Athlona Posted October 17, 2008 Posted October 17, 2008 Hello I have just purchased a HP ProCurve Access Point 10ag WW J9141A. I ran the setup fine its all working great, but I just want the Staff & Students to be able to use the Internet through the wireless setup. The problem is they can see the whole network even the servers!!! They still need to enter a user name and password to get in, but Is there any way to hide the network side of things from them all??? I have had a good look at all the setting within the Access Point couldn't see anything to do that job!!! The laptops that are going to use the wireless connection are not part of the domain at all!!! Any Ideas please??? Thanks
FN-GM Posted October 17, 2008 Posted October 17, 2008 You would need to put the AP on its own V-lan. You can do this with managed switches if you have them
spc-rocket Posted October 17, 2008 Posted October 17, 2008 Hello I have just purchased a HP ProCurve Access Point 10ag WW J9141A. I ran the setup fine its all working great, but I just want the Staff & Students to be able to use the Internet through the wireless setup. The problem is they can see the whole network even the servers!!! They still need to enter a user name and password to get in, but Is there any way to hide the network side of things from them all??? I have had a good look at all the setting within the Access Point couldn't see anything to do that job!!! The laptops that are going to use the wireless connection are not part of the domain at all!!! Any Ideas please??? Thanks Hi, You should be able to do this using radius and as others have said placing this network into its own vlan. If you access point supports vlan you can also have different ssids on different vlans to allow corporate access as well as guest access using the same APs. Ash.
Athlona Posted October 17, 2008 Author Posted October 17, 2008 I have a full HP ProCurve network and they are all managed switches:) Downloading the manuals for them now... Never setup a VLAN before any TIPS:) Thanks
Athlona Posted October 17, 2008 Author Posted October 17, 2008 Been reading up on VLANs most of today still can't understand how I can hide the network doing this method!!! Please can someone kindly explain it to poor me??? Thanks Paul
FN-GM Posted October 17, 2008 Posted October 17, 2008 Been reading up on VLANs most of today still can't understand how I can hide the network doing this method!!! Please can someone kindly explain it to poor me??? Thanks Paul Well they would be two seperate networks so they wont be able to be able to see each other.
yabbadabba Posted October 18, 2008 Posted October 18, 2008 You can use a vlan as already suggested. Use a router and put the WAP on its own network. Depending on the kit you have in house you could create a subnet and use this for the WAP and use a "router on a stick config". WAPS often have options such as "see other devices", disable this and nothing using the WAP will be able to see anything else on the same network.
Athlona Posted October 29, 2008 Author Posted October 29, 2008 I have successfully setup a 2nd VLAN on my HP ProCurve 5406zl, I can't get the port that I have tagged with VLAN2 to work on the internet at all!!! I have even just plugged in a laptop straight into that port and still no internet!!! I have checked all the correct proxy information has been entered into the laptop fine!!! Any Idea's please? As If I can't get the laptop thats into that vlan port a access point has no change!!! I think I am missing something here!!! Thanks
keithu Posted October 29, 2008 Posted October 29, 2008 You need to define an IP subnet on your new vlan and make sure there is a route defined for clients to access your proxy server and for the proxy to send replies back. Also, don't forget that while you're testing with a laptop its port will have to be an untagged access port.
Domino Posted October 29, 2008 Posted October 29, 2008 If your vlan has no access to your normal lan, it won't be able to use your proxy.
Athlona Posted October 29, 2008 Author Posted October 29, 2008 Domino thanks for this info as I also didn't think setting up a second vlan would work, but all the peps I have phoned have said it would!!! So what defines a proxy to vlan1 ONLY? Is there any way to set it up so vlans2 see the proxy? All this stress has driven me to drink!!! Thanks
keithu Posted October 29, 2008 Posted October 29, 2008 If you post your config file from the 5406 (cut and paste from the web interface) and some details of your current network (proxy IP in particular) we could probably get it going.
Domino Posted October 29, 2008 Posted October 29, 2008 what proxy are you using? do you have an ISA server? Its possible to get it working, but we need details, just setting up the vlan isn't enough
Athlona Posted October 29, 2008 Author Posted October 29, 2008 The`Local Authority`supply our schools broadband by the mean of a netpilot and a cachepilot for caching websites!!!If a PC or Laptop is on the Domain group policy has the redirect to the cachepilots IP address to that is forwarded to the netpilot... But these laptops are not part of any Domain they are all standalone units... What other information have I missed out that you would like to know? Please ask away?
Domino Posted October 29, 2008 Posted October 29, 2008 so what you'll need is a static route from the VLAN to the netpilots address. I'm not familiar with the particular hardware so can't really tell you exactly how to do it
keithu Posted October 29, 2008 Posted October 29, 2008 Athlona - we're running HP Procurves here and I'm happy to help you out, but you'll have to give more information about your current setup. Switch config and IP addresses at least.
Athlona Posted October 29, 2008 Author Posted October 29, 2008 Hi HP ProCurve 5406:- Netpilot:- Hope this is enough:)?
keithu Posted October 29, 2008 Posted October 29, 2008 That's good, but we also need the actual running config. If you click on the 'Diagnostics' tab on that first screen, then on the 'Configuration' button you should see it.
Athlona Posted October 30, 2008 Author Posted October 30, 2008 Hi keithu Please could you tell me which area of configuration you would like a screen grab off???
keithu Posted October 30, 2008 Posted October 30, 2008 In that screenshot you're on the 'Configuration' tab (top of the screen). You need to click on the 'Diagnostics' tab, which is two tabs to the right. On the screen that comes up press the 'Configuration Report' button. The text which appears in the window is what we want, but it might be a bit long for a screenshot so you may have to copy and paste it. It looks like this: Running configuration: ; J4819A Configuration Editor; Created on release #E.10.02 hostname "Server Room - ProCurve 5308xl" snmp-server location "A55" max-vlans 40 connection-rate-filter sensitivity aggressive mirror-port E14 module 1 type J4878B module 4 type J4907A module 2 type J4907A module 3 type J4878B module 5 type J4907A module 7 type J4878B blah, blah, blah.....
Athlona Posted October 30, 2008 Author Posted October 30, 2008 Here it is: Running configuration: ; J8697A Configuration Editor; Created on release #K.11.63 hostname "ProCurve Switch 5406zl" snmp-server location "CORE Switch" module 1 type J8702A module 2 type J8702A module 3 type J8705A trunk C21-C22 Trk30 LACP ip default-gateway 10.45.224.2 snmp-server community "public" Unrestricted snmp-server host 10.45.224.231 "public" vlan 1 name "DEFAULT_VLAN" untagged A1-A24,B1-B24,C1-C20,C23-C24,Trk30 ip address 10.45.224.41 255.255.240.0 exit vlan 50 name "VLAN50" ip address 10.45.250.1 255.255.240.0 tagged A12 exit spanning-tree Trk30 priority 4 password operator
keithu Posted October 30, 2008 Posted October 30, 2008 That looks okay, but a couple of things jump out at me: In VLAN50 you've defined the gateway address as 10.45.250.1 which is in the middle of the subnet. I would put it at 10.45.240.1 which is the first address. VLAN1 is similar too, but you may have your own reasons for that. It will still work as it is of course. If you're testing with a laptop plugged into port A12 you'll probably want to set that port as untagged for now. It looks like your main problem is defining a route between the laptop/access point and your proxy. On the laptop you need to make sure that its IP address is within the VLAN50 address range and its gateway address is 10.45.250.1 (or 10.45.240.1 if you change it). On the proxy you need to define a route to the VLAN50 subnet. Unfortunately I don't know anything about this proxy. Does it run on windows? Have you got admin access?
Athlona Posted October 30, 2008 Author Posted October 30, 2008 Hi keithu many thanks for all your help, I have phoned our LA how are going to setup that static route to the proxy - vlan50... Thanks Again:hand:
keithu Posted October 30, 2008 Posted October 30, 2008 (edited) You're welcome One thing you haven't mentioned is dhcp. If you want clients on vlan50 to use an existing dhcp server on vlan1 you'll have to define an 'ip helper'. To do that you log in to your switch and type the following at the command prompt: config vlan 50 ip helper-address exit wr mem You'll then have to define a new dhcp scope for the vlan50 subnet on your existing dhcp server and add a static route from the dhcp server to vlan50. Edited October 30, 2008 by keithu more info
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now