foofighterjim

Possible development, or more information at least. I can now ping the VLAN 50 default gateway from the switch (10.122.201.129), this is probably because the routing table is now correct. The switch can't ping the device on VLAN 50 (10.122.201.130), is there the possibility that the switch is firewalling at some level (ACL?)? The switch can ping the laptop on VLAN 1.

This is my problem at the moment, I cant even get that far by using two laptops. No, same error. I have also tried through the web UI, I can change it but not remove it. Here is my current running config, I have removed the other VLANs for now. Running configuration: ; J8698A Configuration Editor; Created on release #K.15.17.0007 ; Ver #08:02.ff.f7.fc.7f.ff.3f.ef:ae hostname "HP-5412zl" module 1 type j9534a module 2 type j9536a module 3 type j9534a module 4 type j9534a module 5 type j8706a module 6 type j9309a trunk F1-F2 trk1 trunk timesync sntp sntp unicast sntp server priority 1 10.122.204.69 time daylight-time-rule western-europe ip route 0.0.0.0 0.0.0.0 10.122.204.49 ip routing interface F1 disable exit snmp-server community "public" unrestricted snmp-server location "Server Room" vlan 1 name "DEFAULT_VLAN" untagged A1-A23,B1-B22,C1-C24,D1-D24,E1-E24,F3-F4,Trk1 tagged A24 ip address 10.122.204.81 255.255.252.0 exit vlan 50 name "Wireless Mgmt" untagged A24 tagged B9 ip address 10.122.201.129 255.255.255.128 ip helper-address 10.122.204.69 exit spanning-tree spanning-tree Trk1 priority 4 no spanning-tree bpdu-throttle no autorun no dhcp config-file-update no dhcp image-file-update password manager

I just get Invalid input: default-gateway in the CLI, the new IP route has taken in the route table though. The two laptops still can't ping each other though. How do I go about getting VLAN 50 in the routing table if it is not populating automatically? Is it worth at this point factory resetting the switch and starting from scratch? The config would only take about 20 minutes at this point. Edit: I have just re-run show ip route and VLAN 50 is now showing in the routing table, still unable to ping a device in VLAN 1 though.

Now that is interesting your VLAN is showing in the routing table, I'm guessing that you did not need to add it manually? So we are in the same boat up until this point, I haven't looked at the DHCP server or internet connection just yet as I appear to have something rather more fundamental wrong. Or are you saying my inability to ping may be a red herring? Your internet issue may be resolved in this video:

So I have been doing some digging on this and I can't even ping the VLAN 50 default gateway from the switch, strange as the IP should belong to it. I have run the following: show ip route IP Route Entries Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 10.122.204.0/22 DEFAULT_VLAN 1 connected 1 0 127.0.0.0/8 reject static 0 0 127.0.0.1/32 lo0 connected 1 0 As you can see there is no route defined to my VLANs could this be causing the problem, if so what do I do about it?

Yes, the laptops are set statically. The ip default-gateway command on the switch? This is currently set to the Smoothwall IP (10.122.204.49) the router after the Smoothwall I do no control and would need to find its IP.

Ok, just got in and I have done the following: Reboot switch Tested Ping - no change Updated Firmware to K.15.17.0007 Tested Ping - no change Rebooted again Tested ping - no change I have the VLAN 1 device set to IP 10.122.206.55, Subnet 255.255.252.0, Default Gateway 10.122.204.81. VLAN 50 device is set to IP 10.122.201.130, Subnet 255.255.255.128, Default Gateway 10.122.201.129

You can get them for around £0.26 each from Comms Express based on ordering 100. If you give them a call I'm sure they will be able to do something more given the volume of the purchase.

The two devices are unable to ping each other.

So I need to change the default gateway on my domain to 10.122.204.81? Do I then need to set anything on the switch so devices can find their way out to the Smoothwall? There is no lease for the laptop it just gets 169.254.115.188 255.255.0.0

I have been using this guide for the ESX part: VMware KB: Sample Configuration - ESX/ESXi connecting to physical switch via VLAN access mode and External Switch VLAN Tagging (EST Mode) it suggests that as long as the hosts network properties are set to 0 or none it should get through. All of my hosts are set to 0. I removed the tagged ports from A1-12 for VLAN 50 and from A24 from VLAN 1, unfortunately this hasn't changed anything. One thing I have thought about is the default gateway of the DHCP server, it is currently set to 10.122.204.49 (Our Smoothwall IP) should it rather be the VLAN 1 Switch IP (10.122.204.81)? I haven't tested it because when I changed it the server lost connection to the internet.

I can't, not all of my switches support VLANs at the moment (I know, don't get me started on that). The best I can do for now is VLAN my wireless traffic as all APs are connected to Layer 2 or 3 switches.

Sorry, I had just edited my reply. The server is a VM so I tagged all ports going to ESX hosts (A1-12), Laptop is connected to A24.

I am certain it is, config below. The server is a VM so I tagged all ports going to ESX hosts (A1-12), Laptop is connected to A24. Running configuration: ; J8698A Configuration Editor; Created on release #K.15.12.0012 ; Ver #05:08.41.ff.3f.ef:63 hostname "HP-5412zl" module 1 type j9534a module 2 type j9536a module 3 type j9534a module 4 type j9534a module 5 type j8706a module 6 type j9309a trunk F1-F2 trk1 trunk timesync sntp sntp unicast sntp server priority 1 10.122.204.69 ip default-gateway 10.122.204.49 ip routing interface F1 disable exit snmp-server community "public" unrestricted snmp-server location "Server Room" vlan 1 name "DEFAULT_VLAN" untagged A1-A23,B1-B22,C1-C24,D1-D24,E1-E24,F3-F4,Trk1 tagged A24 ip address 10.122.204.81 255.255.252.0 exit vlan 50 name "Wireless Management" untagged A24 tagged A1-A12 ip address 10.122.201.129 255.255.255.128 ip helper-address 10.122.204.69 exit vlan 55 name "Wireless Staff" ip address 10.122.202.1 255.255.255.0 exit vlan 60 name "Wireless Guest" ip address 10.122.203.1 255.255.255.0 exit vlan 150 name "Printers" no ip address exit spanning-tree spanning-tree Trk1 priority 4 no autorun no dhcp config-file-update no dhcp image-file-update password manager

So I have hit a bit of a brick wall with this. I have setup a new scope 10.122.201.128 255.255.255.128 (for use with VLAN 50) on the DHCP server (which is on VLAN 1). I have excluded 10.122.201.129 from being distributed by DHCP as this is the Switch IP for VLAN 50. I have set IP Helper for VLAN 50 to 10.122.204.69 (the DHCP server on VLAN 1), I have tagged VLAN 50 on the ports connecting to the server with VLAN 1 set to Untagged. I have isolated one port for testing which has VLAN 50 untagged and VLAN 1 tagged and connected a laptop to it for testing. Unfortunately the laptop does not acquire an IP, however if I set the laptop with the IP 10.122.201.130, Subnet 255.255.255.128 and Default Gateway 10.122.201.129. I can ping the default gateway, I can't however ping the DHCP server (10.122.204.69). I believe this is where my problem is as I think I have everything set correctly on the switch. I am not sure how to trouble shoot this.

Thanks for your help, I think I will start writing my config down, making sure I have the subnets correct (I am pretty sure they are) and start making changes during the holidays. This is the biggest problem of not having a test network to play with! Must remember to start backing up the switch config regularly now! Looks like my summer just got a little easier now I'm not expanding the existing range and will just be playing with the VLANs, at least I can undo everything in minutes if I do something wrong. Thanks again for your help.

So for example if the switch has IP 10.122.201.129 on 255.255.255.128 for VLAN 50 this will be the default gateway for all devices on that VLAN. Because this IP would be in the scope for 10.122.201.129 - 10.122.201.254 (but reserved I presume), the devices from VLAN 50 will automatically obtain IPs from that scope? Sorry for being so thick. Re Aerohive, It is very straightforward to get the VLANs set on there so I'm not too worried about that at the moment.

Thanks for the clarification @FN-GM & @themightymrp (We use Aerohive BTW) I will only be able to go so far with this as I mentioned I can't currently VLAN wired traffic due to deficiencies at the edge. So in theory I can keep my current wired traffic on 10.122.204.1/22 and VLAN by location at a later date. I can just setup a VLAN with 10.122.201.129/25 for the APs and 10.122.202.1/23 for Guest access? I think this makes sense its just how to get the VLAN'd devices to get IPs from the correct scope?

Wouldn't I need a router in place to do this? The only router I have is from the ISP which I don't control. Or are you saying that my 5412zl should be able to do this? I was hoping that the VLANs would help reduce the broadcast traffic.

This may turn quite long winded so please bear with me. The situation I have at the moment, flat network on 10.122.204.1/22, I have recently introduced Smoothwall and am finally able to play with the IP schema. I am trying to expand the range so I have more IPs available to me I was thinking of changing to 10.122.192.1/20. I believe this would just involve changing the subnet of the existing devices and DHCP scope as the existing IPs would be covered by the new subnet. Is this correct or am I way off the mark? As part of the above I am looking to VLAN wireless traffic only, all of my APs connect to one of three switches (HP 5412zl, HP 5406zl & HP 2530). I can't VLAN wired traffic at the moment as not all of my switches support VLANs and I am unable to replace them due to budget, there are no unmanaged switches between the three aforementioned switches. Here is where my real problems start, I would like to create a VLAN for AP management and have the APs get their IPs from a separate DHCP scope on the main DHCP server but don't actually know how to do it. I would also need to create a separate VLAN for guest access. Here is my logic so far: VLAN 1 (default) - in place to serve all wired traffic (for now). VLAN 50 (AP Management) - Creates a range of IPs for the APs to use, separate from my current DHCP scope. VLAN 60 (Wireless Guest Access) - Gives clients access to nothing but DHCP (separate scope), I can then create a location in Smoothwall to allow internet transparently. I am aware that I may be able to get Smoothwall to be the DHCP server for these devices but don't know how this setup would work with my existing DHCP server. In the above example I believe all ports with APs will need to have VLANS 1, 50 & 60 untagged and all uplink ports back to the core will need these VLANs tagged. The Smoothwall connection to the core switch would have to be tagged with these VLANs too. VLAN1 would still be on these ports for any school owned; group policy controlled devices connecting wirelessly. I am really not sure if this is correct or how to get them to obtain IPs from different scopes or servers (IP Helper??) Apologies for my ramblings, I know what I want to do. I just do know how to get there! I need a drink and a lie down now.

To make matters worse I have contacted the school who the Head teacher wants to model the plan on and they just give staff full local admin access and map all of the network dives manually! They don't even authenticate on their proxy! If I were to emulate this I would expect to be fired! I was told this other schools staff love this setup, of course they do they can do anything they want and not be accountable.

Chance would be a fine thing, some of our older staff laptops don't even have TMP chips! As for spares Lost of replies here have either got rid of staff laptops altogether or are doing what we already do, for use at home. This is what worries me, the leadership here seem to be trying to save money with this idea when it is actually going to cost money upfront that we supposedly don't have. With the laptops we have we would have no choice to use universal docking stations or let the teachers plug the cables in manually. The idea itself is not a necessarily a bad one but it needs the correct device and enough for spares. I am being offered neither of these.

Is the ISA IP used as the default gateway for your clients?

I would say in this day in age secondary schools need to be considering their internet connection redundancy, rather than this being the reason for bringing things in house.

Ever though about uninstalling some of the old games you don't play anymore? If I recall Forza 5 takes up about 40GB. Definitely what I would do, you can always install again at a later date if you want to play them again.