bmittleider

I am setting up some ACLs on our HP 5412zl to block a VLAN from all other VLANs and just want to see which method is best. I have the basic ACL working but I'm not sure the best place to apply the rest. In this ACL I am allowing only DHCP through but want all other traffic to be denied unless it's going out the Internet. Note that this configuration uses external DNS servers. We have about 10 different VLANs throughout our district and in this initial configuration I am only denying access to one (10.5.1.0/24). My main question is it better to apply each VLAN in this ACL or an ACL on that VLAN? Do I need to put all 10 VLAN deny statements in this ALLOW_DHCP_ONLY access-list or use one on each separate VLAN blocking access from the one VLAN that shouldn't be accessing others? ip access-list extended "ALLOW_DHCP_ONLY" 10 permit udp 0.0.0.0 255.255.255.255 eq 68 0.0.0.0 255.255.255.255 eq 67 20 deny ip 0.0.0.0 255.255.255.255 10.5.1.0 0.0.0.255 30 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

I thought that might be the case. Thanks.

I have a VLAN (310) that is to only be used by our video equipment and is basically just a passthrough port on our switches. There is no routing or IP configured on the core switch for this VLAN but I want to be sure no traffic can get from this VLAN to any of our other VLANs. Can someone help me with an ACL that would not allow any traffic in or out of VLAN 310 to any other VLAN? My core switch is a HP 5412zl and my edge switches are HP 2910al and 3500yl. This VLAN is just for our video equipment and is routed from another switch from our Internet provider. Core Switch: HP ProCurve 5412zl Edge Swtiches: HP ProCurve 2910al & HP ProCurve 3500yl Video VLAN: 310

Our school just rolled out 1:1 iPads and we during planning we decided to increase our access points and Internet pipeline to handle more traffic from the devices (approx. 275 iPads). What we did not account for was how much traffic is sent between these devices and the App Store on a regular basis. We expected an increase in traffic as they all started downloading apps but it has overloaded the network. So my question is there a way to use the rate limit feature of the HP ProCurve (5412zl acting as a router) to throttle the traffic to the App Store? I have narrowed down the IP's being used to make a connection to the App Store but I have never used the rate limit feature of the ProCurve switches. For the time being I have blocked the App Store during school hours but ideally we want them to be able to get apps when needed for classes. I have found an example for something similar when doing my Google searches, but not sure if it can work on remote hosts and if what I am trying to do is considered IN or OUT traffic. class ipv4 servers-to-be-slowed match ip 1.2.3.4/32 any match ip 1.2.3.5/32 any exit policy qos SlowBadServers class servers-to-be-slowed action rate-limit kbps 1000 exit interface all service-policy SlowBadServers in

I have replaced the power adapter to the ap that has been acting up the most. I will have to monitor it for a week or two to really know if it did anything. I also started disabling IPv6 on all our faculty laptops to see if it has any effect. I will only make these two changes and monitor it now for awhile to see if any change. It's not impossible that they found/used it but with the timing of the outages so random and even during the times students are not present I am leaning towards it not being the cause. All the ap's have been flashed with DD-WRT over the stock Buffalo firmware. I will start by setting up a log server to monitor the units and see if I can pinpoint when and what is going on. Thanks for the suggestion. If I continue to see the problem after changing a few settings from the previous posts I will then try reducing the output.

I have tried from multiple devices wireless and wired from the network and am still unable to ping/http into the router. Haven't introduced any new devices but re-imaged a few since the install of the APs. However we do not use IP6 anywhere. Not all of the troubled devices are plugged directly into a ups or surge protector but the one that has the most problems is plugged directly into an APC 1000 unit.

The AP that has the most problems typically has 5-8 devices connected to it throughout the day. It seems as though it is at random times and sometimes it works throughout the day and then the next morning it is in its unresponsive state. I have scheduled through a cron to reboot the routers twice a day but it seems as though when they become unresponsive they don't execute the cron or I would think they would be functional. They do have static IPs assigned and have since being installed.

I have eight Buffalo WHR-HP-G54 units flashed with DD-WRT (v24-sp2 std) and three out of the eight will randomly stop responding to network traffic. When they become unresponsive I am unable to ping or connect to the web gui. Clients can see the AP but get no IP when connecting. If a client is connected when the AP becomes unresponsive the connection drops and displays the x on the connection status (Windows 7). In my troubleshooting I thought maybe the problem was coming from multiple connects/disconnects over the course of the week so I created a cron to reboot each AP every morning before any clients attempt to connect but that didn't seem to help. Unplugging the network cable to the AP and reconnecting it will bring connectivity back and it will work until it randomly quits again. Same goes for unplugging the power and rebooting the AP. All eight AP's were flashed at the same time with the same firmware and have been in place for over two years before this problem arose. I have replaced cables and changed ports to where the AP makes the connection back to the core router/switch but that has not changed anything. I thought I would ask around before I reflashed the AP's or replaced them. I know it's not impossible that three units could be bad, but I find it odd that they all lasted the same amount of time before failing so I have to believe it is software or a load issue. Any thoughts?

I am looking for a little guidance on setting up some ACL rules on my HP Procurve 5412zl. Our district recently upgraded our infrastructure and I am trying to get the final touches completed by creating a few ACLs to help secure our network. Below I have included our current VLAN structure as well as the subnet for the VLAN. I have already configured the 5412 to handle routing and added the appropriate ip helper-addresses to the VLANs. VLAN 1: Default (10.10.10.0/24) VLAN 5: Servers (10.5.1.0/24) VLAN 10: High School (10.10.0.0/23) VLAN 20: Middle School (10.20.1.0/24) VLAN 30: Primary School (10.30.1.0/24) VLAN 40: Intermediate School (10.40.1.0/24) VLAN 50: Administration Offices (10.50.1.0/24) VLAN 60: IT Management (10.60.1.0/24) VLAN 100: Internet (WAN) (192.168.100.0/24) VLAN 200: Security (172.16.200.0/24) VLAN 250: Guest (192.168.250.0/24) VLAN 250 is our guest network that I am trying to isolate on the network. On this VLAN I have a pfSense box and 20 small access points distributed throughout our four buildings. Since this VLAN is to be isolated I don’t want to use the primary DHCP/DNS server that our other VLANs will be using so I have configured pfSense to handle DHCP for this network. I have configured switch to use the ip helper-address of the ip to the pfSense box. The pfSense box has dual network cards which are configured for VLAN 250 and VLAN 100. This box acts as the gateway to the Internet and does not rely on any internal servers. What I need is for VLAN 250 is to keep all traffic in VLAN 250 and not have the ability to access any other VLAN. VLAN 250 Static IPs - Switch 192.168.250.1 - pfSense Server 192.168.250.5 - Access Points 192.168.250.10-30 Thanks in advance.

I have some new discoveries to report today. I installed Lion on a MacBook that was previously setup with with Snow Leopard and connected to OD and AD and once Lion was installed it was receiving some of the MCX settings. However it wasn't perfect as it was stuck on loading a network share connection that I still can't find where it picked it up from.

As suspected, can't send MCX preferences using the Active Directory computer entry.

3s-gtech: If I remember correctly, when using the Active Directory entry it does't see it as a managed client that can accept the MCX preferences. It might show the computer as part of the group but WGM doesn't really see it as a Mac that can accept the policies. I could be mistaken and I will give this a try. Not ready to upgrade the whole lot of 10.6.x computers for the 10 10.7.x systems.

I'm pretty sure I already know the answer to this question but I can't find any sources to confirm. We have just started receiving a few new MacBooks with Lion installed. We have a Mac Mini running Snow Leopard Server (10.6.8) that serves as our Open Directory and MCX handler. I can't see the new MacBooks that are running Lion in the WGM under Computers and I don't see them available when adding new members to a group of computers. Is it not possible to see Lion workstaions in WGM if it is not running on Lion itself?

A little update here: I did a test by unplugging the network and still no change. I then reinstalled Bootpicker from a fresh download and again no change as I was still seeing a delay. I do believe it tied to network accounts as while doing my tests I have the login screen showing the indicators for network accounts and when it refreshes and becomes green the Bootpicker goes away and then reappears starting the countdown from the beginning. We have the iMacs bound to both Open Directory and Active Directory with a domain not using .local but .net (e.g. example.net). As a further test I tried this on a couple computers in our MacBook lab and I see the same issue. Also I have imaged them using DeployStudio both with the same image and a stripped down image that is the OS only. Thanks for the suggestions so far, hope this can be resolved. I will look into rEFIt if I can't get Bootpicker to behave.

I just re-cabled the entire lab where we are seeing this issue prior to the install of the operating systems. I also upgraded the switch to a 1GB HP ProCurve 2900. From this lab the uplink runs back to an HP ProCurve 5412 and then another uplink (fiber) to another 5412 where the DNS, Mac and Active Directory servers are located. All lines in use are at least Cat6 or fiber. I hope it isn't physical hardware the is causing this. As for the other possibilities, I will look to see what video chipset is being used. Our domain the computer are binded to is not a .local but .net.