Manny-Tech Posted October 5, 2023 Posted October 5, 2023 (edited) I have a networking question that I'm hoping someone can explain. On my Aruba switch I have the below configuration VMWareHostVLAN IP 172.100.200.1/26 Untagged 10-13 iLO-VLAN IP 172.100.200.65/26 Untagged 15-16 Default VLAN IP 192.168.100.100/16 Tagged 10-13 Untagged 1-9, 14, 17-24 Static routes: 0.0.0.0 - Gateway 192.168.100.1 192.168.0.0/16 - Gateway Default VLAN 172.100.200.0/26 - Gateway VMWareHostVLAN 172.100.200.64/26 - Gateway iLO-VLAN I also have the following devices with the below IPs Host1 - 172.100.200.10 Host2 - 172.100.200.11 iLo1 - 172.100.200.66 (host1) iLo2 - 172.100.200.67 (host2) If I have a client machine on 192.168.100.3 - it is able to communicate with both the host and the iLO. Looking at the switch config I can see the VMWareHost VLAN ports are tagged on the default VLAN which would make sense why I can communicate with the hosts. What I can't understand is how I can communicate with the iLO VLAN when the ports aren't tagged on the default VLAN. Anyone able to offer their knowledge on networking? Edited October 5, 2023 by Manny-Tech
Tys Posted October 5, 2023 Posted October 5, 2023 I think I understand what you mean here. So the tagging doesn't allow/prevent traffic across VLANs, that would be done by an ACL (Access Control List). The tagging just determines which VLAN (& subnet etc) a device will "sit" on. By default I imagine the switch will route traffic between all of those VLANs - the inter-VLAN routing that @Primus mentions - meaning a device on any of those VLANs, as long as the switch is its default gateway, will be able to communicate with devices on other VLANs. Are you looking to prevent traffic going between VLANs? If you can let us know your switch model I'm sure we can guide you through that.
Manny-Tech Posted October 5, 2023 Author Posted October 5, 2023 Would that be by just having 'routing' enabled on my switch on Aruba Central? I can't see anything in particular set on the VLANs
Tys Posted October 5, 2023 Posted October 5, 2023 It's been a little bit since I've used Aruba switches but I would imagine so, yes. Normally if no specific ACLs are set to specifically permit/deny traffic in certain ways I think they default to allowing all traffic. Bare in mind though, if you switch routing off on the switch entirely, any devices that are using the switch as a default gateway won't be able to get out to other VLANs or the internet anymore. If you want to be more specific (ie prevent routing between VLANs but still allow routing to the internet) you'll need an ACL. It may take a little trial and error to get that right if you've not done it for a while, I try to hold off on that sort of change until half terms here.
Manny-Tech Posted October 5, 2023 Author Posted October 5, 2023 I think I understand what you mean here. So the tagging doesn't allow/prevent traffic across VLANs, that would be done by an ACL (Access Control List). The tagging just determines which VLAN (& subnet etc) a device will "sit" on. By default I imagine the switch will route traffic between all of those VLANs - the inter-VLAN routing that @Primus mentions - meaning a device on any of those VLANs, as long as the switch is its default gateway, will be able to communicate with devices on other VLANs. Are you looking to prevent traffic going between VLANs? If you can let us know your switch model I'm sure we can guide you through that. My switch is a Aruba 2930M. I'm not trying to restrict between VLANs, I was just trying to understand how it was configured. My device gateway is 192.168.100.1 which is my router, though it does have a static route back for 172.100.0.0 to the switch for the other VLAN range. Maybe it's just my interpretation of what untagged/tagged is. I assume untagged means anything on that port is a member of that VLAN and tagged carries traffic over the ports that are tagged. Is that correct? So essentially the switch will do inter-vlan routing as long as it's all on the same switch, otherwise I need a static route to point it to my core switch where the VLANs are configured?
Aprice Posted October 6, 2023 Posted October 6, 2023 So essentially the switch will do inter-vlan routing as long as it's all on the same switch, otherwise I need a static route to point it to my core switch where the VLANs are configured? Not quite, if you haven't enabled IP routing using the command 'IP routing' then even on the same switch it wouldn't work. The client device will need to have it's gateway address set to be the IP of the interface on that VLAN. For example: VLAN 100 name ***TEST*** ip address 10.10.1.1 255.255.255.0 Then your laptop plugged into VLAN 100 would need an address in that range with 10.10.1.1 as it's default gateway. Tagged vs untagged just tells the switch whether or not to place a tag at the start of the packet indicating which VLAN that packet has come from, not useful for a desktop PC which is just on one VLAN ( so we would use untagged) Useful for a WiFi access point which has access to multiple VLANS (would be tagged on those, also usually untagged on it's management VLAN) Basically it's just a router with an interface plugged into each VLAN on the switch, if the interface doesn't have an IP then it won't be routed. And if the clients aren't pointing to that 'router' address then the switch won't route it.
keithu Posted October 6, 2023 Posted October 6, 2023 If I have a client machine on 192.168.100.3 - it is able to communicate with both the host and the iLO. Looking at the switch config I can see the VMWareHost VLAN ports are tagged on the default VLAN which would make sense why I can communicate with the hosts. What I can't understand is how I can communicate with the iLO VLAN when the ports aren't tagged on the default VLAN. Anyone able to offer their knowledge on networking? If you type tracert 172.100.200.66 on your client machine you'll be able to see how packets are routed to the ILO. 1
Davit2005 Posted October 6, 2023 Posted October 6, 2023 (edited) Once you put subnet gateways on a switch doing routing it is usually normal for it jus to allow traffic by default between those subnets. Doing a tracert from one device to the other and only getting one hop would prob be result. Edited October 6, 2023 by Davit2005
Jcx500 Posted October 6, 2023 Posted October 6, 2023 I have a networking question that I'm hoping someone can explain. On my Aruba switch I have the below configuration VMWareHostVLAN IP 172.100.200.1/26 Untagged 10-13 iLO-VLAN IP 172.100.200.65/26 Untagged 15-16 Default VLAN IP 192.168.100.100/16 Tagged 10-13 Untagged 1-9, 14, 17-24 Static routes: 0.0.0.0 - Gateway 192.168.100.1 192.168.0.0/16 - Gateway Default VLAN 172.100.200.0/26 - Gateway VMWareHostVLAN 172.100.200.64/26 - Gateway iLO-VLAN I also have the following devices with the below IPs Host1 - 172.100.200.10 Host2 - 172.100.200.11 iLo1 - 172.100.200.66 (host1) iLo2 - 172.100.200.67 (host2) If I have a client machine on 192.168.100.3 - it is able to communicate with both the host and the iLO. Looking at the switch config I can see the VMWareHost VLAN ports are tagged on the default VLAN which would make sense why I can communicate with the hosts. What I can't understand is how I can communicate with the iLO VLAN when the ports aren't tagged on the default VLAN. Anyone able to offer their knowledge on networking? Isn’t 172.100 a public range ? 1
Davit2005 Posted October 6, 2023 Posted October 6, 2023 (edited) Isn’t 172.100 a public range ? Yes but we have a large range of public IPs used internally too, best to hide any identifiable info :-). Edited October 6, 2023 by Davit2005
synaesthesia Posted October 9, 2023 Posted October 9, 2023 Using switches on aruba central? You're brave! If you have ip route on it will make the default gateways moot and enable intervlan routing by default. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now