mikkydoos Posted April 30, 2021 Posted April 30, 2021 (edited) Hi all, Hope all are good I'm in the process of rejigging our network. New core switches install which means re-setting up and re-doing my VLANs. I've flattened the network to one subnet prior to this so I'm basically starting this from scratch. I'm having a bit of trouble getting internet access on anything but the default VLAN via smoothwall and need a bit of help. Scenario: VLANs are created on each switch 10.x.104.x /22 (Default) 10.x.108.x /22 10.x.112.x /22 etc etc Ports joined to VLAN (untagged) Trunks/VLAN tagging set on uplinks/LAGS from L2 edge switches to L3 core stack DHCP addresses are being issued & can ping between subnets All client gateways point to L3 switch VLAN IPs Static route set up on L3 switch --> next hop == Smoothwall Static route set up on Smoothwall to each VLAN address (Network/Routing/Subnets) Now.... I can't get internet on anything but the default VLAN. The only thing I haven't done is set up link from the L3 switch to Smoothwall as a trunk.... could that be it ? Bit reticent to do it in production hours. What else might I be missing ? P.S... these are fairly middle of the road Cisco SX500 L3 switches. Cheers in advance :) Edited April 30, 2021 by mikkydoos
Davit2005 Posted April 30, 2021 Posted April 30, 2021 (edited) On the smoothwall you mention the static routes back to the subnets routed on the core switch, is this using the IP address on the default vlan of the core switch to each of the vlans routed on the core switch. i.e. 10.x.108.0 /22 via 10.x.104.[iP address of default on core]/22 Not sure of exact command or syntax on the Smoothwall. Have you default route set on the Core?? In theory should not matter about the trunk as I'm assuming you are only using one vlan *the default anyway, that been the case. Edited April 30, 2021 by Davit2005 1
DGardiner Posted April 30, 2021 Posted April 30, 2021 (edited) Hi all, Hope all are good I'm in the process of rejigging our network. New core switches install which means re-setting up and re-doing my VLANs. I've flattened the network to one subnet prior to this so I'm basically starting this from scratch. I'm having a bit of trouble getting internet access on anything but the default VLAN via smoothwall and need a bit of help. Scenario: VLANs are created on each switch 10.x.104.x /22 (Default) 10.x.108.x /22 10.x.112.x /22 etc etc Ports joined to VLAN (untagged) Trunks/VLAN tagging set on uplinks/LAGS from L2 edge switches to L3 core stack DHCP addresses are being issued & can ping between subnets All client gateways point to L3 switch VLAN IPs Static route set up on L3 switch --> next hop == Smoothwall Static route set up on Smoothwall to each VLAN address (Network/Routing/Subnets) Now.... I can't get internet on anything but the default VLAN. The only thing I haven't done is set up link from the L3 switch to Smoothwall as a trunk.... could that be it ? Bit reticent to do it in production hours. What else might I be missing ? P.S... these are fairly middle of the road Cisco SX500 L3 switches. Cheers in advance :) Have you added an extra interface on the smoothwall in vlan mode? the default internal port is a basic port, wont do vlans - Im not sure of the hoop jumping to convert it since you will lose access when you delete the if...but you may be better puting the other 2 vlans on another interface? https://help.smoothwall.net/FilterFirewall/Content/3Network/1Configuration/1Interfaces/Add.htm Edited April 30, 2021 by DGardiner 1
mikkydoos Posted April 30, 2021 Author Posted April 30, 2021 @Davit2005 Just presently testing on VLAN20 Smoothwall static route is.... L3 Switch.... @DGardiner Aaah. Thats helpful... cheers. I'll have a look at that.
mikkydoos Posted April 30, 2021 Author Posted April 30, 2021 Thank you for the pointers guys. I've got it connecting now. LAN interface on Smoothwall was a basic interface, created my VLANs on another port, plugged in and bingo. Can't ping outside however. 8.8.8.8 returns destination net unreachable.
Davit2005 Posted April 30, 2021 Posted April 30, 2021 (edited) Is vlan 20 just a name for the route? Glad a bit of progress though :-) Edited April 30, 2021 by Davit2005
DGardiner Posted April 30, 2021 Posted April 30, 2021 (edited) Thank you for the pointers guys. I've got it connecting now. LAN interface on Smoothwall was a basic interface, created my VLANs on another port, plugged in and bingo. Can't ping outside however. 8.8.8.8 returns destination net unreachable. check your firewall rules, specifically check that the address object "internal networks" has populated with your vlan addresses. and the rules apply as you want. its possible youre rules have your main subnet set with ranges? if you can ping the sw interface its probably 99% firewall config just needing adjusting You will need to go into proxy > authentication policies and add a transpartent/explicit proxy for each of the new interface/vlan addresses unless youre routing between them. Also if you have the smoothwall being the "router" you wont need to mess with routes so clear anything youve manually added there - this might be misdirecting the traffic being sent back Edited April 30, 2021 by DGardiner 1
mikkydoos Posted May 4, 2021 Author Posted May 4, 2021 @DGardiner No, my L3 stack is acting as router & gateway. Smoothwall just filter/firewall. I'll have a look into that. Presumably I ned to do the same for transparent proxy too.
mikkydoos Posted May 4, 2021 Author Posted May 4, 2021 (edited) I've hit a wall.... Thanks @Dardiner ... got all the auth policies set up and they're good. I think I have a routing issue.... My OP... mainly solved... Now have internet on all VLANs so there's traffic coming back and forth from my clients and Smoothwall. However I still can't get outside other than HTTP on the VLANS. Default VLAN is fine. The gateway address on my client machine for VLAN 20 is x.x.108.1 --> the ip given to VLAN20 on the L3 switch. For the VLAN client to pick up a DHCP address I have set the gateway on my DHCP server to x.x.104.45 --> the ip assigned to the default VLAN (1) on the L3 switch. The client is getting a DHCP IP and an A record is being created. I can ping across VLANs, to the router and to Smoothwall. (Prior to this all the gateway addresses pointed to Smoothwall). ---> Can't ping outside on the DHCP server with that gateway. ---> Can't ping outside on the VLAN client with it's VLAN gateway (x.x.108.1) Switch the gateway back to Smoothwall --> Pings outside. Also, if I turn off the proxy on the client --> no HTTP access... which suggests to me the transparent/unauth proxy isn't configured correctly for the VLAN. Static route is set up on the L3 switch to Smoothwall and I've tried a static route back to the router from Smoothwall. Any suggestions ??? Edited May 4, 2021 by mikkydoos
mikkydoos Posted May 4, 2021 Author Posted May 4, 2021 (edited) Noticed this in the Smoothwall dashboard.... Have I set this up correctly ? Showing as an external interface because I've specified a gateway. Where VLANS is my virtual interface set up under Network/Interfaces. EDIT: .... and I can ping my default VLAN subnet from Smoothwall (using the EXTERNAL NIC as a source) and get a reply from clients on the default VLAN, but not to my VLAN NIC. What do I need to do to add my VLAN NIC to the external NICs config ? Edited May 4, 2021 by mikkydoos
DGardiner Posted May 4, 2021 Posted May 4, 2021 Noticed this in the Smoothwall dashboard.... Have I set this up correctly ? Showing as an external interface because I've specified a gateway. [ATTACH=CONFIG]61696[/ATTACH] Where VLANS is my virtual interface set up under Network/Interfaces. EDIT: .... and I can ping my default VLAN subnet from Smoothwall (using the EXTERNAL NIC as a source) and get a reply from clients on the default VLAN, but not to my VLAN NIC. What do I need to do to add my VLAN NIC to the external NICs config ? Id check the vlan if, it shouldnt be showing there i dont think - probably means youve set it as an external interface , none of mine show up anyway!
mikkydoos Posted May 5, 2021 Author Posted May 5, 2021 (edited) It's definitely an internal. Smoothwall support aren't accepting calls for anything apart from critical. Typical. Edited May 5, 2021 by mikkydoos
mikkydoos Posted May 5, 2021 Author Posted May 5, 2021 , and thrice Guess who put the wrong gateway address in his DHCP config ???? Thanks for the help guys, appreciated 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now