HP ZL Core Switch - "Talk" to DHCP Scope

[JRA]

Morning all,

Just failing hard at something, hoping I could ask the collective for a hand-hold. :/

Visiting a new network for today and trying to complete some unfinished work on DHCP scopes and VLANs with an HP ZL core switch. Just trying to get one scope working for the sake of VoIP, otherwise a flat network.

VLANS all in place on the switch and made up a new DHCP scope for the VoIP clients, but getting no leases given, and no connectivity showing on my test client.

IP helper is in for the test VLAN, scope looks ok.

*Think* where I'm going wrong is sticking the router address "somewhere" in the core switch. I know what I'd like it to be, but actually "plugging that in" is a different matter. Or I could be going wrong somewhere entirely different.

 

If anyone out there can assist it would really really save me, thanks much for anything!

[Davit2005]

If you are routing that vlan on the core switch then put the ip address of the subnet gateway on that vlan

 

Below example

 

vlan 11

name "test"

ip address 192.168.3.1 255.255.255.0 * this will be the default gateway for the clients on the vlan

ip helper-address 192.168.1.10 * this is you dhcp server where you have a scope for the clients on the vlan

[howartp]

*Think* where I'm going wrong is sticking the router address "somewhere" in the core switch. I know what I'd like it to be, but actually "plugging that in" is a different matter. Or I could be going wrong somewhere entirely different.

The only DHCP related commands we have in our HP 5406 are the ip helper-address on each VLAN.

 

vlan 7
  name "Vlan_07"
  tagged A9-A20,C17-C18,F11-F12,Trk1-Trk3,Trk14-Trk15,Trk20
  ip helper-address 192.168.5.11
  ip address 192.168.7.254 255.255.255.0
  exit

Where are your DHCP scopes? On the Windows DNS?

 

Is the DHCP server tagged in the new VLAN?

[JRA]

If you are routing that vlan on the core switch then put the ip address of the subnet gateway on that vlan

 

Below example

 

vlan 11

name "test"

ip address 192.168.3.1 255.255.255.0 * this will be the default gateway for the clients on the vlan

ip helper-address 192.168.1.10 * this is you dhcp server where you have a scope for the clients on the vlan

You're a god amongst men thanks Davit2005!

 

Ok this might be a daft question but I'm going to ask it anyway...

 

How does the DHCP server "know" which pool/scope to assign to a client? Does something in it "see" which VLAN is being passed to it?

[JRA]

The only DHCP related commands we have in our HP 5406 are the ip helper-address on each VLAN.

 

vlan 7
  name "Vlan_07"
  tagged A9-A20,C17-C18,F11-F12,Trk1-Trk3,Trk14-Trk15,Trk20
  ip helper-address 192.168.5.11
  ip address 192.168.7.254 255.255.255.0
  exit

Where are your DHCP scopes? On the Windows DNS?

 

Is the DHCP server tagged in the new VLAN?

 

Oops didn't see you there - thanks for that also!

 

It's not tagged in the VLAN no, scopes are on the DHCP server. Not changed anything in DNS.

[Davit2005]

You're a god amongst men thanks Davit2005!

 

Ok this might be a daft question but I'm going to ask it anyway...

 

How does the DHCP server "know" which pool/scope to assign to a client? Does something in it "see" which VLAN is being passed to it?

 

That I don't know to be honest, I can only imaging it works it out from the ip gateway address/subnet/broadcast picked up from the the core switch.

[JRA]

FWIW gateway set to the (now second) address assigned to the internal NIC in Smoothwall. Shouldn't stop DHCP getting an address to a device but at least that part is done. Or looks to be!

 

No joy though, can't seem to get an address to a client with a cable into a free port on the core switch. Weird.

 

Ok so the client (which is the test device plugged into the core switch) in untagged in just the one VLAN. Server itself is in just the flat network that exists around the place. I think my answer is in there *somewhere* I'm just not able to brain it. Anyone got any thinking at all on it?

[Davit2005]

Where is the DHCP server in relation to the client that is on the core switch? I've normally had the vlan where the dhcp server located routed on the core switch.

 

It should not be impossible to setup if the dhcp server is on a different vlan with it's gateway on a different router but jus takes a few more steps.

 

A diagram of the basic network but remove anything that is identifiable such as IPs, fqdns, etc. might be of use.

Edited April 11, 2022 by Davit2005

[JRA]

I have drawn my very very best diagram:

 

 

DHCP Relay in Smoothie maybe? All the Smoothwall box is getting is the one untagged VLAN internally. Although it has the one free NIC on it.

[Davit2005]

I have drawn my very very best diagram:

 

[ATTACH=CONFIG]65245[/ATTACH]

 

DHCP Relay in Smoothie maybe? All the Smoothwall box is getting is the one untagged VLAN internally. Although it has the one free NIC on it.

 

Where is the gateway for the DC currently, is it on the smoothie?

 

Do you have any vlans with their gateways on the core switch apart from the VOIP one you are testing with?

[JRA]

Yep, gateway for that scope (which is the scope for the whole network) is the Smoothwall box.

 

Also just noticed my diagram isn't right (I crossed two cables following them.) A1 only untagged on something called the DMZ VLAN and that also goes to-and-from the Smoothwall. Updated that below:

 

 

That DMZ A1 VLAN is also tagged on the ports that feed the VMs.

 

This sure is a curious one!

 

Extremely glad to have the hand also thanks very much.

[JRA]

I'm wondering if it's even just that DHCP relay... the "IP address alias thing" (which I think is a sub-interface rightly? IDK what clever people call that) which would form the gateway address in DHCP of my VLAN in the working scenario in my head does actually ping from the server on the flat network, so it is "there."

 

I'll try that when I'm back on site tomorrow and cross fingers but thank you all loads and loads for the help so far!

 

EDIT - and on a marginally related note this was amazing: https://www.practicalnetworking.net/stand-alone/routing-between-vlans/

Edited April 12, 2022 by JRA

[JRA]

OK well today's re-visit of things sees me not wanting to involve the Smoothwall at all in the inter-VLAN routing. If I can help it.

 

The world here seems to be (for the most part) just on the default VLAN here, trying to set up my own one for the sake of VoIP, and then eventually move the lot over.

 

I have the VLAN set up on the core switch. Also enabled ip routing on it. Also also made an SVI on that vlan to the address 10.x.x.1, with a corresponding mask to the one in the DHCP scope, and that SVI will ping from a console session on the switch itself.

 

I have IP helper set to one of the DHCP servers. The gateway in that scope in DHCP itself is 10.x.x.1. However that address which does ping from the console session on the switch does not ping from the DHCP server.

 

Any ideas where to start the rummage this afternoon?

 

Thanks all!

[howartp]

Now you're heading back towards my setup - I only use one internal interface on Smoothwall for the LAN, plus the external connection.

 

Attached are screenshots of my VLAN setup on HP and Smoothwall.

 

VLANs 1-15 are the wired LAN, with DHCP on a DC (.5.11)

 

VLAN 90 is the APs.

VLANs 91 upwards are various wifi SSIDs with DHCP running on Smoothwall.

 

See if you can make sense of that and if it helps you.

[JRA]

I am grateful indeed thanks for that. I may well steal some of those ideas especially Smoothie doing the DHCP for a couple of my VLANs to come!

 

Ok, so you have things in your VLAN 1 and also VLAN 5 and they can ping each other, that right? And get addresses from DHCP on .5.11 from other VLANS, that also right?

 

How did you do the, like, doing of that part if you have a mo? As far as I can brain it, it should just need (if the LOT is plugged into the core switch in the following example:)

 

- DHCP server untagged in default VLAN 1 in port A1.

- A PC untagged in the classroom VLAN 2 in port A2.

 

Switch has ip routing enabled.

DHCP helper address has been set in VLAN 2, being the address of the DHCP server in port A1.

IP address and netmask also set up for VLAN 2. Can ping SVI of VLAN 2 from the switch CLI.

 

So far so good I'd think, but...

 

DHCP server has a scope set up on it (to ideally server leases to VLAN 2,) gateway is the IP of the SVI. However it can't ping it.

PC in A2 gets no IP address and can't ping the server nor the SVI.

 

DHCP relay is even on in the core switch:

 

 

It is proving very smelly. The pictures are ace though.

Edited April 13, 2022 by JRA

[howartp]

First of all, explanation of my network:

 

I should have said, nothing is in VLAN1 on my network.

 

VLAN2 is switches

VLAN5 is all servers

VLAN 7-13 is all PCs

VLAN 91 is ditto for wireless laptops on the LAN

 

So a PC is plugged into a port on the HP 5406zl switch, untagged in eg VLAN 7

The port has an ip-helper pointing at 192.168.5.11

 

Server 192.168.5.11 is somewhere on Trk2 (Trunk2) which is tagged in VLAN 5 and VLAN 7

(If I didn't have a fancy Dell VRTX with vSphere, then 5.11 would simply be untagged in VLAN 5 so you're correct there)

 

PC broadcasts a DHCP request on VLAN 7, is directed (via IP helper) to VLAN 5, and DHCP on 192.168.5.11 receives the broadcast request and replies with an IP address eg 192.168.7.23

PC then has its IP of 192.168.7.23 and operates in VLAN 7 s normal.

 

PC can ping server and server can ping PC.

 

I was going to say I don't have any "SVI" - i'd not heard of them until I googled them earlier today - but I think from quick reading that i'm creating them without realising, when I give an IP address to a VLAN.

 

WiFI Access Points are all plugged into a port on HP 5406ZL switch, untagged in VLAN 90.

The iPads all join an appropriate SSID (eg Staff) which has eg VLAN 93 associated with it; when they request DHCP they broadcast within VLAN 93, the DHCP service in Smoothwall responds directly to the broadcast (as it is listening on each of the VLANs ticked on the screenshot - so no IP Helpers etc required for wifi) and issues an IP eg 192.168.93.55

 

To try and answer your network, everything looks correct that you've put.

 

In DHCP do you have Scope Option 003 (Router) set to the SVI on VLAN 2. (ie mine is set to 192.168.7.254 being the VLAN IP address on VLAN 7)

In HP is A2 tagged for VLAN 1 and untagged in VLAN 2?

 

Peter

[Davit2005]

What I have seen and done is have internal wired routed on the core switch, servers routed on the firewall and WiFi routed on the firewall. That would be best option INMO if your firewall can handle it.

 

Create a vlan between your core switch and the smoothwall for routing, put an IP address at either end. You can then use these IP addresses to route traffic. i.e. 0.0.0.0/0 route on the core switch using the routing vlan IP address set on the sub-interface on the smoothwall as a default route. Then for traffic going back create a route for that subnet on the smoothwall using the routing vlans IP address set on the core switch as the next hop.

 

But I would tagg the vlan used for routing and don't use vlan 1 for the routing vlan either.

 

But if you can aim for something like that I think it should give a good building block for the future.

 

You will also prob need to do rules on the smoothwall etc. but I cannot really help on that as I've never used them.

Edited April 13, 2022 by Davit2005

[JRA]

Firstly thanks both for sticking with me on this one.

 

In DHCP do you have Scope Option 003 (Router) set to the SVI on VLAN 2. (ie mine is set to 192.168.7.254 being the VLAN IP address on VLAN 7)

In HP is A2 tagged for VLAN 1 and untagged in VLAN 2?

I do have DHCP set that way indeed yes, but both server and client are on untagged ports in their respective VLANs. And until very recently I didn't use the term "SVI" at all and would have just called it "that gateway address thing bit that is the way out of the VLAN for stuff" but all the cool folks are saying "SVI" lol.

 

 

 

What I have seen and done is have internal wired routed on the core switch, servers routed on the firewall and WiFi routed on the firewall. That would be best option INMO if your firewall can handle it.

 

Ah ok I'm with you on that I think. So, workstations and printers let's say (being good typical "internal wired" thingies) are sat on, say, a workstation VLAN 10 and a printers VLAN 20. VLANs 10 and 20 have SVIs set up on the core switch, with the IP helper address of the domain's DHCP server set there too. Hopefully I'm right so far!

 

Servers in this scenario are on VLAN 30. VLAN 30 has it's gateway as a sub-interface of a NIC on the Smoothie box. Let's also say for fun there's just no DHCP on that range neither so everything has to be assigned a static address and config to do anything, to also mean I think we wouldn't need IP helpers anywhere on that VLAN. For VLAN 30 we have tagged packets all 'round.

 

Create a vlan between your core switch and the smoothwall for routing, put an IP address at either end. You can then use these IP addresses to route traffic. i.e. 0.0.0.0/0 route on the core switch using the routing vlan IP address set on the sub-interface on the smoothwall as a default route. Then for traffic going back create a route for that subnet on the smoothwall using the routing vlans IP address set on the core switch as the next hop.

 

I must admit I am having some trouble braining this part. If you have some time, patience and sock puppets could you elaborate on that part? I think I understand that the Smoothie box in this scenario will handle the to-and-fro of server <> workstation traffic (accessing shared files and drives etc) but the "internet going in and out to things" aspect of it I'm not quite seeing.

 

I'll promise £10 to the charity of your choice if you can get me my eureka moment lol!

 

But thanks both much, I'm nearly there I hope.

[Davit2005]

I'll use my (over complicated) home network as an example.

 

Internal network (this is all wired connections) core is Stacked 2930 switches. All wired vlans are routed on this switch including hard wired clients, CCTV and VOIP and their gateway is on this core switch.

 

Between the core switch I have a vlan that I jus use for routing traffic between the core and the firewall.

 

This is a client network routed on my core switch

##### sh run vl 3032

 

Running configuration:

 

vlan 3032

name "h-wired_3032"

tagged 1/6,1/18,1/24,2/3,4/5,4/8,4/15,Trk10

untagged 4/22

ip helper-address 172.25.0.###

ip helper-address 172.25.0.###

ip helper-address 172.25.0.###

ip address 10.30.32.1 255.255.255.0

exit

 

This is the vlan I use for routing traffic between the core switch and the firewall. It only needs to be a small subnet of IP addresses so in my case there are a maximum of 14 addresses I can use which is too much in my case. I am using a completely different network range than I use for anywhere else.

 

##### sh run vl 255

 

Running configuration:

 

vlan 255

name "int_routing"

tagged 1/6,1/18,4/8,4/11,4/15,Trk10,Trk41

ip address 172.25.255.11 255.255.255.240

exit

 

On the core switch I have a static route setup which the next hop is the vlan 255 interface on the firewall i.e. 0.0.0.0/0 gateway(next hop) 172.25.255.9 . This route means traffic for any networks not directly connected (routed on) the core switch gets directed to the firewall (to do with metrics, connected networks have metric of 0 and static routes have a metric of 1) the lower metric takes precedence for routing in most cases.

 

On the firewall I have routes so the firewall knows where the network is i.e. 10.30.32.0 255.255.0.0 gateway 172.25.255.11 (the IP address used on the routing vlan on the core switch). This is so the firewall knows where the destination network is (in this case routed on another Layer 3 switch)

 

I have routes to the wireless and IoT networks that are routed on my firewall on the core switch as I have my DHCP server on a network routed on the core switch.

 

 

There is quite a bit of information there I know but once you get to understand how it works it gets a lot easier trust me and I hope I have not scared you off :-) I'd still recommend talking to Smoothwall support before you go down this route though

Edited April 14, 2022 by Davit2005

[JRA]

Thanks much for writing all that! I'm not sure I follow all the way (though I have had the covid last week and I'm more than a little foggy!) The principles though I definitely see.

LAN "normal" clients get IP addresses from your DHCP server/s, which are on the ip-helper addresses outside of their own subnet and VLAN.The "getting out to the internet" process seems to (from my slightly fuzzy-headed reading of things) rely on a couple of bits. One bit is the rule in the core switch that says "anything I myself, being the core switch, don't have a route for and which comes from any of my VLANs, I spit out to this other interface and hope that it handles it" <- that being the address of the firewall in the VLAN that only the firewall and the core switch share to to-and-fro on.

 

This rule is set up with the next hop business (I'll have to read up on how to configure that bit.)

 

The firewall has a static IP set of course so it can "be" that destination address. This is the only VLAN it sits in for the sake of passing traffic (prolly has another one for administration.)

 

The destination network it "knows" because, although the network itself is 10.30.32.0 255.255.0.0, it passes any "stuff" for that range down the interface on 172.25.255.11 (again the VLAN the core switch and the firewall use for to-and-fro talking) and the core switch "sorts out" the destination of %packet% when it gets it.

 

The wireless part I'll turn some thinking to when I get some brain back.

 

I might be getting there you know but seriously thanks for taking the time to explain it all! I'm getting there for sure. I think lol!

[Davit2005]

Thanks much for writing all that! I'm not sure I follow all the way (though I have had the covid last week and I'm more than a little foggy!) The principles though I definitely see.

LAN "normal" clients get IP addresses from your DHCP server/s, which are on the ip-helper addresses outside of their own subnet and VLAN.The "getting out to the internet" process seems to (from my slightly fuzzy-headed reading of things) rely on a couple of bits. One bit is the rule in the core switch that says "anything I myself, being the core switch, don't have a route for and which comes from any of my VLANs, I spit out to this other interface and hope that it handles it" <- that being the address of the firewall in the VLAN that only the firewall and the core switch share to to-and-fro on.

 

This rule is set up with the next hop business (I'll have to read up on how to configure that bit.)

 

The firewall has a static IP set of course so it can "be" that destination address. This is the only VLAN it sits in for the sake of passing traffic (prolly has another one for administration.)

 

The destination network it "knows" because, although the network itself is 10.30.32.0 255.255.0.0, it passes any "stuff" for that range down the interface on 172.25.255.11 (again the VLAN the core switch and the firewall use for to-and-fro talking) and the core switch "sorts out" the destination of %packet% when it gets it.

 

The wireless part I'll turn some thinking to when I get some brain back.

 

I might be getting there you know but seriously thanks for taking the time to explain it all! I'm getting there for sure. I think lol!

 

No problem, a route back from the firewall would be needed so it knows where to send the traffic back to. Routers only forward information if they have a route for it. Sometimes it can be setup to have OSPF, RIP, BGP so you don't have to manually create routes on the upstream router/firewall but that is prob overkill and needlessly complicated for your setup. I did have to setup ospfv3 on my home network to get IPv6 to work properly as could not work out what IP address to use as a next hop for the IPv6 traffic.

[JRA]

No problem, a route back from the firewall would be needed so it knows where to send the traffic back to. Routers only forward information if they have a route for it. Sometimes it can be setup to have OSPF, RIP, BGP so you don't have to manually create routes on the upstream router/firewall but that is prob overkill and needlessly complicated for your setup. I did have to setup ospfv3 on my home network to get IPv6 to work properly as could not work out what IP address to use as a next hop for the IPv6 traffic.

You have been a gent thank you.

 

What's the charity you'd like? I think they've earned the tenner lol.