VLAN and internet routing woes

[maniac]

Hello everyone :-)

 

OK this is puzzling me, I'm trying to setup some really basic VLAN segregation on this network to allow me to control traffic a little bit e.g provision visitors internet access while shielding them from our network etc. However, I'm struggling to get the switch to do it's routing properly. This is the first time I've actually tried to configure this myself, although I know, in theory, it should work.

 

So consider this:

 

The IP address range I've chosen (as I'm re-addressing the network as well) is 10.100.0.1/21 which gives me an address range of 10.100.0.1 - 10.100.7.254

Within this I've defined several /24 ranges for different things so for example 10.100.0.1/24 is servers 10.100.1.1/24 is workstations etc.

 

I've decided to bring the internet connection in on it's own VLAN so I can use ACL's to easily control which VLANs do and do not have access to the internet, so I've defined a VLAN of 999 and given it a narrow address range of 10.100.7.248/29 (right at the top end of the range I've chosen) so I only have 6 addresses in this range, enough to provide a gateway on the switch and an address for the router. The router (which is a sonicwall NSA 250) has been given IP address 10.100.7.250 with a mask of 255.255.248.0 (so it should route for the entire address range) and connected to a port on the switch which is untagged for VLAN 999. VLAN 999 has a router address on the switch of 10.100.7.248

 

I've setup a static route on the switches routing table for 0.0.0.0/0 10.100.7.250 so it should send anything it doesn't handle to that router.

 

So with this all in place, I can ping outside the network from the switch console its self, if I ping 8.8.8.8 for example (googles DNS servers) then I get a reply when I do it on the switch, but I cannot ping outside the network from any workstation on any of the VLANs, so if for example I put a workstation on VLAN 100 with approperate IP address, it cannot ping anything outside my own network. inter-vlan routing within the switch is fine, I can ping all the gateways and things on other VLANs fine, but anything outside the network gets lost.

 

What have I done wrong? somewhere something isn't quite right, and I cannot work out where.

 

Switch config below

 

SW_H1_CAB01_01# show config

Startup configuration: 138

; J9726A Configuration Editor; Created on release #WB.15.18.0006
; Ver #09:14.29.eb.8f.fc.f3.ff.37.2d:ba

hostname "SW_H1_CAB01_01"
module 1 type j9726a
mirror-port 2
gvrp
timesync sntp
sntp unicast
sntp server priority 1 132.140.0.71
telnet-server listen data
time daylight-time-rule western-europe
web-management listen data
ip ssh listen data
ip timep manual 132.140.0.71
ip route 0.0.0.0 0.0.0.0 10.100.7.250
ip routing
snmp-server community "public" unrestricted
snmp-server listen data
snmp-server contact "Systems Manager" location "H1 Server Room"
oobm
  disable
  ip address dhcp-bootp
  exit
router rip
  redistribute connected
  exit
vlan 1
  name "DEFAULT_VLAN"
  no untagged 1-24
  untagged A1-A2,B1-B2
  no ip address
  exit
vlan 100
  name "SERVERS"
  untagged 1-12
  tagged 23-24
  ip address 10.100.0.1 255.255.255.0
  exit
vlan 110
  name "WORKSTATIONS"
  tagged 23-24
  ip address 10.100.1.1 255.255.255.0
  exit
vlan 120
  name "STUDIO"
  tagged 23-24
  ip address 10.100.2.1 255.255.255.0
  exit
vlan 130
  name "SFDC"
  tagged 23-24
  ip address 10.100.3.1 255.255.255.0
  exit
vlan 200
  name "MANAGEMENT"
  tagged 1-24
  ip address 172.16.0.1 255.255.255.0
  exit
vlan 210
  name "OLD NETWORK 132.140 range"
  untagged 13-19
  tagged 23-24
  ip address 132.140.0.250 255.255.0.0
  exit
vlan 300
  name "iSCSI"
  untagged 21-22
  tagged 23-24
  no ip address
  exit
vlan 800
  name "VISITORS"
  tagged 23-24
  ip address 192.168.0.1 255.255.255.0
  exit
vlan 999
  name "INTERNET"
  untagged 20
  ip address 10.100.7.249 255.255.255.248
  exit
primary-vlan 200
tftp server listen data
password manager
password operator

 

Regards,

 

Mike.

Edited October 30, 2015 by maniac

[Davit2005]

Your Router may need to have a route back to the other vLANs.

 

i.e. Put a route on the router back to the vLAN subnet via the hop of your core switch

[maniac]

Your Router may need to have a route back to the other vLANs.

 

i.e. Put a route on the router back to the vLAN subnet via the hop of your core switch

 

Obvious when I think about it. The switch is pinging the router from the default gateway on that VLAN so it doesn't need any routing, of course things on other VLANS do. That makes perfect sense now.

 

Cheers,

 

Mike.

[maniac]

You were correct by the way - the router had automatically added a route for the subnet, but with no gateway because it presumes it is acting as the gateway. I added the same route manually but specifying the gateway as well and it all sprung into action. It's always the simple little things isn't it.

 

Mike.

[Davit2005]

You were correct by the way - the router had automatically added a route for the subnet, but with no gateway because it presumes it is acting as the gateway. I added the same route manually but specifying the gateway as well and it all sprung into action. It's always the simple little things isn't it.

 

Mike.

 

No problem. Glad you got it working