably because the routing table is now correct. The switch can't ping the device on VLAN 50 (10.122.201.130), is there the possibility that the switch is firewalling at some level (ACL?)? The switch can ping the laptop on VLAN 1. Edited August 6, 2015 by foofighterjim
simpsonj Posted August 6, 2015 Posted August 6, 2015 If it is an access port there will be no VLAN tags. The only thing that will show there is something different going on is the source IP address. If this is an issue you could setup NAT but I would avoid this. - - - Updated - - - That default gateway is used for the management of the switch, not for the routing of the traffic. It shouldn't make a difference. NAT is one of the few things I can change on our Palo Alto, so whilst I'm reticent to implement NAT if you're not recommending it, it might be my only route. Any pointers for what I should be looking to do? I've had an outside company have a look, and they've confirmed my vLan is setup as it should be. From a client on the new vLan, I can nslookup an outside website (BBC - Homepage for example) so DHCP and DNS are working fine. When I run a tracert, it hops to the switch, hops to the router, but then stops, so I'm assuming that the client can see out, but the router can't talk back to the client without some static routing being setup (ala the video @foofighterjim put up). Interestingly, I can't ping the client from the switch (target does not respond), so perhaps that's an issue too... 1
foofighterjim Posted August 6, 2015 Author Posted August 6, 2015 @simpsonj could you compare or put up your config (or pm me), I just want to see if there are any subtle differences. Failing that I will be resetting my switch config this afternoon and starting from scratch. Should only take 20 minutes to get back to this point.
simpsonj Posted August 6, 2015 Posted August 6, 2015 Stupid thing, but ensure that the firewall on the client is turned off! PM sent 1
foofighterjim Posted August 6, 2015 Author Posted August 6, 2015 (edited) So switch factory reset and settings put back in, still no luck. I am going to take the 3rd switch I have APs connected to offline tomorrow and see if I can get VLANs to talk to each other. I am starting to think there may be something wrong with the core switch. Everything I have done so far suggests that the VLANs should at least be able to talk to each other. Edited August 6, 2015 by foofighterjim
foofighterjim Posted August 11, 2015 Author Posted August 11, 2015 Stupid thing, but ensure that the firewall on the client is turned off! Guess what, Windows f****** Firewall! For anyone looking at this I would say everything up to post #41 (& #48) is all good advice. My issue was that when I originally created the VLANs the switch did not create entries in the routing table for them. I resolved this by simply deleting and recreating the VLANs, they then showed in the routing table as expected. Everything from post #42 onwards was because Windows firewall had been turned back on. Many thanks to @FN-GM, @themightymrp, @IrritableTech & @simpsonj for their help on this. 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now