SSTechIII

Just to confirm that routing is enabled between VLANs. Each VLAN has its own IP and routes have been defined to direct traffic between VLANs. My next step will be to assign the ACL to all ports members of VLAN 3 (unless somebody found a way to assign an ACL to an entire VLAN in one fell swoop).

Thanks for following up. Your explanation regarding the inbound traffic for VLAN 3 makes sense. I just always assumed that inbound and outbound were defined relatively to the switch itself. I'll have to check on Monday if routing is enabled between VLANs. I assumed it was but now that you bring it up, I'm not so sure anymore. Yes, the command to assign an ACL starts with packet-filter. However, this command is not available in the context of the VLAN interface, it only seems to apply to individual ports. I'll let you know what I find out on Monday.

Well, I am running into problems: Problem #1 @Ash: You were saying the ACL should be applied to the inbound side of the VLAN 3 interface. Shouldn't it be outbound? The WOL packets come from VLAN 1 into the layer 3 switch and then are sent out to VLAN 3. So as far as the switch is concerned, these packets are outbound. Problem #2 On a 3Com switch, you first define an "advanced ACL" and then add "rules" to it: acl number 3000 match-order config rule 0 permit udp source 10.65.1.0 0.0.0.255 destination 10.65.3.0 0.0.0.255 destination-port eq 7 Now, do 3Com ACLs have an implied deny any any at the end like Cisco's? In any case, the goal of the ACL is to allow WOL and regular traffic, but to block the traffic now allowed through because of the ip forward-broadcast statement. Based on this post my final ACL looks like this: Advanced ACL 3000, 9 rules Acl's step is 1 rule 0 permit udp source 10.65.1.0 0.0.0.255 destination 10.65.3.0 0.0.0.255 destination-port eq echo rule 1 deny ip source 0.0.0.0 0.255.255.255 rule 2 deny ip source 127.0.0.0 0.255.255.255 rule 3 deny ip source 255.0.0.0 0.255.255.255 rule 4 deny ip destination 0.0.0.0 0.255.255.255 rule 5 deny ip destination 127.0.0.0 0.255.255.255 rule 6 deny ip destination 255.0.0.0 0.255.255.255 rule 7 deny ip destination 10.65.3.255 0 rule 8 permit ip Problem #3 Assuming this ACL works, does anybody know how to apply it to the VLAN interface? It looks like I can only apply it to ports. Problem #4 So I tried to apply the ACL to all the ports that are members of VLAN 3 but when I do, only the inbound option is available... If you know how to solve any of these problems, please let me know.

Thanks Ash. I am much more familiar with Cisco too, the challenge is to convert Cisco commands into 3Com commands... I have the user's manual so it's just a matter of time. I'll post my findings once I'm done. We have several multihomed servers with IPs on each subnet, so running wol from the servers is never a problem. I thought about using psexec to have the user run the script from the server but she would have to be a member of the server's administrators group for psexec to work and that's not an option. Also the labs are not in use every day and the schedule is not alway the same so a batch file running from the server doesn't really make sense in my case.

Thanks ashok for your prompt reply. I was so close! By digging a bit further, I found the command I was missing. I needed to run "ip forward-broadcast" on the VLAN interface, not the port! So, I entered "interface vlan-interface 3" to switch to the VLAN 3 interface, then typed "ip forward-broadcast", and that was it, both labs turned on. I found the instructions here. Now, does anybody know how 3Com implements ACLs? I need to create an ACL that allows computers on network 10.65.1.0/24 to send directed broadcast to the 10.65.3.0/24 network. The wolcmd help says the magic packets are UDP packets and the default port is port 7. That's enough info to create a pretty restrictive ACL, but I don't know the 3Com syntax to create and apply ACLs, so if anybody knows, please chime in. I had a look at mc-wol but I fail to see how it would help in my case. As they say: "If a target computer is on another LAN, IP address must be specified. For example you have a segment using the class C network 192.168.5.0. The broadcast ip address of this subnet is 192.168.5.255 - that's what you use as the destination IP address on the packet." In other words, mc-wol creates a subnet-directed broadcast which would be blocked by the layer 3 switch unless it has been configured to let the broadcast pass through (as I did). I'll stick with wolcmd which lets me specify the port to use.

Hi, I have 2 computer labs on 2 different VLANs: VLAN 1 (default) uses the 10.65.1.0/24 subnet, VLAN 3 uses the 10.65.3.0/24 subnet. The workstation of the person in charge of both labs is on VLAN 1. I wrote a script a while ago to allow that person to turn on both labs via Wake on LAN. The script just calls the wolcmd.exe utility (from Depicus) which broadcasts a magic packet for each MAC address. It worked great until the replacement of the layer 3 switch (3Com 5500) between the labs. Now WOL is limited to one subnet, i.e.: The computer running the script has to be on the same subnet as the computer lab it tries to wake up. I did my homework and found out that I needed to allow "subnet directed broadcasts" to allow the packets to cross subnets. So I entered "ip forward-broadcast" on the 3Com 5500 and I am now able to successfully ping the broadcast address of the other network (10.65.3.255) but WOL still doesn't work. The example here shows that the "ip forward-broadcast" command should also be run on the interface connecting to the other VLAN, but on the 3Com 5500, this particular command doesn't seem to be supported by the Gigabit port connecting to the VLAN. Did any of you run into the same problem? All suggestions are welcome.

I have been looking for a free alternative to Ghost Corporate Edition, and DRBL/Clonezilla seems to do exactly what I need. What I don't understand is the 2 NICs requirement. I have set up PXE boot environments before, using the 3Com boot services and never needed 2 NICs. Same for TFTPD32, it doesn't require 2 NICs. I must be missing something important here. Would you mind explaining to me why the 2 NICs are required?