VLAN access to the internet

[Chass]

Hello Folks

I am relativly new to VLANS and need some advise please.

So I can create VLANS and allow devices across switches to talk to each other, no issue there.

My issue is, how do I allow a device on say, VLAN 50 to access the internet using my existing Firewall which is on a different subnet?

Here is an example below of a setup; (I lknow the 172.16 may not be routeable) but have used as an example.

VLAN 50 - Management

Default Gateway - 172.16.10.100

Mask - 255.255.255.224

Range of IPs - 172.16.10.96 - 172.16.10.127 (32 IP’s to use)

The devices on this VLAN can all communicate which each other, but I can't ping 8.8.8.8.

I am assuming I need to add some static route on the switch to reach my Firewall/ which is on the "Standard" network, i.e. The firewall (which is also my defualt gateway for the usual devices on the network) has the ip of 10.0.0.253 and a mask of 255.255.255.0.

I believe all my switches are Layer 2 and I also have a 3400cl which is Layer 3 (This is where I setup my VLAN) in the first instance.

So basically, I need to be able to be on a VLAN and to be able to use the 10.0.0.253 to access the internet.

Thanks in advance and if you do respond, please kindly keep it simple, I'd really appreciate any help as I plan to other several VLANS and need this gap in my knowledge filled! :-)

[FN-GM]

You will need to add a static route on your firewall.

Who manages this?

[Chass]

Would the static route be on the firewall or the HP switch where I have set up the VLAN? I think the Firewall will need a NAT out from that IP range as well wouldn't it?

[FN-GM]

Your NAT config will probably be ok.

 

The HP switch will be ok. It sets up its required routes when you create the VLAN. It will be your Firewall.

[Chass]

OK, so I have found how to add a static route on my firewall for the VLAN in question. But how does my VLAN know how toget to the firewall in the first place? Here are the detials for the VLAN again;

 

VLAN 50 - Management

Default Gateway - 172.16.10.100

Mask - 255.255.255.224

 

Are you saying I don't have to do ANYTHING to the VLAN setup? Remember the Firewall IP is 10.0.0.253, so how will the VLAN know how reach that? (or will it reach it BECAUSE I have setup the static route in the Firewall.)

 

Sorry to keep asking questions, I just cant afford to miss any steps when putting this in place :-)

 

 

[Davit2005]

You need a static default route on your Core switch. If I'm not mistaken.

 

Say you have your Core switch doing the routing for the vlans it won't know what to do traffic for networks it does not know about so will do nothing with them i.e. the 8.8.8.8

 

The static default route on the core switch would be like this.

i.e. 0.0.0.0 0.0.0.0 [iNTERNAL FIREWALL LAN IP ADDRESS]

[FN-GM]

What he said ^^

 

This static route will already be on your core so you shouldn't have to worry

 

0.0.0.0 0.0.0.0 [iNTERNAL FIREWALL LAN IP ADDRESS]

[Chass]

OK guys, starting to make sense now. I haven't, as yet set any default route on the core switch in which I set the VLAN 50 up on!So this is the correct command to run? (10.0.0.253 is my firewall). I assume I only have to do this on my core switch and this will become the default route for ALL VLANs on my network? Or do I have to do this for each VLAN that I want to go out on the internet?

 

ProCurve (config)# ip route 0.0.0.0 0.0.0.0 10.0.0.253

 

Is routing on by default or do I need to run a command to enable it? I will be doing this on my core switch which is Layer 3, but can i do this on a Layer2 device if needed? So once I have done this on the core switch, I can then configure the static route on the firewall in order for the firewall to let traffic out on the net from the VLAN.

 

Have I got this correct? :-)

Edited February 14, 2018 by Chass

[FN-GM]

Is this your first time making VLANS or is this an additional one?

 

My answer will change depending on the answer.

 

I have been assuming you are adding an additional to some you already have.

[Chass]

At the moment, VLAN 50 is the only one on the network. But I need to add maybe one more soon.

[Chass]

Here is my current config on the core switch.

[ITGuyWestMidlands]

Is ip routing enabled on your l3 switch ( command is ip routing) Have you assigned an IP address to vlan 50?

[FN-GM]

Your default route for the internet is at the tip of the screenshot.

 

Have you added static routes into the firewall?

[free780]

Presumably you've allowed outbound ICMP traffic from your firewall for your VLAN range?

[FN-GM]

Presumably you've allowed outbound ICMP traffic from your firewall for your VLAN range?

 

ICMP isn't required. In fact I recommend you block it.

[Chass]

I reset the switch back to factory before I put it in place, so I can only presume it is not currently on. Here are the details for the VLAN;

 

VLAN 50 - Management

Default Gateway - 172.16.10.100

Mask - 255.255.255.224

Range of IPs - 172.16.10.96 - 172.16.10.127

[Chass]

Yes I noticed this also when I took the screenshot. I haven't added the static route yet on the firewall, but plan to ASAP. Am I correct in saying that if I add another VLAN, I will need to add another static route for that VLAN as well on both the switch and the firewall? or will it just use my default static route on the switch? (which will be the same for the new VLAN anyway as it is the same firewall 10.0.0.253)

 

If this is correct, then surely just adding the static route on the firewall will allow me to ping 8.8.8.8 from any device on the VLAN 50 range? :-)

[sultan966]

Your configuration is:

VLAN 50 - Management

Default Gateway - 172.16.10.100

Mask - 255.255.255.224

Range of IPs - 172.16.10.96 - 172.16.10.127

 

You need:

Interface vlan 50

ip address 172.16.10.97 255.255.255.224 (or 172.16.10.100)

Clients of 172.16.10.96-172.16.10.127 network must have the default gateway address of 172.16.10.97 (You can use 172.16.10.100 as well)

You must exclude 172.16.19.97 from dhcp addres range because you are assigning it to Vlan50.

 

From your Layer 3 switch to firewall what is your address range? Can you ping from switch to firewall? Layer3 switch to firewall is different subnet. Ping 8.8.8.8 from switch and see if it works. It must be successful. If not problem is with the firewall. From the firewall ping 8.8.8.8 and see if it succeeds.

 

You sequence of testing will be:

1. Ping 8.8.8.8 from firewall

2. Ping 8.8.8.8 form switch

3. Ping 8.8.8.8 from client in Vlan 50

 

Do remember that clients in vlan 50 does not need to know your firewall at all. What it needs to know is the default gateway of 172.16.10.97.

 

One more thing: How would the firewall know about network 172.16.10.96-172.16.10.127? You can make a static route on Firewall which will point towards this network. Or you can use a routing protocol between Firewall and layer 3 switch. Firewall must be able to ping a client in the 172.16.10.96-172.16.10.127. Test this. If you can not then sort this out by static route or routing protocol.

Edited February 15, 2018 by sultan966

[Chass]

Great info, thank you to everyone so far. With reference to this;

 

 

One more thing: How would the firewall know about network 172.16.10.96-172.16.10.127? You can make a static route on Firewall which will point towards this network. Or you can use a routing protocol between Firewall and layer 3 switch. Firewall must be able to ping a client in the 172.16.10.96-172.16.10.127. Test this. If you can not then sort this out by static route or routing protocol.

 

So is it a case I either make the static route on the switch to point to the firewall Or make a static route on the firewall to point to the VLAN? Or is it both?

 

Edited February 15, 2018 by Chass

[sultan966]

On the firewall you have to make a static route:

 

ip route 172.16.10.96 0.0.0.31 (someting like this). Check hp command for static route.

[sultan966]

Your firewall address is 10.0.0.253.

One of the port of your layer 3 switch must have an address in this same subnet. This port is not switchport but layer 3 port means it has static ip address. Check what port is connected to Firewall. Let us say the port of your layer 3 switch that is connected to Firewall has an address of 10.0.0.100.

On the firewall issue the command:

 

ip route 172.16.10.96 0.0.0.31 10.0.0.100

 

Check all the ip addresses on the layer 3 switch. Find out what port has ip address in 10.0.0.0 network. It could be a vlan as well.

 

For example:

 

Interface vlan 1

ip address 10.0.0.100 255.255.255.0

 

Find out if a physical port or vlan port has an address in 10.0.0.0/24 network on the layer 3 switch.

Edited February 15, 2018 by sultan966

[Davit2005]

Here is my current config on the core switch.[ATTACH=CONFIG]47680[/ATTACH]

 

If you do a 'show run'

 

ip routing should be near the top of the output, I've not worked on these specific HP model though.