Vlan gets DHCP address but no internet

[TRS]

I am tearing my hair out setting up a vlan for guest internet access (and I don't have much to pull out) and I would appreciate some guidance please.

Our setup is as follows:

Core Switch HP 6600ml

DHCP Range (Vlan 1 - 10.66.28.0/22, Vlan 32 - 10.66.32.0/21)

Ruckus wireless AP (Guest WLAN - Vlan ID 32)

Ruckus Zonedirector 3000 (on native Vlan ID 1)

Microtek Router (on Vlan ID 1 - 10.66.28.1)

 

I have set up the new vlan (32), tagged the relevant ports and created a new IP Scope on our DHCP Server. If clients connect to the main WLAN, they receive an address from the 10.66.28.0/22 range and connect to the internet with no problems. When connecting to the Guest WLAN, clients receive an address from the correct guest ip range (10.66.32.0/21) and when they open a browser it points them to the Ruckus Guest Authentication page. Once authenticated, they should then be redirected to their page (e.g. google.co.uk). It is obviously trying to redirect, but fails with "the site cannot be reached".

 

I think the issue is to do with routing between the two vlans, but I have checked and rechecked the switch config and can't see where I have gone wrong. I should point out that vlans are very new to me and i'm learning (this week) as I go, so I could be completely wrong here .

 

Here is my config:

ip routing

vlan 1

name "DEFAULT_VLAN"

untagged 3-15,17-18,21-24,25-28

ip address 10.66.28.39 255.255.252.0

tagged 1-2,16,19-20

ip igmp

exit

vlan 32

name "Guest_WiFi"

ip helper-address 10.66.28.42

ip address 10.66.32.4 255.255.248.0

tagged 1-2,16,19-20

exit

ip route 0.0.0.0 0.0.0.0 10.66.28.1

router rip

no auto-summary

default-metric 4

redistribute connected

redistribute static

exit

spanning-tree

vlan 1

ip rip 10.66.28.39

exit

vlan 32

ip rip 10.66.32.4

exit

no autorun

no dhcp config-file-update

no dhcp image-file-update

 

Basically, what have I missed?

 

Ta very much

 

Tony

[IrritableTech]

In your DHCP range for the new subnet have you set 10.66.32.4 as the gateway address?

[TRS]

Sorry, yes I have

[simpsonj]

Have you told your router/firewall about your vLan?

 

When setting ours up, I had to ask Virgin to add routes to the Palo Alto Routing table that was serving as our Firewall/Default Gateway. Nothing complicated (as far as I can see) just a route that says anything from the new vLan IP address range needs to be directed to the Core HP switch.

[TRS]

@simpsonj - our firewall (fortigate) has been set up by our provider (schools broadband) and I explained what I wanted to achieve and they put routes in for 10.66.32.0/21 and 10.66.28.0/22. They also control our router so I would hope they had made any changed to that too)

 

Thanks

 

Tony

Edited July 21, 2016 by TRS

[IrritableTech]

From a device in the effected VLAN ping the gateway 10.66.32.4, then the switches other IP 10.66.28.39, then your fortinet address 10.66.28.1 - which one fails?

 

BTW - that's a huge subnet for wireless - do you plan to subnet within that range?

[TRS]

From a device in the effected VLAN ping the gateway 10.66.32.4, then the switches other IP 10.66.28.39, then your fortinet address 10.66.28.1 - which one fails?

 

BTW - that's a huge subnet for wireless - do you plan to subnet within that range?

 

I can't ping any of them, but I can ping another device on the same vlan.

Yes I know and plan to subnet in that range once I've got my head round the basics

 

Thanks

 

EDIT: I can't ping any of the devices on the new vlan from the switch either, but can ping another switch that I have set up on the same vlan and can still ping everything on the native vlan (from the switch).

Edited July 21, 2016 by TRS

[sted]

can you get to websites by their ip rather than name maybe its dns related

[TRS]

can you get to websites by their ip rather than name maybe its dns related

 

That was my first thought, but no I can't get to the ip address either - something is definitely stopping me getting to the router and can't fathom out what it is.

 

Thanks

[Blue_Cookeh]

Does Ruckus do any tunneling or anything of that nature for WiFi/Guest WiFi?

 

Your switch config looks fine to me.

 

EDIT: Shouldn't cause any issues, but do you actually need RIP? (ip rip 10.66.32.4).

Edited July 21, 2016 by Blue_Cookeh

[IrritableTech]

I can't ping any of them, but I can ping another device on the same vlan.

Yes I know and plan to subnet in that range once I've got my head round the basics

 

Thanks

 

EDIT: I can't ping any of the devices on the new vlan from the switch either, but can ping another switch that I have set up on the same vlan and can still ping everything on the native vlan (from the switch).

 

Could it be an issue with your ruckus SSID and or access lists then?

 

You could eliminate Ruckus for now by physically wiring a pc to a port untagged in vlan 32

Edited July 21, 2016 by IrritableTech

[TRS]

@Blue_Cookeh not sure about tunnelling, but it denies access to any ip range. I've overruled that for the moment to try to ping

@IrritableTech I wondered that too, so have manually patched a device to the switch (on ip range 10.66.32.0/21) to completely bypass the dhcp and ruckus, but I still can't ping out which leads me back to thinking it's something with the switch config.

 

Thanks

[Blue_Cookeh]

@Blue_Cookeh not sure about tunnelling, but it denies access to any ip range. I've overruled that for the moment to try to ping

@IrritableTech I wondered that too, so have manually patched a device to the switch (on ip range 10.66.32.0/21) to completely bypass the dhcp and ruckus, but I still can't ping out which leads me back to thinking it's something with the switch config.

 

Thanks

 

Is that your full switch config? I've just pulled our's up and it's relatively similar, so I don't think that's your problem. J9728A Configuration Editor; - Pastebin.com

 

In this case devices on VLAN1 use the switch IP 10.0.48.248 for the default gateway. The switch then forwards this onto 10.0.0.1 in VLAN100 which is the SchoolsBroadband router. All VLANs route successfully between each other.

 

Maybe WiFi guest isolation is on and wreaking havoc?

Edited July 21, 2016 by Blue_Cookeh

[IrritableTech]

@Blue_Cookeh not sure about tunnelling, but it denies access to any ip range. I've overruled that for the moment to try to ping

@IrritableTech I wondered that too, so have manually patched a device to the switch (on ip range 10.66.32.0/21) to completely bypass the dhcp and ruckus, but I still can't ping out which leads me back to thinking it's something with the switch config.

 

Thanks

 

Ok - that's interesting. I know this shouldn't be needed normally - but have you restarted your switch? (sorry for the turn it off and on again type suggestion but I did have a similar issue with an HP switch once).

[TRS]

Is that your full switch config? I've just pulled our's up and it's relatively similar, so I don't think that's your problem. J9728A Configuration Editor; - Pastebin.com

 

In this case devices on VLAN1 use the switch IP 10.0.48.248 for the default gateway. The switch then forwards this onto 10.0.0.1 in VLAN100 which is the SchoolsBroadband router. All VLANs route successfully between each other.

 

Apart from a couple of trunk ports that go to another switch that's pretty much it for ours. Thanks for posting yours, I can't see anything different apart from the ip rip address in each vlan.

[TRS]

Ok - that's interesting. I know this shouldn't be needed normally - but have you restarted your switch? (sorry for the turn it off and on again type suggestion but I did have a similar issue with an HP switch once).

 

Don't worry, Ive spent two days on this now and did restart the switch this morning - there's been no config changes since I restarted

[Blue_Cookeh]

When you connected a device to your switch (I'm assuming a Windows/Mac/Linux device with no VLAN capability) with a manual IP set in the 10.66.32.0/21 range, did you patch it to an untagged port in VLAN32 and try pinging the switch on 10.66.32.4?

 

Untagged means any "normal" traffic on that particular port will be shoved into VLAN 32.

Edited July 21, 2016 by Blue_Cookeh

[IrritableTech]

Just to confirm... in your config file you have

[color=#333333]tagged 1-2,16,19-20 

You've placed the vlan ID into your ruckus SSID right? And when you tried a machine plugged directly into the switch the port you used was untagged in Vlan 32??

 

 

[/color]

[TRS]

When you connected a device to your switch (I'm assuming a Windows/Mac/Linux device with no VLAN capability) with a manual IP set in the 10.66.32.0/21 range, did you patch it to an untagged port in VLAN32 and try pinging the switch on 10.66.32.4?

 

Untagged means any "normal" traffic on that particular port will be shoved into VLAN 32.

Just to confirm... in your config file you have

[color=#333333]tagged 1-2,16,19-20 

You've placed the vlan ID into your ruckus SSID right? And when you tried a machine plugged directly into the switch the port you used was untagged in Vlan 32??

 

 

[/color]

 

 

Yes to both

 

Tagged 1-2, 19-20 trunk ports to another 6600 switch (not involved in this at the moment lol)

Tagged port 16 goes to a HP V1910 switch that the Ruckus controller sits on (with relevant ports tagged). I've also plugged the Ruckus directly into the 6600 (tagged 16) to eliminate the HP V1910 switch. So at the moment I have the Ruckus Controller (tagged 16), the Mikrotek router (untagged, which also connects to the fibre broadband) and the wired device (on vlan 32 untagged) all plugged directly into the HP 6600 switch.

 

Thanks

Edited July 21, 2016 by TRS

[Blue_Cookeh]

Yes to both

 

Tagged 1-2, 19-20 trunk ports to another 6600 switch (not involved in this at the moment lol)

Tagged port 16 goes to a HP V1910 switch that the Ruckus controller sits on (with relevant ports tagged). I've also plugged the Ruckus directly into the 6600 (tagged 16) to eliminate the HP V1910 switch. So at the moment I have the Ruckus Controller (tagged 16), the Mikrotek router (untagged, which also connects to the fibre broadband) and the wired device (on vlan 32 untagged) all plugged directly into the HP 6600 switch.

 

Thanks

 

The fact that your device cannot ping the switch IP despite being plugged into an untagged port for that VLAN is the alarming thing here, and the thing that's causing all your issues... personally I'm not sure where to go from here other than trying another switch!

[IrritableTech]

Or presuming you don't have another switch just lying about I'd try to simplify your config and build upon a working one. Keep version histories and go backwards if something doesn't work properly. Start as simple as possible - something like...

 

[color=#333333]ip routing 
[/color][color=#333333]ip route 0.0.0.0 0.0.0.0 10.66.28.1[/color]
[color=#333333]vlan 1 [/color]
[color=#333333]name "DEFAULT_VLAN" [/color]
[color=#333333]untagged 3-15,17-18,21-24,25-28 [/color]
[color=#333333]ip address 10.66.28.39 255.255.252.0 [/color]
[color=#333333]tagged 1-2,16,19-20 [/color]
[color=#333333]exit [/color]
[color=#333333]vlan 32 [/color]
[color=#333333]name "Guest_WiFi" [/color]
[color=#333333]ip helper-address 10.66.28.42 [/color]
[color=#333333]ip address 10.66.32.4 255.255.248.0 [/color]
[color=#333333]untagged PORT_NUMBER_TO_TEST_SINGLE_MACHINE[/color]
[color=#333333]exit [/color]

[TRS]

Thanks guys. I'm going to have to leave it for today, but I'll try both of your suggestions tomorrow and report back.

 

Thanks

[TRS]

Morning All.

 

Right, I am a bit closer but still no cigar ...

 

I've configured another switch (another HP 6600, so hopefully not an issue with that particular model). vlan 1 (10.66.28.0/22) and vlan 32 (10.66.32.0/21):

Running configuration:

ip routing

vlan 1

name "DEFAULT_VLAN"

untagged 3-15,17-18,21-24,25-28

ip address 10.66.28.38 255.255.252.0

tagged 1-2,16,19-20

ip igmp

exit

vlan 32

name "Guest_WiFi"

ip helper-address 10.66.28.42

ip address 10.66.32.3 255.255.248.0

tagged 1-2,16,19-20

exit

ip route 0.0.0.0 0.0.0.0 10.66.28.1

router rip

default-metric 4

redistribute connected

redistribute static

exit

spanning-tree

no dhcp config-file-update

no dhcp image-file-update

 

dhcp scope changed to 10.66.32.3 (gateway)

changed wi-fi wlan to standard usage (to eliminate guest restrictions)

switch rebooted

 

Devices connect to wlan and receive 10.66.32.0/21 ip address correctly (with default gateway as 10.66.32.3, the switch vlan 32)

Devices (wired untagged and wireless) can ping the switch on 10.66.32.3 and each other (yay!)

Still no internet access (10.66.28.1) and cannot ping 10.66.28.1

Ran Fing on a tablet connected to vlan 32 and can see all devices on 120.66.32.0/21 range, but not the router (10.66.28.1)

Ran dns lookup for google.co.uk and correctly resolves to 216.58.213.99

Tracert to google.co.uk stops at 10.66.32.3

 

So I am almost there (even though this is where I came in) and it looks like the switch is either not routing across the vlans or there is an issue with the router not accepting the 10.66.32.0 range.

 

Thanks

 

Tony

[Davit2005]

Have you tried untagging an interface on the core switch for the Guest WiFi and plug a laptop in. If this works then go to an access switch and try the same.

 

Sorry if someone else has mentioned this.

[TRS]

Have you tried untagging an interface on the core switch for the Guest WiFi and plug a laptop in. If this works then go to an access switch and try the same.

 

Sorry if someone else has mentioned this.

 

Done that, thanks though.