Help... I need a Procurve Pro!

[Ric_]

I'm having a couple of probs configuring my procurve VLANs and could do with talking to someone. If someone could PM me their phone number I would be grateful!

[ChrisH]

I hope your doing something horribly complicated (probably knowing you ) as I will be doing mine next week and was expecting a nice easy experience like my old 3 Coms.

[DMcCoy]

Configure it from telnet. Just login via its ip and then type 'menu'. The web interface from vlan configuration is rather limited and breaks when you use any slighly different combination of features that it is expecting.

 

I've only done layer 2 vlans on the primary switch, although I have played around with the dynamic vlans a little. I can't move to layer 3 yet as I want to get more of the switches replaced with procurves first. Plus trying to work out vlans, subnetting, routing and 802.1x at the same time made my head hurt

[ChrisH]

Just doing subnetting makes my head hurt :?

[Sylv3r]

This is something I was looking to do with my procurve switches. Do anybody have any instructions / user guides on getting started.

 

Cheers

[Ric_]

@DMcCoy: I think it might be something to do with the vast array of options. You get tagged, untagged, off and another option IIRC. I think it is right but I'm not confident.

 

It does indeed make your head hurt trying to figure this out... hence why I printed out A4 pics of the switches from Visio and heavily annotated which port needed to be in which VLAN.

 

@ChrisH: Surely 3 VLANs isn't that complicated

[ChrisH]

You only need tagged on your links really so traffic from all the VLANs can travel accross them. So basically if one port needs to be in more than one VLAN you do it with tagging.

[projector1]

what are the benefits of vlans

[CyberNerd]

what are the benefits of vlans

 

you can subnet the network but still use the existing switches (and cabling with tagged vlans) rather than build another physical network around your existing iinfrastructure. Subnetting reduces broadcast traffic, increases security and improves network performance.

[Geoff]

VLAN's allow you to seperate your physical network into several logical networks. Machines on each of these logical networks cannot see each other.

[thom]

I am also having trouble understanding the difference between tagged, untagged and off.

 

At the moment we have a switch that could have

a phone: VLAN 61(routed to a MITEL server)

an admin pc: VLAN 2 (goes to the admin DC)

or a classroom pc : VLAN 3 (goes to the curriculum DC).

It has a fibre uplink to our core switch.

 

Now, I thought, for instance, that if the device connected to port 1 was a classroom PC I need to set the curriculm vlan to tagged and the uplink to tagged for all vlans.

What else needs to be set up on port 1? Should the admin and phone vlan be set up as untagged or no? What's the difference or am I thinking about this in completely the wrong way?

[DMcCoy]

Untagged - this is port based, all traffic from the port is sent to this vlan if it is untagged (no vlan support is needed by the client with this setting)

 

Tagged - traffic tagged by the client will be sent to the relevant vlan if it has been set to tagged.

 

You can not mix tagged and untagged (I guess it might be possible but it would be complicated).

 

I assume that off means that that vlan is not accessable to that port.

 

If you are setting the ports as tagged are you also configuring the clients to use that vlan?

[DMcCoy]

I've only done a little testing with the propergation of vlans from the core switch so I'm not sure about the tagging for the uplink.

 

If you only need to see one vlan then you can leave it on untagged and turn vlan options off on the client, or you can tag it on the vlan they will use and put the client on the correct vlan (doesn't really make any difference with access to one vlan).

 

When I say you can't mix them, I mean you can't really mix tagged and untagged on a single port.

[thom]

So if I want a PC to be joined to the curriculum VLAN, I can set the port to untagged for VLAN 3 and leave admin and phone as no? Correct?

There is also a Default management VLAN (1) what should I use this for?

[DMcCoy]

So if I want a PC to be joined to the curriculum VLAN, I can set the port to untagged for VLAN 3 and leave admin and phone as no? Correct?

There is also a Default management VLAN (1) what should I use this for?

 

Yes you can leave the others as no, all untagged traffic will go to vlan 3 from that port.

 

I use my managment vlan for access to the switches, but you don't need to use it for anything.

[thom]

Thanks, that has really helped me get my head around it.

[jjx]

You can not mix tagged and untagged (I guess it might be possible but it would be complicated).

 

 

Guys,

A few things here for you...

 

1) Tag vs Untag

Tagged VLAN assignments are used for a) Uplinks and b) Devices that used Tagging (ie VoIP Phones). Untagged VLANs are used for 'endpoints' such as desktops with NICs that dont talk in 'VLAN'.

 

2) Mixing

You CERTAINLY mix tagged & untagged. Edge ports are untagged (unless you have a 2nd device such as a phone) and uplinks are tagged. (1 exception, we usually untag the default or mgmt VLAN).

 

3) ProCurve and VLANs

Which switches do you have and I'll get the correct CLI reference to you?

ProCurve VLANs are very simple (simpler than most) to configure. You create a VLAN by number (ie #VLAN 30 name Students would make a VLAN 30 and name it on the switch, naming is optional).

 

4) VLANs and Subnets

You can think of VLAN-ing similarly to subnetting, but understand they're different. Usually people combine VLAN segmentation with subnetting/IP, which is why VLANs are often mistaken for a Layer 3 technology. Generally, we like to identify the VLAN somewhere in the IP scheme... so with a 16-bit subnet mask, maybe your default VLAN is 10.10.X.X/16... you could create a seperate VLAN '35' and segment that's 10.35.X.X/16. Not required, but usually what's done.

 

5) ProCurve

If you're not used to VLANs, I would suggest using/installing the ProCurve Manager Plus (PCM+) software. It will scout out the network, map out your switches and let you see where VLANs are set in a visual format. If you're missing a link along the way you can clearly identify it from the VLAN network map view.

 

 

Hope this helps!

jj

[DMcCoy]

Guys,

A few things here for you...

 

1) Tag vs Untag

Tagged VLAN assignments are used for a) Uplinks and b) Devices that used Tagging (ie VoIP Phones). Untagged VLANs are used for 'endpoints' such as desktops with NICs that dont talk in 'VLAN'.

 

2) Mixing

You CERTAINLY mix tagged & untagged. Edge ports are untagged (unless you have a 2nd device such as a phone) and uplinks are tagged. (1 exception, we usually untag the default or mgmt VLAN).

 

3) ProCurve and VLANs

Which switches do you have and I'll get the correct CLI reference to you?

ProCurve VLANs are very simple (simpler than most) to configure. You create a VLAN by number (ie #VLAN 30 name Students would make a VLAN 30 and name it on the switch, naming is optional).

 

4) VLANs and Subnets

You can think of VLAN-ing similarly to subnetting, but understand they're different. Usually people combine VLAN segmentation with subnetting/IP, which is why VLANs are often mistaken for a Layer 3 technology. Generally, we like to identify the VLAN somewhere in the IP scheme... so with a 16-bit subnet mask, maybe your default VLAN is 10.10.X.X/16... you could create a seperate VLAN '35' and segment that's 10.35.X.X/16. Not required, but usually what's done.

 

5) ProCurve

If you're not used to VLANs, I would suggest using/installing the ProCurve Manager Plus (PCM+) software. It will scout out the network, map out your switches and let you see where VLANs are set in a visual format. If you're missing a link along the way you can clearly identify it from the VLAN network map view.

 

 

Hope this helps!

jj

 

 

Since I wrote this I have implemented vlan/subnet/auth so I know what I'm doing now

 

I believe I was talking about mixing tagged and untagged for a single port, although it was some time ago. I think you might even be able to mix on a single port, but it gets interesting when trunking at the same time.

 

PCM+ is quite the pile of junk. I even bought it.

 

Currently it doesn't support 13.x firmware and won't talk to some of my procurves that have snmpv3.

 

In fact I've not done so well for firmware lately. My 3400s no longer do snmpv3 with the latest version and my 5400s have a crashing issue under 13.09.

 

HP suggested I do a factory reset. It is the core switch.

 

In general they have been great, and XP SP3 will hopefully squash my remaining 802.1x issues

[jjx]

Hi there,

Yeah, I realized JUST after I typed it all that the post was OLD! LOL oh well

 

 

As for tag/untag- you MUST mix them if you plan to have more than 1 device on a port. For example, a VoIP phone would use the tagged and the PC connected through it untagged... so the port would be Tagged for 1 and Untagged for the other...

 

PCM+ actually does support the ver 13 firmware. I have it here in my labs and several customers are already on 13... however... I'm not recommending they upgrade on 5400 past 12.57 (you can get it here ProCurve Networking by HP - Software Summary)

 

If you want to try it, load the 12.57 into Secondary Flash.. do a reload to secondary.. if it's all working, you can copy Secondary to Primary. THat will likely fix the issues. (If you want CLI commands let me know).

 

PCM is not pretty- they're working on that- but it is useful in reporting and troubleshooting. Personally, I prefer the CLI but when you have a lot of switches, firmware and config mgmt is much easier with PCM+.

 

 

Good Luck!

-jj

[DMcCoy]

The notes did mention that it didn't work properly with 13, and from my experience it doesn't. I've not updated PCM in the last few weeks though.

 

I can add my 5400s, and they get added ok. However after a few minutes it says it can no longer connect and all communication tests fail, despite the switch still working.

[jjx]

Interesting.. I have the latest version and haven't had a problem so far (yet).

 

I have added this to a list at the dev labs/support to check into.

 

thanks!

jj