trannghia Posted November 14, 2015 Posted November 14, 2015 Dear All, I have a diagram below. http://s20.postimg.org/j3lreg771/vlan2.jpg On Windows Server i have created 2 DHCP scope: - Scope1: 192.168.30.x/24 (normal vlan) - Scope2: 192.168.100.x/24 (vlan2) I'm using SW HP 6600-24 core sw and have created a new vlan named:vlan 100 (untaged: 4,11-12), but when i connected the cable form port 4 to the client still won't automatically get a IP (192.168.100.x) form DHCP server. I'm sure I've missed something/set something wrong but can't figure out what! http://awscdn.cdngeek.net/images/smilies/confused.png Any helps are welcome. HP 6600 config ip default-gateway 192.168.30.1 ip routing vlan 1 name "DEFAULT_VLAN" untagged 1-3,5-10,13-23,Trk1 ip address 192.168.30.40 255.255.254.0 no untagged 4,11-12 exit vlan 100 name "VLAN100" untagged 4,11-12 ip helper-address 192.168.30.5 ip address 192.168.100.100 255.255.255.0 exit fault-finder bad-driver sensitivity high gvrp dhcp-snooping dhcp-snooping authorized-server 192.168.30.5 dhcp-snooping authorized-server 192.168.30.6 dhcp-snooping vlan 1
IanT Posted November 14, 2015 Posted November 14, 2015 Dear All, I have a diagram below. http://s20.postimg.org/j3lreg771/vlan2.jpg On Windows Server i have created 2 DHCP scope: - Scope1: 192.168.30.x/24 (normal vlan) - Scope2: 192.168.100.x/24 (vlan2) I'm using SW HP 6600-24 core sw and have created a new vlan named:vlan 100 (untaged: 4,11-12), but when i connected the cable form port 4 to the client still won't automatically get a IP (192.168.100.x) form DHCP server. I'm sure I've missed something/set something wrong but can't figure out what! http://awscdn.cdngeek.net/images/smilies/confused.png Any helps are welcome. HP 6600 config ip default-gateway 192.168.30.1 ip routing vlan 1 name "DEFAULT_VLAN" untagged 1-3,5-10,13-23,Trk1 ip address 192.168.30.40 255.255.254.0 no untagged 4,11-12 exit vlan 100 name "VLAN100" untagged 4,11-12 ip helper-address 192.168.30.5 ip address 192.168.100.100 255.255.255.0 exit fault-finder bad-driver sensitivity high gvrp dhcp-snooping dhcp-snooping authorized-server 192.168.30.5 dhcp-snooping authorized-server 192.168.30.6 dhcp-snooping vlan 1 What happens if you give that client a static IP Address? Can you ping the server? Is the DHCP authorized? HP Procurve DHCP Snooping - Stefan Lindblom 1
ass17 Posted November 14, 2015 Posted November 14, 2015 Defo disable DHCP snooping see if you get a DHCP address, if that fails, set the static IP & gateway on the client PC to see if you can ping the DHCP server. Let us know you results 1
trannghia Posted November 16, 2015 Author Posted November 16, 2015 Dear All, Thanks for your help. What happens if you give that client a static IP Address? - When I set the IP static, (192.168.100.10 sm: 255.255.255.0, GW: 192.168.100.100) I cannot ping to the server although all windows firewall and antivirus are disabled. Defo disable DHCP snooping see if you get a DHCP address, if that fails, set the static IP & gateway on the client PC to see if you can ping the DHCP server. Let us know you results - I have try to disabled DHCP Snooping but nothing to change. I don't know what happened ?Please help me. Thanks.
Davit2005 Posted November 16, 2015 Posted November 16, 2015 What is the gateway set on the DHCP server, is it set to the switch vLAN 192.168.30.40 1
trannghia Posted November 16, 2015 Author Posted November 16, 2015 What is the gateway set on the DHCP server, is it set to the switch vLAN 192.168.30.40 - The gateway set on the dhcp server is: 192.168.30.1 is it set to the switch vLAN 192.168.30.40 - Your mean i must set the gateway for this vlan right ?
Davit2005 Posted November 16, 2015 Posted November 16, 2015 My thinking is that unless default gateway of DHCP is set correctly that the server will not be able to return traffic to. Give it a try out of hours if need be, as long as you are on the site and not accessing server through RDP you should be safe enough to get back if necessary. 1
ass17 Posted November 16, 2015 Posted November 16, 2015 Because your firewall is the switches default gateway you need some static routes setting up RIP or OSPF should do it.
Davit2005 Posted November 16, 2015 Posted November 16, 2015 Shouldn't need anything done on the firewall IMO for this to work, However as @ass17 suggest you may need a route on firewall so it can forward traffic back onto any additional subnets for internet traffic to return. Many org's like mine and even my home network the layer 3 switch does the intervlan routing. Normally on HPs it does not matter what the Default Gateway is set to if you enable IP Routing, you just set a default route to the next hop out of your network i.e. your firewall 0.0.0.0 0.0.0.0 192.168.30.1 . 1
ass17 Posted November 16, 2015 Posted November 16, 2015 Shouldn't need anything done on the firewall IMO for this to work, However as @ass17 suggest you may need a route on firewall so it can forward traffic back onto any additional subnets for internet traffic to return. Many org's like mine and even my home network the layer 3 switch does the intervlan routing. Normally on HPs it does not matter what the Default Gateway is set to if you enable IP Routing, you just set a default route to the next hop out of your network i.e. your firewall 0.0.0.0 0.0.0.0 192.168.30.1 . Yes, quite correct as HP switches only need IP ROUTING and a next hop, bobs your uncle! Our setup is different and more complex than yours hence my first post.. :-)
trannghia Posted November 17, 2015 Author Posted November 17, 2015 Because your firewall is the switches default gateway you need some static routes setting up RIP or OSPF should do it. Hi @ass17 you mean, Now i must have to config the routers for my VLAN2 (on the SW) or on Firewall. Please advice. Thanks.
Davit2005 Posted November 17, 2015 Posted November 17, 2015 (edited) You will need at least static route/s on the Firewall to the subnet otherwise the Firewall will not know where to send returning traffic. In the same way your switch needs a hop to the Internet via your Firewall, the firewall must know where to return the traffic to. Do you go through an LEA service at all or do you have a public IP address on your firewall??? We have about 30 vLANS here and to be honest keeping the static routes up to date is not really a problem because we rarely add extra vLANs. If we add any extra vLANS these have to be configured elsewhere on the firewall in our setup anyway. Edited November 17, 2015 by Davit2005 1
trannghia Posted November 17, 2015 Author Posted November 17, 2015 Because my HP SW can be routing and I have changed the IP gateway on my DHCP Server to: 30.40. Now, everything are working fine. Thanks for your supports.
Julian Posted November 17, 2015 Posted November 17, 2015 Your routing table is empty. Which is why your switch can not route the data. Sorry that I can not give much more advise my knowledge of layer 3 routing is limited. I can tell you that for HP Switches, you configure the routing table, the access control lists, and the ip helper address (required for DHCP server) from the command line. Please find below a working HP switch configuration, for many vlans We paid a expert to do the configuration. We are using one vlan per end location, broadcast storms only take down one vlan! Running configuration: ; J8692A Configuration Editor; Created on release #K.15.16.0005 ; Ver #06:74.fc.7f.ff.3f.ef:de hostname "HP-3500YL-CORE-0" module 1 type j86xxa module 3 type j9312a console idle-timeout 600 console idle-timeout serial-usb 600 fault-finder broadcast-storm sensitivity high fault-finder bad-driver sensitivity high fault-finder bad-transceiver sensitivity high fault-finder bad-cable sensitivity high fault-finder too-long-cable sensitivity high fault-finder over-bandwidth sensitivity high fault-finder loss-of-link sensitivity high fault-finder duplex-mismatch-hdx sensitivity high fault-finder duplex-mismatch-fdx sensitivity high trunk 11-14 trk1 lacp trunk 21,24 trk2 lacp trunk A3-A4 trk3 trunk power-over-ethernet pre-std-detect ports 1-10,15-19 qos protocol ip priority 4 timesync sntp sntp unicast sntp server priority 1 172.16.199.201 stack commander "HP-3500YL-CORE" stack member 1 mac-address c4346b-a41d00 time daylight-time-rule western-europe ip access-list extended "101" exit ip default-gateway 192.168.248.49 no ip ssh ip directed-broadcast ip route 0.0.0.0 0.0.0.0 192.168.248.49 ip routing interface 11 no power-over-ethernet exit interface 12 no power-over-ethernet exit interface 13 no power-over-ethernet exit interface 14 no power-over-ethernet exit interface 18 name "Meru" exit interface 20 name "HGfL Router" no power-over-ethernet speed-duplex 100-full exit snmp-server community "netAdmin" unrestricted snmp-server host 192.168.0.251 community "public" snmp-server host 192.168.0.248 community "public" snmp-server host 192.168.0.151 community "public" snmp-server contact "Mr J Hill" location "ICT Server Room" vlan 1 name "DEFAULT_VLAN" no untagged 2-4,6-8,16,20 untagged 1,5,9-10,15,17-19,22-23,A1-A2,Trk1-Trk3 ip igmp exit vlan 99 name "VLAN99" no ip address exit vlan 100 name "IT" tagged 10,Trk1-Trk3 ip address 172.16.200.30 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 101 name "OldMusicArea" tagged Trk1,Trk3 ip address 172.16.196.126 255.255.255.192 ip address 172.16.200.62 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 102 name "6thFormBlock" tagged 17,Trk3 ip address 172.16.200.94 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 103 name "MediaStudies" tagged 22,Trk3 ip address 172.16.200.126 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 104 name "MathsClassrooms" tagged Trk3 ip address 172.16.200.158 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 105 name "Art_Drama" tagged Trk3 ip address 172.16.200.190 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 106 name "AdminBlock" tagged 17,Trk3 ip address 172.16.196.190 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 107 name "ICT_Staff_Staffroom" tagged Trk1,Trk3 ip address 172.16.200.254 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 108 name "D&TBlock" tagged 23,Trk3 ip address 172.16.196.254 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 109 name "MFL_Geography" tagged 10,Trk3 ip address 172.16.201.62 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 110 name "H3" tagged Trk1,Trk3 ip address 172.16.201.94 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 111 name "H4" tagged Trk3 ip address 172.16.201.126 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 112 name "EnglishLib" tagged 17,Trk3 ip address 172.16.201.190 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 113 name "CR3" untagged 2,6,16 tagged 19,Trk1,Trk3 ip address 172.16.201.254 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 114 name "CR1" tagged Trk1,Trk3 ip address 172.16.202.62 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 115 name "CR2" tagged 9,Trk3 ip address 172.16.202.126 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 116 name "S11" tagged Trk2-Trk3 ip address 172.16.202.190 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 117 name "NewMusic" tagged Trk3 ip address 172.16.202.254 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 118 name "CR4" tagged Trk1,Trk3 ip address 172.16.203.62 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 119 name "S13" tagged Trk2-Trk3 ip address 172.16.203.126 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 120 name "Wireless" tagged 18,Trk1,Trk3 ip address 172.16.203.222 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 121 name "Servers" tagged Trk1-Trk3 ip address 172.16.203.254 255.255.255.224 ip helper-address 172.16.199.201 exit vlan 122 name "FoodTechLSD" tagged Trk1,Trk3 ip address 172.16.203.190 255.255.255.192 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 123 name "SchoolHouse" tagged Trk1,Trk3 ip address 172.16.196.30 255.255.255.224 ip helper-address 172.16.199.202 ip helper-address 172.16.199.201 exit vlan 124 name "EPOS" tagged Trk1,Trk3 ip address 172.16.200.222 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 125 name "PE" tagged 17,Trk3 ip address 172.16.201.30 255.255.255.224 ip helper-address 172.16.199.201 ip helper-address 172.16.199.202 exit vlan 199 name "HGfLRouter" untagged 20 tagged Trk3 ip address 192.168.248.50 255.255.255.252 exit vlan 201 name "Servers2" untagged 3-4,7-8 tagged Trk2-Trk3 ip address 172.16.199.254 255.255.255.192 exit vlan 202 name "Student-W" tagged 10,18,22-23,Trk2-Trk3 no ip address ip helper-address 10.0.41.252 exit vlan 203 name "Staff-W" tagged 10,18,Trk2-Trk3 no ip address ip helper-address 10.0.43.252 exit vlan 300 name "Telephone" tagged 10,17 ip address 172.17.54.253 255.255.255.0 exit spanning-tree spanning-tree Trk1 priority 4 spanning-tree Trk2 priority 4 spanning-tree Trk3 priority 4 no autorun password manager 1
Davit2005 Posted November 17, 2015 Posted November 17, 2015 Because my HP SW can be routing and I have changed the IP gateway on my DHCP Server to: 30.40. Now, everything are working fine. Thanks for your supports. No Problem,
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now