sosmrttech Posted June 1, 2012 Posted June 1, 2012 I have implemented a ProCurve 5406 switch as a main layer 2/3 switch on the network. It has several VLANs configured. Everything works properly except for internet access which only works for VLAN 1. There are 2 ISP routers connected to the switch. What I want is VLAN 1 to be routed through router1 and remainder of VLANs to be routed thought router2. The connection from 5406 to router1 is untagged for VLAN 1 and router1 has IP of 192.168.60.1. The connection from 5406 to router2 is tagged for all VLANs with exception VLAN 1 and router2 has IP of 192.168.52.1 for VLAN 52, 192.168.53.1 for VLAN 53, etc. All internal routing works as devices can ping the 5406 and both routers. The 5406 has the following IPs: 192.168.60.2 for VLAN 1 192.168.52.2 for VLAN 52 192.168.53.2 for VLAN 53 These are the IPs that are served as default gateways in DHCP Here's the dilemma. I have a static default route of 0.0.0.0 0.0.0.0 192.168.60.1 on the 5406. Now what the 5406 is doing is routing all traffic to the outside though router1 only. Is there a way to have default routes based on VLANs? Something along the lines of: 0.0.0.0 0.0.0.0 192.168.60.1 for VLAN 1 0.0.0.0 0.0.0.0 192.168.52.1 for VLAN 52 0.0.0.0 0.0.0.0 192.168.53.1 for VLAN 53 Any help would be greatly appreciated.
PiqueABoo Posted June 1, 2012 Posted June 1, 2012 I don't know that switch/model and it might be cleverer, but I did play with some HP switch or other and it definitely couldn't do that. You could have say VLAN1 going out to the net via Router1 and VLAN2 going out to the net via Router2 but *only if* VLAN1 doesn't need to talk to VLAN2 or vice-versa, for instance you don't configure an IP for VLAN2 on the switch and set DHCP to hand our Router2's IP as the gateway for devices on VLAN2.
sosmrttech Posted June 1, 2012 Author Posted June 1, 2012 This is exactly how I have the non-VLAN 1 devices configured right now. The 5406 still has an IP address in VLANs 52, 53, etc, but the DHCP scope for these VLANs is serving router2's IP as the default gateway. Now I have internet access on these VLANs, but they don't talk to VLAN 1 devices. Ultimately I might have to start looking at tagging all VLANs going to router1 and forget about router2.
Destinova Posted June 4, 2012 Posted June 4, 2012 Yes you can have separate routing for each vlan on a layer 3 switch.
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 How would I go about implementing that? Any syntax examples would be greatly appreciated.
Mehmet Posted June 4, 2012 Posted June 4, 2012 I have implemented a ProCurve 5406 switch as a main layer 2/3 switch on the network. It has several VLANs configured. Everything works properly except for internet access which only works for VLAN 1. There are 2 ISP routers connected to the switch. What I want is VLAN 1 to be routed through router1 and remainder of VLANs to be routed thought router2. The connection from 5406 to router1 is untagged for VLAN 1 and router1 has IP of 192.168.60.1. The connection from 5406 to router2 is tagged for all VLANs with exception VLAN 1 and router2 has IP of 192.168.52.1 for VLAN 52, 192.168.53.1 for VLAN 53, etc. All internal routing works as devices can ping the 5406 and both routers. The 5406 has the following IPs: 192.168.60.2 for VLAN 1 192.168.52.2 for VLAN 52 192.168.53.2 for VLAN 53 These are the IPs that are served as default gateways in DHCP Here's the dilemma. I have a static default route of 0.0.0.0 0.0.0.0 192.168.60.1 on the 5406. Now what the 5406 is doing is routing all traffic to the outside though router1 only. Is there a way to have default routes based on VLANs? Something along the lines of: 0.0.0.0 0.0.0.0 192.168.60.1 for VLAN 1 0.0.0.0 0.0.0.0 192.168.52.1 for VLAN 52 0.0.0.0 0.0.0.0 192.168.53.1 for VLAN 53 Any help would be greatly appreciated. I am not familiar with HP hardware or the CLI. I believe you need to implement some policy based routing. On Cisco devices you create something called a route-map; I would imagine something similar exists in the HP world.
Destinova Posted June 4, 2012 Posted June 4, 2012 It doesn't need to get as complicated as PBR - you simply need layer 3 addressing for each subnet and then route based on that. Your layer 3 switch can be used or you can have subinterfaces on the router for each vlan. Then either using static routes to point each vlan at it's next hop, or a dynamic routing protocol like OSPF or EIGRP to dynamically propagate the routes you want.
Mehmet Posted June 4, 2012 Posted June 4, 2012 It doesn't need to get as complicated as PBR - you simply need layer 3 addressing for each subnet and then route based on that. Your layer 3 switch can be used or you can have subinterfaces on the router for each vlan. Then either using static routes to point each vlan at it's next hop, or a dynamic routing protocol like OSPF or EIGRP to dynamically propagate the routes you want. Sounds interesting. Can you give an example of what that configuration would look like?
Destinova Posted June 4, 2012 Posted June 4, 2012 Sounds interesting. Can you give an example of what that configuration would look like? Sure - with the caveat that this is Cisco syntax - I've not done much work with HP gear at layer 3. The "old way" or router on a stick using subinterfaces on your router for each vlan: interface GigabitEthernet0/0 description Inside1 no ip address duplex full speed 1000 media-type rj45 interface GigabitEthernet0/0.1 encapsulation dot1q 1 native ip address 192.168.60.2 255.255.255.0 (not sure of what mask you wanted here...) interface Gigabitethernet0/0.52 encapsulation dot1q 52 ip address 192.168.52.2 255.255.255.0 interface GigabitEthernet0/0.52 encapsulation dot1q 53 ip address 192.168.53.2 255.255.255.0 etc. Each vlan uses these addresses as it's default gateway. Alternatively, and the current recommended way - at least in the Cisco world - is to have a layer 3 switch as your gateway - this way inter-vlan routing is not hairpinning on the router. This just uses layer 3 vlan interfaces rather than subinterfaces: interface vlan 1 ip address 192.168.60.2 255.255.255.0 no shut interface vlan 52 ip address 192.168.52.2 255.255.255.0 no shut interface vlan 53 ip address 192.168.53.2 255.255.255.0 no shut Then whatever routing protocol you want and advertise those routes to your router (of course you need to run the same protocol on the router to advertise your WAN links) router ospf 1 network 192.168.60.0 0.0.0.255 area 0 network 192.168.52.0 0.0.0.255 area 0 network 192.168.53.0 0.0.0.255 area 0 Static routes can also be used if you want to specify a different path for specific traffic.
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 This is the current routing table: ZULU(config)# sh ip route IP Route Entries Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 0.0.0.0/0 192.168.60.1 1 static 1 1 10.0.1.0/24 vMotion 11 connected 1 0 127.0.0.0/8 reject static 0 0 127.0.0.1/32 lo0 connected 1 0 192.168.1.0/24 192.168.60.253 1 static 1 1 192.168.2.0/24 192.168.60.253 1 static 1 1 192.168.3.0/24 192.168.60.253 1 static 1 1 192.168.4.0/24 192.168.60.250 1 static 1 1 192.168.5.0/24 192.168.60.253 1 static 1 1 192.168.6.0/24 192.168.60.253 1 static 1 1 192.168.7.0/24 192.168.60.253 1 static 1 1 192.168.8.0/24 192.168.60.253 1 static 1 1 192.168.9.0/24 192.168.60.253 1 static 1 1 192.168.11.0/24 192.168.60.253 1 static 1 1 192.168.34.0/24 192.168.60.4 1 static 1 1 192.168.51.0/24 Management 51 connected 1 0 192.168.52.0/24 Wireless 52 connected 1 0 192.168.53.0/24 VoIP 53 connected 1 0 192.168.54.0/24 Central Store 54 connected 1 0 192.168.55.0/24 Cameras 55 connected 1 0 192.168.60.0/24 DEFAULT_VLAN 1 connected 1 0 192.168.61.0/24 192.168.60.254 1 static 1 1 The top static route is manually entered. I can't seem to find anything in the that allows me to enter routes based on VLAN. The "connected" one were dynamically generated bt the 5406. If I try adding a static route, there is no place to specify the VLAN: ZULU(config)# ip route IP-ADDR/MASK-LENGTH Specify IP address and mask of the route destination. ZULU(config)# ip route
Destinova Posted June 4, 2012 Posted June 4, 2012 A vlan is just a subnet - if you want static routing just specify a route for the subnet of the vlan you want to change: ip route 192.168.52.0 255.255.255.0
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 It looks like the 5406 is already doing that. Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 192.168.52.0/24 Wireless 52 connected 1 0 Where "Wireless" is the IP of 5406 for VLAN 52. This makes routing possible on the inside. However if the VLAN 52 needs to go outside, the 5406 routes it though the static default route (0.0.0.0/0 192.168.60.1). I can't seem to find a spot to specify default routes by VLANs.
Destinova Posted June 4, 2012 Posted June 4, 2012 Where do you want the traffic to go, rather than 192.168.60.1 ?
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 For VLAN 1 I want the next hop to be 192.168.60.1. Which is exactly what's happening. For VLAN 52, the next hop should be 192.168.52.1 For VLAN 53, the next hop should be 192.168.53.1 All the intra VLAN routing works perfectly as the default gateway for each VLAN is the 5406. However any outside access is only sent through 192.168.60.1. I'm trying to come up with something along the lines of: 0.0.0.0 0.0.0.0 192.168.60.1 for VLAN 1 0.0.0.0 0.0.0.0 192.168.52.1 for VLAN 52 0.0.0.0 0.0.0.0 192.168.53.1 for VLAN 53 This would establish a different default route based on VLAN source.
Destinova Posted June 4, 2012 Posted June 4, 2012 Do you have layer 3 interfaces for those addresses?
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 Yes, the two ISP routers are XTM510 Watchguards. I'm trying to avoid using the Watchguard as the gateway IP in VLAN 52, 53 addresses. If I do that, I have internet connectivity on those VLANs, but then the Watchguard is doing the routing for these VLANs. I'm starting to think that the 5406 will not do what I want it to. In the GUI interface, I found a spot to enter a default gateway and it looks like it will route all VLAN traffic to that 192.168.60.1 gateway regardless of the VLAN source. I opened a case with HP network support as well. I wonder what they will come up with? I also want to start looking at PBR - Policy Based Routing. Maybe that's my ticket?
Destinova Posted June 4, 2012 Posted June 4, 2012 So which interface(s) have the IP address for 192.168.52.1 and 192.168.53.1 ? I'm a bit confused here maybe a network diagram would help if you have one.
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 Sorry, I'm a bit rusty in Visio, but there it is.
Mehmet Posted June 4, 2012 Posted June 4, 2012 Sure - with the caveat that this is Cisco syntax - I've not done much work with HP gear at layer 3. The "old way" or router on a stick using subinterfaces on your router for each vlan: interface GigabitEthernet0/0 description Inside1 no ip address duplex full speed 1000 media-type rj45 interface GigabitEthernet0/0.1 encapsulation dot1q 1 native ip address 192.168.60.2 255.255.255.0 (not sure of what mask you wanted here...) interface Gigabitethernet0/0.52 encapsulation dot1q 52 ip address 192.168.52.2 255.255.255.0 interface GigabitEthernet0/0.52 encapsulation dot1q 53 ip address 192.168.53.2 255.255.255.0 etc. Each vlan uses these addresses as it's default gateway. Alternatively, and the current recommended way - at least in the Cisco world - is to have a layer 3 switch as your gateway - this way inter-vlan routing is not hairpinning on the router. This just uses layer 3 vlan interfaces rather than subinterfaces: interface vlan 1 ip address 192.168.60.2 255.255.255.0 no shut interface vlan 52 ip address 192.168.52.2 255.255.255.0 no shut interface vlan 53 ip address 192.168.53.2 255.255.255.0 no shut Then whatever routing protocol you want and advertise those routes to your router (of course you need to run the same protocol on the router to advertise your WAN links) router ospf 1 network 192.168.60.0 0.0.0.255 area 0 network 192.168.52.0 0.0.0.255 area 0 network 192.168.53.0 0.0.0.255 area 0 Static routes can also be used if you want to specify a different path for specific traffic. How does this configuration allow for traffic bound for the internet to be routed based on source VLAN though? It seems this is just a simple router on a stick configuration used for inter-VLAN routing? Am I missing something?
Destinova Posted June 4, 2012 Posted June 4, 2012 Yes, that's correct. I was under the (incorrect) impression that's what he was looking for. With the diagram I realize there's an actual second physical router, which tosses things back to PBR. 1
Mehmet Posted June 4, 2012 Posted June 4, 2012 Yes, that's correct. I was under the (incorrect) impression that's what he was looking for. With the diagram I realize there's an actual second physical router, which tosses things back to PBR. Oh right. You scared me there for a minute! Thought I was missing something!
sosmrttech Posted June 4, 2012 Author Posted June 4, 2012 Any one know the CLI syntax for configuring PBR? I can't seem to find much info on it on the web. I know that I have to upgrade the firmware on the 5406 since the current one does not support PBR.
sosmrttech Posted June 5, 2012 Author Posted June 5, 2012 I contacted HP support with this. This is part of the e-mail response: "Thank you for contacting HP Networking Support. The switch does not support the creation of different static routes based upon VLAN ID. Different static routes can be configued with metrics, which serve to specify an integer value that is associated with the route. It is used to compare a static route to routes in the IP route table from other sources to the same destination. Another parameter that can be set for static routes is the distance. This specifies the administrative distance to associate with a static route. If not specified, this value is set to a default of 1. For more on this topic, refer to “Administrative Distance” on page 5-10 of the "Multicast and Routing Guide" at http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c02610033/c02610033.pdf The option supported by the HP Switches is Equal Cost Multipath for Static Routes, as described on page 5-30 of the same Guide. The prerequisite for ECMP is the deployment of OSPF, which is also described in the Routing Guie, beginning with page 5-46." Thanks to all for all the help and suggestions.
Mehmet Posted June 6, 2012 Posted June 6, 2012 I contacted HP support with this. This is part of the e-mail response: "Thank you for contacting HP Networking Support. The switch does not support the creation of different static routes based upon VLAN ID. Different static routes can be configued with metrics, which serve to specify an integer value that is associated with the route. It is used to compare a static route to routes in the IP route table from other sources to the same destination. Another parameter that can be set for static routes is the distance. This specifies the administrative distance to associate with a static route. If not specified, this value is set to a default of 1. For more on this topic, refer to “Administrative Distance” on page 5-10 of the "Multicast and Routing Guide" at http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c02610033/c02610033.pdf The option supported by the HP Switches is Equal Cost Multipath for Static Routes, as described on page 5-30 of the same Guide. The prerequisite for ECMP is the deployment of OSPF, which is also described in the Routing Guie, beginning with page 5-46." Thanks to all for all the help and suggestions. Based on the requirements you have given I can't see how this information is of any use.
gaiacraig Posted June 7, 2012 Posted June 7, 2012 Create a new VLAN on the HP switch and connect router2 to that VLAN. Give Router2 an IP of 192.168.255.1/255.255.255.252 and the HP switch 192.168.255.2 / 255.255.255.252. Configure a static default route on the HP switch to point to Router2's IP address. That will route all VLANs via Router2. Leave Router1 connected to VLAN1 and set all devices on VLAN1 to use Router1 as its default gateway (it sounds like that's what you already have). Put a static route on both routers to point each one back to the rest of the LAN via the HP switch's address on the relevant VLAN, so Router1 would have a static route pointing 192.168.0.0 / 255.255.0.0 to 192.168.60.2. Router2 would have a static route pointing 192.168.0.0 / 255.255.0.0 to 192.168.255.2. You'll also need to enable IP redirects on the routers and HP switch if they support it.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now