IP routing on HP/Aruba switches

[Tinribs]

OK - my last post on this got absolutely no response so I'm trying from a different direction.

Our WiFi network allows guests to connect to the internet using our infrastructure but with no access to any other parts of the school network.

I have been asked to setup a sandbox machine for the A Level ICT class that has internet access but cannot access the rest of the network.

My thought was to assign the computer one of the IPs in the range for the guest wifi. I've done this and added the relevant netmask and gateway etc.

When the computer is turned on (it's a linux box btw) it is unable to see the internet. I am also unable to ping it from the switch it is connected to but I can see its mac address on the port that it is using.

The switch can ping the relevant gateway but it can also not ping the linux box despite the box being turned on and despite the fact that it can see its MAC address.

I am assuming that this is a routing issue and that I need to add a route from the linux box to the gateway on the switch it is connected to - either that or the VLAN that is used by the guest wifi network is not routed or configured on the directly connected switch.

If I do a sh ip on the switch all the vlans bar the management vlan show as disabled under IP Config. I have no idea what that means. I can also see that there is no routing configured on any switch except for the core switches.

Can anyone assist?

[Davit2005]

How does you guest WiFi authenticate, is that an issue.

 

Not sure what router/firewall you have but you could setup an isolated vlan on that, do an ACL on the actual vlan on the core switch where that vlans default gateway is to prevent traffic to your other networks whilst allowing traffic out to the internet but TBH I'd prefer doing this on your firewall so it is very isolated, generally easier than dealing with ACLs on a core switch too.

[Tinribs]

Thanks Davit2005,

To add to an already annoying situation our entire wifi network is down as the controller (MERU) died a while back and Fortinet are struggling to locate a replacement. I have considered that might also be a blocker for this but am hoping not. My knowledge of routing is verging on the negative.

Our firewall is managed by our ISP on the cloud via Netsweeper. Do you think there is something they could arrange to assist with this?

I did consider setting up a new VLAN just for this one box - no idea how to do it and cannot find a beginner's guide on how this could be done. It is just one IP address after all - shouldn't take a genius, just someone who knows what they are doing - which, unfortunately, is not me.

[Davit2005]

Thanks Davit2005,

To add to an already annoying situation our entire wifi network is down as the controller (MERU) died a while back and Fortinet are struggling to locate a replacement. I have considered that might also be a blocker for this but am hoping not. My knowledge of routing is verging on the negative.

Our firewall is managed by our ISP on the cloud via Netsweeper. Do you think there is something they could arrange to assist with this?

I did consider setting up a new VLAN just for this one box - no idea how to do it and cannot find a beginner's guide on how this could be done. It is just one IP address after all - shouldn't take a genius, just someone who knows what they are doing - which, unfortunately, is not me.

 

Yes it is a lot for one PC. Whatever happens you will likely need to involve the firewall/router. If you setup a new vlan on the core switch there will likely need to be a route added on the firewall/router to route traffic back to the network on the core switch.

 

Once done a few it gets pretty easy but sometimes easy to miss the odd thing still :-)

[mavhc]

Let's go back a step. In order to connect to the internet a computer must have a route for the internet.

 

Start with putting the Linux computer on your normal LAN, and configuring a static ip and gateway, the gateway should set a route up automatically.

 

routel should list the routes, and you should have a default route