Search the Community

Hi there I have this setup Layer 3 Cisco with 3 vlan Vlan 1 172.17.10.1 Vlan 2 172.17.20.1 Vlan 3 172.17.30.1 route 0.0.0.0 0.0.0.0 172.17.10.250 to the PFsense Box that runs in a Vmware Dell server Vmware ip 172.17.10.10 all Devices are able to ping internally even the VM Box. But only devices in vlan 1 can only ping PFsense and view the internet PLEASE any help

Hi folks, please help me regain a little sanity, and reduce further hair loss! I have a case open with Netgear about this but thought it worth asking here in case anyone has seen anything similar. We've just replaced a single core switch with two, split over two sites and linked via 10Gb fibre. There is an M5300-52G3 and an M5300-28GF3 linked as a remote stack via 10Gb fibre and managed as a single stack. Each has a number of GS7xxTP PoE switches attached for wifi access and some GS748Ts for wired access. The ports that the access points plug into on the 748TPs are configured as tagged for VLANS 10, 20, 24, 28, 32, untagged for VLAN 3 and have a PVID of 3. The 748TP trunks back to the stack have all VLANS tagged. On the stack trunk ports connected to the 748TPs the VLANS are all set as tagged. [TABLE=width: 1000] [TR] [TD]VLAN[/TD] [TD]SSID/Auth type[/TD] [TD]Subnet[/TD] [TD]Purpose[/TD] [/TR] [TR] [TD]3[/TD] [TD]N/A[/TD] [TD]192.168.2.0/24[/TD] [TD]WiFi AP management[/TD] [/TR] [TR] [TD]10[/TD] [TD]Dom/PSK and Dom2/RADIUS[/TD] [TD]10.xx.yy.0/22[/TD] [TD]Main campus VLAN[/TD] [/TR] [TR] [TD]20[/TD] [TD]Student/RADIUS[/TD] [TD]192.168.20.0/22[/TD] [TD]Student wifi[/TD] [/TR] [TR] [TD]24[/TD] [TD]Staff/RADIUS[/TD] [TD]192.168.24.0/22[/TD] [TD]Staff wifi[/TD] [/TR] [TR] [TD]28[/TD] [TD]Guest/PSK[/TD] [TD]192.168.28.0/24[/TD] [TD]Guest wifi[/TD] [/TR] [TR] [TD]32[/TD] [TD]Tablet/PSK[/TD] [TD]192.168.32.0/22[/TD] [TD]College Tablets[/TD] [/TR] [/TABLE] There is a Windows Server 2008 R2 DC running DHCP for all scopes and NAP for RADIUS authentication. It is plugged in to a port on the 52G3 that is a member of VLAN 10 only and has a PVID of 10. The switch stack is configured for DHCP relay and is using static routing between all of the VLANS mentioned so far. The issue I'm having is that everything on the PSK authenticated networks and also on the RADIUS authenticated parts of VLAN 10 is fine and dandy but on VLANs 20 and 24 a lot of RADIUS traffic seems to be going missing. Access points connected via the 52G3 mostly seem to be working okay (95% of clients authenticate successfully) but RADIUS connections from access points connected via the 28GF3 don't seem to be making it over the stack link to the server; most but not all fail. Consequently almost nobody can connect to the correct wifi on that site. Bizarrely, a few RADIUS requests do manage to make it across so it's unlikely to be a misconfiguration, else none would make it. We're currently working around the issue by attaching staff to a less secure wifi VLAN that uses PSK. Our previous core switch, a forerunner of the M5300-52G3 called GSM7352Sv1, had exactly the same configuration apart from stacking and worked flawlessly so I'm convinced that the server and wifi side of things is not at fault since nothing has changed on them. We replaced the single core switch to reduce the number of fibre runs that traveled a long way over a main road and back again and terminated most of the fibre on the M5300-28GF3. Anyone got any ideas what might be going on here? I'm completely stumped!

Hi, weve just recently had these installed by our network provider for which they were configured aswell. the problem is - our cachepilot is on a 172.16.1 range and is pingable across all other vlans but it cant be accessed as a proxy server on port 8000 any else apart from the vlan it is a memebr of. therefore how can i route port 8000 across the other vlans?? thanks, ITHelp

Hi, If you are with JA.net you probably already know that from the end of March they will not route traffic outside (Internet) through their Network Infrastructure IP addresses. All fine for clients as you can use IP Pools but all Fortigate services ( license, antivirus, antispam, webfiltering) will try to go through the same interface without success. If you have MSR with JA.net then all should be ok but if your Fortigate Firewall is directly connected to JA.net infrastructure what do you plan to do?

We have a dedicated call center in our hospital. We are using a IP PBX software from a outsourced vendor. The software is installed in our PCs to attend the enquiry calls.The client pcs using in call center is a data vlan in one of the access switch. The server IP PBX software is installed in data center server farm switch. For the past weeks, the software was having some issues at some time, when i checked with the vendor they said software side is ok upon checking on wireshark logs. They have made several observations & fixes - Key Observations: Wrong Sequence Number (Red Entries) - RTP packets are arriving out of order or being lost, likely due to network congestion or QoS issues. High Jitter Values (Max: 7.03 ms) - Increased jitter can degrade voice quality, causing choppy audio or lag. Packet Loss (0.00%) - No significant packet loss was observed, but sequence errors suggest potential packet reordering. Clock Drift (-79 ms) - A lack of synchronization between sender and receiver clocks can impact audio quality. Cause - Solution. Network Congestion - Prioritize RTP traffic using QoS settings on the firewall or router. Jitter & Delay - Implement jitter buffers or increase buffer size in VoIP settings. Packet Reordering - Check network routing and MTU settings to prevent out-of-order delivery. Clock Drift - Ensure both endpoints synchronize time using NTP. Pls help me what to do from the core switch side or on the access switch side. NOTE- When I checked the ping status from the client PC to Server IP there is no drop or that much latency. Core switches are CISCO 4506 model Access switch for call center department is Aruba Instant ON 1930 model.

I've got 3 network cards in my debian box, ive got two that are on the same subnet which are 192.168.2.1/255.255.252.0 and 192.168.2.10/255.255.252.0 When i send traffic to 192.168.2.10 it goes through the 192.168.2.1 card, i presume this is some sort of routing issue. How can i fix it so that the traffic for each ip goes through the correct network card for it? Thanks Jack

OK - my last post on this got absolutely no response so I'm trying from a different direction. Our WiFi network allows guests to connect to the internet using our infrastructure but with no access to any other parts of the school network. I have been asked to setup a sandbox machine for the A Level ICT class that has internet access but cannot access the rest of the network. My thought was to assign the computer one of the IPs in the range for the guest wifi. I've done this and added the relevant netmask and gateway etc. When the computer is turned on (it's a linux box btw) it is unable to see the internet. I am also unable to ping it from the switch it is connected to but I can see its mac address on the port that it is using. The switch can ping the relevant gateway but it can also not ping the linux box despite the box being turned on and despite the fact that it can see its MAC address. I am assuming that this is a routing issue and that I need to add a route from the linux box to the gateway on the switch it is connected to - either that or the VLAN that is used by the guest wifi network is not routed or configured on the directly connected switch. If I do a sh ip on the switch all the vlans bar the management vlan show as disabled under IP Config. I have no idea what that means. I can also see that there is no routing configured on any switch except for the core switches. Can anyone assist?

I'm looking to setup an always on VPN service for our staff laptops. However, I'd prefer the VPN Server to reside on an isolated network as is best practice. Our firewall is provided by Exa via Link2ICT and is fully managed. I've asked if it's possible for a VLAN to be created on the Exa router and it to be isolated from the rest of the network. They've said an additional VLAN can be created in a different range, however it's not possible for it to be isolated i.e traffic would be free to flow between the subnets which the defeats the purpose of this. I've been given the option of the VLAN or a /30 point to point layer 3 link and handling the routing ourselves (something which I'm not particularly comfortable with) Has anybody had any experience with this type of scenario?, I would approach Exa support directly however, Link2ICT has an agreement with them and so we can't contact them directly Any help is greatly appreciated

Hi guys I am trying to learn the HP Procurve product for a coming implementation, and have a test lab comprising two Procurve 2920 24G switches to play with. I am trying to set up these two switches with vlan's, and am trying to test the intervlan routing on them. These two switches are not connected to any existing internal or external network, since I'm working on a customer site, I don't have that option. So therefore they are just two stand alone swithes to start with. I'm trying to see if I can create a few vlan's, with different ip adressing on each, and connect a labtop to the different vlan's, and then from one vlan ping the other vlan's , to test that routing between the vlan's are working. And would like to test the access list feature once I get the vlan routing to work. I found a guide of how to set up the routing for a Procurve 5300XL, which outline the following; CONFIGURATION COMMANDS: (created on software version E.06.01): HP ProCurve Switch 5304XL# enable HP ProCurve Switch 5304XL# config term HP ProCurve Switch 5304XL(config)# ip routing HP ProCurve Switch 5304XL(config)# router rip HP ProCurve Switch 5304XL(rip)# vlan 100 HP ProCurve Switch 5304XL(vlan-100)# untag a1-a24 HP ProCurve Switch 5304XL(vlan-100)# tag b1 HP ProCurve Switch 5304XL(vlan-100)# ip address 10.10.100.1/24 HP ProCurve Switch 5304XL(vlan-100)# ip rip v2-only HP ProCurve Switch 5304XL(vlan-100)# vlan 200 HP ProCurve Switch 5304XL(vlan-200)# untag c1-c24 HP ProCurve Switch 5304XL(vlan-200)# tag b1 HP ProCurve Switch 5304XL(vlan-200)# ip address 10.10.200.1/24 HP ProCurve Switch 5304XL(vlan-200)# ip rip v2-only HP ProCurve Switch 5304XL(vlan-200)# write mem I have used that guide as a framework to try and implement the intervlan routing on the 2920 24G switches, and below is the configuration I have on the switch right now. SwitchA(vlan-20)# sh run Running configuration: ; J9726A Configuration Editor; Created on release #WB.15.11.0007 ; Ver #03:12.15.0d:09 hostname "SwitchA" module 1 type j9726a trunk 23-24 trk1 lacp ip routing snmp-server community "public" unrestricted oobm ip address dhcp-bootp exit router rip redistribute connected exit vlan 1 name "DEFAULT_VLAN" no untagged 1-14,Trk1 untagged 15-22,A1-A2,B1-B2 no ip address exit vlan 10 name "MANAGEMENT" untagged 1-4 tagged Trk1 ip address 192.168.1.1 255.255.255.0 ip rip 192.168.1.1 exit vlan 20 name "SERVERS" untagged 5-9 tagged Trk1 ip address 10.1.1.1 255.255.255.0 ip rip 10.1.1.1 exit vlan 30 name "USERS" untagged 10-14 tagged Trk1 ip address 10.1.2.1 255.255.255.0 ip rip 10.1.2.1 exit vlan 40 name "SWITCH-LINK" tagged Trk1 ip address 172.16.1.1 255.255.255.0 ip rip 172.16.1.1 exit spanning-tree Trk1 priority 4 no autorun no dhcp config-file-update no dhcp image-file-update password manager password operator If I connect to a vlan port let's say vlan 10, with my laptop, and give my labtop a static IP address of 192.168.1.5, I can only ping 192.168.1.1 but none of the other IP adresses like for example 10.1.1.1 on vlan 20. What am I doing wrong, and shouldn't I be able to ping the other vlan's when the routing has been set up. Any help would be appreciated. virt-net

I've recently deployed a new VPN Server as our current isn't up to scratch in terms of ciphers etc which were being used. I got our provider (Exa via Link2ICT) to forward the necessary ports (500 and 4500 UDP) and everything was working fine for about a day. However, I'm no longer able to connect to the service using my personal broadband as there is no response from the VPN Server, when connecting via my mobile everything works fine. When I ping the server from my home broadband I get "destination net unreachable" however when going via my mobile when not connected to the VPN I get the expected "Request timed out". I was in contact with Link2ICT and "nothing is being blocked and the issue must be with my provider" at first this was believable as I suspect there are issues with my ISP so I put it down to that. My broadband contract is up so I'm changing provider, I thought that would resolve the issue. After much back and forth with Link2ICT this were very dismissive and are adamant that it's not there issue and they won't be providing any more support regarding this as "we're not using the supported VPN (Exa's Fortigate VPN)" However, today I had a complaint from a user that the VPN wasn't connecting. After remoting onto her laptop it appears that she is experiencing the exact same issue. When pinging the server "Destination net unreachable". This user is with a different provider to my self (she's with Sky and I'm with Vispa). I contacted Link2ICT, again their response was as were not using the provided VPN so they won't support us I'm no networking expert so my knowledge in these areas is pretty limited. After some Googling it seems that "Destination net unreachable" is usually indicative of either routing issues or the connection somehow being blocked. Both of which they deny are causing the issue I'm planning on ruling out a VPN issue by sticking iperf on the vpn server and trying to connect via my laptop remotely. Am I being an idiot or is this likely to be an issue on their side? This ticket has been open with them for over 17 days and I'm getting nowhere, I don't how much longer I can put up my their c**p

Hello Everyone, I’d like to get staff & pupils on different IP ranges because using devolved web filtering I can set different levels of filtering for different IP ranges. We already have 3 VLANs setup on our CISCO POP3 (Catalyst 3550) switch, done by the LA. Our admin machines (3) use the admin VLAN (10.121.77.0/24) and their workstations have a static IP config. Both staff and pupils are on 10.74.68.0 -10.74.69.255), I’d like to have our pupils on the 10.74.68.0/23 range and the teaching staff on the 10.74.30.0/24 range but I’m unsure of the following:- 1) Create VLANS 2) Do we have the correct hardware 3) How to issue DHCP to each VLAN (I Am able to give each WLAN a VLAN number though)? 4) If the teaching staff are on 10.74.30.0/24 how will they be routed through to 10.74.68.0/23? 5) Our AppleTV devices will probably be on 10.74.30.0/24 how will pupil ipads connect to them via AirPlay? A basic diagram.

Over summer we upgraded from windows 7 to 10. We had net support installed on the windows 7 machines and as far as we know we installed it the same way on the windows 10 machines - only issue is that no one knows how it was installed last time because the staff that were here have forgotten. One person thinks that there is a server-side component as well as the typical master/slave components installed on the client PCs but I have not once seen anything on any of the servers that suggests there is a server component and I cannot find reference to it anyway in the limited docs still around for our version. The symptoms appear to be that if you logon as a member of staff you can usually view some of the PCs set to be in the same room as the machine you are on, but not all of them - but they are all in the same OU on AD. We thought this was an issue with our version of net support so I tried installing veyon, this seems to have different symptoms on different PCs. Unlike net support I cannot do local discovery at all - even PCs that are on the same subnet. However unlike net support if I specify an IP/hostname to connect to it does so instantly. For this reason all of us are scratching our head: At first we thought it could be a VLAN issue with netsupport but the ability for veyon to connect disputes this. The DHCP and subnets have been completely changed to rule out any sort of routing issue. Although windows 7 does not display everything properly we even shoved veyon onto some old laptops and they seem to be able to connect fine. I'm sure it is something really simple but I have to admit I am running out of ideas.

Hi, Desperate help needed here please!! We have ISA 2006 Standard. Up til now it has been running perfectly... This morning I came in to find that internet access was down, with the following error in the Alerts/Monitoring page of ISA configuration every 10 mins or so: "Routing (Chaining) Failure" Whilst in the Application Log at the same time, the following error appears: Event ID: 14130. The Web Proxy filter detected that the upstream proxy server x is not available. During all this, access to the web is unavailable. Now i know the upstream proxy (our county's firewall) is working, as I have a single machine that connects ok (not via the ISA server). Checked all cabling, and all seems fine. Various searches on the web has not really turned anything useful up. Rebooted server but to no avail. Can anyone help please?!?!

Hello everyone. I have a 3Com 4500G (layer 2,3)switch and I plan to use it in the following way: I want to create few VLANS that form separate subnets. One for my company, lets say its 10.10.1.0 network. Two or three for clients in the building - they would use my infrastructure, but they would need their own servers etc - these would be 10.10.2.0 and so on. One for infrastructure, where internet gateway would be. Here is my problem - I am totally green here so please try not to yell at me In this setup I want to use a single gateway to the internet. What should I do to make some of those VLANS/subnets invisible to each other, but to use a single gateway. Is it doable using just 4500G? I know that I can have simple routing in layer 3 switch, but am totally lost on where to start. Thanks in advance for any help.

Hello everyone, I am having an issue trying to access the internet from some VLANS located behind a pfSense (which is doing NAT and is set to Automatic) box. The setup is as follows: VLAN 5 - 10.10.255.253 (Layer 3 Switch) -> 10.10.255.254 (pfSense LAN interface) VLAN 10 - 10.10.10.0/24 VLAN 20 - 10.10.20.0/24 VLAN 30 - 10.10.30.0/24 The VLANs can ping each other so inter VLAN routing is working ok. I have set a default route of: 0.0.0.0 0.0.0.0 10.10.255.254 I can ping 8.8.8.8 from the Layer 3 switch CLI, but for some reason, I cannot ping that address from any of the clients on any of the VLANS. The clients cannot ping 10.10.255.254 but the Layer 3 switch can. How can I get internet access on the clients? Thanks.