VLANs

[Jawloms]

So I'm trying to get to grips with VLANs, routing etc and am really struggling. It very quickly gets very complicated from what I can see! I'll give a little info on what I have;

 

Internet connection provided by LA. This gives me a router in my server room which I can't configure at all. This router gives me (we'll say) 10.163.75.0 - 10.163.76.255 (255.255.254.0) through one port of the router and 10.169.55.0 (255.255.255.0) coming out of another port. The LA's box is the default gateway for both networks at 10.163.75.1 and 10.169.55.1. Both of these ports are connected to my HP 5400zl switch (10.163.75.2). I have setup a VLAN 51 in that switch, given that an IP of 10.169.55.2, and put the 10.169.55.0 connection from the LA router in it. I want my 5400zl to be my DG so that I can setup a few VLANs and route between them. How do I get the switch to route though? If I go in to the menu and go to the IP configuration then "IP routing" is enabled, but obviously I can't just specify 10.169.55.2 as my DG on the clients and expect everything to work. We are growing too big for our IP range so I want to do things like bung the WAPs and printers on their own IP ranges ad then route between them. I've read so many different pages and manuals it's just confusing the hell out of me. Where do I go from here please? I also have edge switches (another 5400zl and two HP 2920) with the VLAN setup in them. Will they require any additional setup (other than obviously tagging/untagging ports appropriately) for the routing to work?

 

Thank you

 

Stuart

[TechMonkey]

I am not fluent in VLANs but my understanding of our network is:

 

- Our core switch (a 5400zl funnily enough) is the gateway for all VLANs. The Router is the gateway for the core switch.]

- All VLANs go back to the core switch and that routes to the correct VLAN based on IP. I can't see anything in our config that specifies what can route to anything else

- We do have some IP HELPER-ADDRESS commands to help point at our DCs and some IP FORWARD-PROTOCOL commands to forward udp packets for PXE boot and WOL.

 

I do need to look into it further as I want to secure our Guest Wireless VLAN to not have any contact with our network at all, but currently you can scan and see servers.

 

Hope that helps.

[Davit2005]

You need to enable ip routing on the core switch which you have done

 

Put a default route of 0.0.0.0 0.0.0.0 [next hop i.e. ROUTER IP ADDRESS]

 

Your core switch can be the gateway for all the Workstations and servers on the different vLANS that is how it should work, BUT then the LA need to add a route to each vlan via your core switch otherwise traffic will not get back to the clients that are on the different network.

 

Hope this make sense.

[Jawloms]

BUT then the LA need to add a route to each vlan via your core switch

 

I'm slightly confused by this statement as I want my 5400zl to be my core switch. I was hoping that my switch could do everything with all traffic over all VLANs, and if it's an Internet request then forward it to the LA box?

Edited June 2, 2016 by Jawloms

[FN-GM]

BUT then the LA need to add a route to each vlan via your core switch otherwise traffic will not get back to the clients that are on the different network.

 

No they don't as long as

 

1. He subnets within his exist assigned LA range.

2. He uses the LA router as the default route (as you stated) on the core switch.

 

Also you do not use the core switch IP for the DG of your clients. The DG for the clients is the vlan interface IP address assigned the VLAN the computer is a member of.

Edited June 2, 2016 by FN-GM

[keithu]

I'm slightly confused by this statement as I want my 5400zl to be my core switch. I was hoping that my switch could do everything with all traffic over all VLANs, and if it's an Internet request then forward it to the LA box?

 

Hi

 

As long as each VLAN is configured with its correct IP address and routing is enabled on the switch it should work fine.

 

There is potentially a subtle problem with the way you have connected the switch and the router though. Switches learn where other network devices are by keeping a record of their mac addresses in an internal table (the Forwarding Databse). The HP switch is pretty clever and keeps a database for each VLAN but it's quite possible that the router only has a single database. In this case the router would get very confused as it would appear that the HP switch is continually moving from one port to the other as it sees packets with the same mac address arrive from both ports. This is bad news as packets arriving on what it thinks is the 'wrong' port will be dropped, which leads to intermittent connections and a lot of head scratching.

 

You can get around this problem by using a single connection between your router and switch. You will have to ask your service provider to route both subnets to the same port (with VLAN tags if you like).

[Jawloms]

Also you do not use the core switch IP for the DG of your clients. The DG for the clients is the vlan interface IP address assigned the VLAN the computer is a member of.

 

I've given the VLAN the IP address of 10.169.55.2 in my 5400zl, and then set that as the DG on the client. So does that mean that if I put "ip route 0.0.0.0 0.0.0.0 10.169.55.1" (as @Davit2005 says) then the client should work as 10.169.55.1 is the IP of the LA DG?

 

Regarding the subnetting within my assigned LA range, would I be right to assume that is only the case if the devices need to be accessible from the outside world? For example, could I bung all my printers on 10.10.10.0 as they would only be accessed from within school, and they don't require Internet access?

 

Thank you

 

Stuart

[FN-GM]

I've given the VLAN the IP address of 10.169.55.2 in my 5400zl, and then set that as the DG on the client.

 

Yes, but the machine needs to be in the same vlan that the IP is assigned to.

So does that mean that if I put "ip route 0.0.0.0 0.0.0.0 10.169.55.1" (as @Davit2005 says) then the client should work as 10.169.55.1 is the IP of the LA DG?

 

Providing 10.169.55.1 is in your LA assigned range.

 

Regarding the subnetting within my assigned LA range, would I be right to assume that is only the case if the devices need to be accessible from the outside world? For example, could I bung all my printers on 10.10.10.0 as they would only be accessed from within school, and they don't require Internet access?

 

That is correct yes

[Jawloms]

Brilliant, thank you. Now working. So last question (he said optimistically);

 

If I now setup my printers in 10.10.10.x, will everything just see them so long as I give their VLAN an IP in the 10.10.10.x range and tag their ports in it, or is there something else I need to do? Another ip route?

[Davit2005]

Once you add a vLAN with an IP Address it should get an added ip route automatically because it is directly connected.

[Jawloms]

OK, so it wasn't my last question

 

So far I've learnt more in the last couple of hours from this thread than in my previous days of Googling!

 

I now have a couple of VLANs setup and all can see everything else (huzzah!), however the Internet no longer works. If I do a tracert to the IP address of the LA's PROXY, the first hop is my DG (the IP of the VLAN in my switch) and then it gets no further. Any thoughts please?

[Davit2005]

I'm thinking that the LA router needs the routes back to the vLAN otherwise it won't ba able to send the reply back.

 

Speak to the LA and get them to put a route in that uses your core switch as a HOP. this IP address will be on the same subnet as the LA's router.

Edited June 2, 2016 by Davit2005

[FN-GM]

I'm thinking that the LA router needs the routes back to the vLAN otherwise it won't ba able to send the reply back.

 

Speak to the LA and get them to put a route in that uses your core switch as a HOP. this IP address will be on the same subnet as the LA's router.

 

This is not correct. If the OP keeps within the allocated LA scope, it doesn't need a route back as the router interface is also configured within that scope, making it directly connected.

 

 

 

@Jawloms is it setup like in post 5? It sounds like your default route isn't setup or the routing between your L3 switch and the LA router. What does the configuration between your L3 switch and the LA router look like?

Edited June 2, 2016 by FN-GM

[Davit2005]

Can you post the config of the core switch, please obscure anything private, confidential or organisation specific.

[Jawloms]

I'll try and clarify what I have, and have done.

 

County have given me 10.169.55.x.

My default gateway (as far as County is concerned) should be 10.169.55.1 which is their Juniper box (which in turn connects to my BT broadband box. I assume the Juniper controls a VPN between me and County).

I have set up a VLAN (51) with an IP address of 10.169.55.2 in my 5400zl.

I have untagged a port on the switch and plugged a laptop into it, and given it an IP of 10.169.55.34 and a DG of 10.169.55.2 (the IP of the VLAN I setup). DNS is 10.169.55.11 and is a 2012R2 box.

On my 5400zl, I put "ip route 0.0.0.0 0.0.0.0 10.169.55.1"

If I type "show ip route" on my 5400zl then one of the lines says "0.0.0.0/0 10.169.55.1 51 Static"

 

Does that answer the question @FN-GM?

[FN-GM]

It doesn't no. There will be some type of connection between the Juniper box and your L3 switch. How is that configured?

[FN-GM]

I am not sure about HP but in Cisco L3 switches have IP Routing disabled by default. Has IP routing been enabled on your switch?

[MS2011]

Hi,

 

I am in same situation like @Jawloms.

 

Internet connection provided by LA. The router and firewall managed by them, /21 network - no Vlans. They are offering us another /20 range to create Vlans.

 

Never done it before, if I create the Vlans on our new L3 core switch, do you I need create Vlans on all the switches across the campus?

 

I am also looking a software to create network map room by room.

 

Thanks

[Jawloms]

It doesn't no. There will be some type of connection between the Juniper box and your L3 switch. How is that configured?

 

Other than one is plugged in to the other, nothing is configured.

 

I am not sure about HP but in Cisco L3 switches have IP Routing disabled by default. Has IP routing been enabled on your switch?

 

If I go to the IP Configuration in the menu of my 5400zl, it says "IP Routing : Enabled"

[FN-GM]

Other than one is plugged in to the other, nothing is configured.

 

What VLAN is it plugged into? Is it on the same VLAN as you are running the traceroute from?

[Jawloms]

Ah, sorry, yes. The port on my switch which the LA's router is plugged in to is untagged in VLAN 51, which is the same VLAN as the laptop I'm running the tracert from. There is no config on my part done (or possible) to the LA's router. Edited June 3, 2016 by Jawloms

[Jawloms]

Just to add to this. If I specify the laptop's DG as the LA's router and run a tracert to their PROXY, it goes over six hops. If I specify my switch as the DG and tracert to their PROXY, the first hop is my switch and then it goes no further, but if I tracert to the third hop, that works and specifies my switch, then the LA box, then a hop I am assuming somewhere in the LA network, then another in their network. I hope that makes sense as I don't really want to paste all the results in here with all those IP addresses.

[Jawloms]

Nevermind, sorted now. There was another spurious ip route in there which I have now removed and all is working. Thanks to all for your input.

 

Stuart

[lostsoul]

Do you have a gateway of last resort configured on your HP switch?