pantscat

I've been smashing my head against my desk over this all morning. HP Procurve environment with a 5412zl at the core. VLANs... "teacher" PCs are on a different subnet to the "student" PCs. I understand that Lanschool should work if you configure it with directed broadcasts - I've done this. I've also enabled the following commands on my core switch: ip directed-broadcast ip udp-bcast-forward Yet still it doesn't work. Has anyone else got this working in a similar environment? Cheers, Ant

Is the second SSID on a different VLAN?

Cunning!

@zag - did you use two different domains for mail delivery? or did you just switch your MX records straight over to the hosted Exchange?

In my experience, chuck as much RAM in there as possible... My VM hosts (two of them, but soon to be three) have got 64GB each. When I first had my VMware setup I couldn't possibly have envisaged that I'd need all that RAM... but I do (thanks to the increased memory usage of Exchange 2010, plus a couple of SQL boxes) and now I'm in a situation where I need extra capacity to cope with the failover requirements. Plus... RAM is cheap! Don't forget that if you're going to be using any HA tools in the future (and adding another host) then you'll need to make sure that you've got enough capacity in your remaining hosts, should one fail, to ensure that all of your key VMs have enough resources available to carry on running.

I think the USB hard disk would probably create a similar bottleneck... How about putting BackupExec on the server with the Storage Array (just for testing...)?

Ok - I'd try and eliminate that as the point of bottleneck... can you try a backup to storage that's local to the B-Exec server?

That's weird. Perhaps check out a "route print" from the command line and check that there's nothing odd going on in the routing tables...

I don't know why... but this thread made me think of this: Might not be completely SFW...

Is internet access via a defined proxy server? or through the default gateway?

Is the SMB share local to the Backup Exec server?

Done! Hope it's useful.

Those transfer rates do seem rather slow. What are you backing up on to? (HDD, Tape?) I've split my Exchange data stores, so I'm backing up 10GB, 30GB and 50GB databases, and I'm averaging about 1000MB/min for GRT. Those figures are from a SATA based SAN (with lots of spindles though) to an LTO4 autoloader.

It's more from a subnet mask point of view.... 255.255.0.0 is what they're currently used to, rather than 255.255.254.0 which I think will confuse them. Maybe it's time for me to do some lessons!

Is there any guidance available or best-practice advice for choosing subnet sizes when implementing VLANs? For example - I'm splitting my network into several VLANs, but is there any good reason not to use a /16 mask (as it's easier for the rest of my team to understand) on the VLANs even if there's only going to be say, worst case scenario 300 devices on one VLAN rather than going for a /23 mask?

Exactly that... it's school kit that ideally would use the DCs for DHCP and DNS resolution. It doesn't really need to access much else... but you never know!

Yep... but that would have to be the IP address of the VLAN on the switch surely? Otherwise how would traffic route between VLANs? Unless I make the Smoothwall box do the routing, but I'm not sure a) if it can. b) if that's not a really naff idea.

Ta - I'm not sure if I can setup different default routes based on traffic source though. Doesn't look like it's possible to do it. I may have to think about this from a different angle. Essentially the issue is Smoothwall authentication and iPads... meh. I need more coffee.

In essence my thread title explains my question. Is it possible (with an HP Procurve based LAN) to have a different default gateway for each VLAN? For example (and this is a very simplified example)... VLAN 1 (10.1.1.0/24 - normal network clients) need the core switch to send traffic to a default gateway of 10.1.1.1 (Smoothwall NIC 1) VLAN 999 (10.2.1.0/24 - iPads and other such tablets) need the core switch to send traffic to a default gateway of 10.2.1.1 (Smoothwall NIC 2, set as a transparent proxy with SSL based auth) I seem to be only able to set one global default gateway on my core switch (5412zl). *UPDATE* I've had a break from typing this and I've now got to the point where I'm pretty sure I'm approaching this the wrong way and what I need to do is setup custom routes on my switch to route traffic depending upon the source location. Does that sound right?

Wow... that's very cool. Thanks very much indeed. I owe you one.

@DMcCoy What ACLs do you use to allow the guest VLAN to access your DCs for Group Policy and to join the domain? Thanks for your help btw, I've got the dynamic VLANs working beautifully!

Super - thanks very much. Play-time now!

How do you configure the switches to get the dynamic VLAN from NPS? That does sound cool! For the printers did you just have a list of allowed MAC addresses configured on the switch?

@DMcCoy Thanks for this - good advice. How did you do the dynamic VLANs? Was this with NPS? For the printers do you need to change the config on the switch ports? Seems that the VoIP side of things might be a tad trickier... I'll have to have a think about that if only one auth type can be used. Hadn't thought of sticking the FOG server in the unauth VLAN - that's nice and straight-forward.

I would like to setup 802.1x authentication for my wired HP Procurve network (I've already got it up and running on my wireless network). I've got an HP Procurve LAN and use NPS on 2008R2 to do the RADIUS side of things. It uses machine-based AD authentication (e.g. checks that the machine is a member of the domain before authenticating it) I know how to setup bog-standard 802.1x machine authentication for wired connections but my brain is starting to hurt when I think about these things: 1. How do I deal with non-802.1x compliant devices (such as printers, VoIP phones... etc.)? It would be nice if NPS could do AD-authentication or Mac-address authentication to cater for this. What do other people do? 2. I'm doing a VoIP roll-out over the summer... can I setup my HP network to authenticate two devices on one port? e.g. the VoIP phone would need to be mac-address authenticated, but if a PC is plugged into the onboard switch could that then be authenticated using AD-authentication? 2a. ...and would each device be put into a separate VLAN? 3. FOG server... obviously I'll still need to allow PXE booting for FOG devices. I'm guessing that I could probably do this with an unauthenticated VLAN and put an ACL in place to allow VLAN routing to my FOG server. Has anyone done this? Thanks in advance to any replies, Ant