Chass

Great info, thank you to everyone so far. With reference to this; One more thing: How would the firewall know about network 172.16.10.96-172.16.10.127? You can make a static route on Firewall which will point towards this network. Or you can use a routing protocol between Firewall and layer 3 switch. Firewall must be able to ping a client in the 172.16.10.96-172.16.10.127. Test this. If you can not then sort this out by static route or routing protocol. So is it a case I either make the static route on the switch to point to the firewall Or make a static route on the firewall to point to the VLAN? Or is it both?

Yes I noticed this also when I took the screenshot. I haven't added the static route yet on the firewall, but plan to ASAP. Am I correct in saying that if I add another VLAN, I will need to add another static route for that VLAN as well on both the switch and the firewall? or will it just use my default static route on the switch? (which will be the same for the new VLAN anyway as it is the same firewall 10.0.0.253) If this is correct, then surely just adding the static route on the firewall will allow me to ping 8.8.8.8 from any device on the VLAN 50 range? :-)

I reset the switch back to factory before I put it in place, so I can only presume it is not currently on. Here are the details for the VLAN; VLAN 50 - Management Default Gateway - 172.16.10.100 Mask - 255.255.255.224 Range of IPs - 172.16.10.96 - 172.16.10.127

Here is my current config on the core switch.

At the moment, VLAN 50 is the only one on the network. But I need to add maybe one more soon.

OK guys, starting to make sense now. I haven't, as yet set any default route on the core switch in which I set the VLAN 50 up on!So this is the correct command to run? (10.0.0.253 is my firewall). I assume I only have to do this on my core switch and this will become the default route for ALL VLANs on my network? Or do I have to do this for each VLAN that I want to go out on the internet? ProCurve (config)# ip route 0.0.0.0 0.0.0.0 10.0.0.253 Is routing on by default or do I need to run a command to enable it? I will be doing this on my core switch which is Layer 3, but can i do this on a Layer2 device if needed? So once I have done this on the core switch, I can then configure the static route on the firewall in order for the firewall to let traffic out on the net from the VLAN. Have I got this correct? :-)

OK, so I have found how to add a static route on my firewall for the VLAN in question. But how does my VLAN know how toget to the firewall in the first place? Here are the detials for the VLAN again; VLAN 50 - Management Default Gateway - 172.16.10.100 Mask - 255.255.255.224 Are you saying I don't have to do ANYTHING to the VLAN setup? Remember the Firewall IP is 10.0.0.253, so how will the VLAN know how reach that? (or will it reach it BECAUSE I have setup the static route in the Firewall.) Sorry to keep asking questions, I just cant afford to miss any steps when putting this in place :-)

Would the static route be on the firewall or the HP switch where I have set up the VLAN? I think the Firewall will need a NAT out from that IP range as well wouldn't it?

Hello Folks I am relativly new to VLANS and need some advise please. So I can create VLANS and allow devices across switches to talk to each other, no issue there. My issue is, how do I allow a device on say, VLAN 50 to access the internet using my existing Firewall which is on a different subnet? Here is an example below of a setup; (I lknow the 172.16 may not be routeable) but have used as an example. VLAN 50 - Management Default Gateway - 172.16.10.100 Mask - 255.255.255.224 Range of IPs - 172.16.10.96 - 172.16.10.127 (32 IP’s to use) The devices on this VLAN can all communicate which each other, but I can't ping 8.8.8.8. I am assuming I need to add some static route on the switch to reach my Firewall/ which is on the "Standard" network, i.e. The firewall (which is also my defualt gateway for the usual devices on the network) has the ip of 10.0.0.253 and a mask of 255.255.255.0. I believe all my switches are Layer 2 and I also have a 3400cl which is Layer 3 (This is where I setup my VLAN) in the first instance. So basically, I need to be able to be on a VLAN and to be able to use the 10.0.0.253 to access the internet. Thanks in advance and if you do respond, please kindly keep it simple, I'd really appreciate any help as I plan to other several VLANS and need this gap in my knowledge filled! :-)