Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Routing issue with VLANs on Procurve 2650

Posted on 2009-04-14
3
Medium Priority
?
674 Views
Last Modified: 2012-05-06
I am trying to implement VLANs using an HP Procurve 2650 but cannot get the default route working properly. My test setup is as follows:

2650 with VLAN 2(primary), VLAN3 & VLAN4.
v2 IP 192.168.11.254
v3 IP 192.168.6.254
v4 IP 192.168.7.254

DEFAULT VLAN not used and IP is disabled for that VLAN.

IP routing is enabled. GVRP disabled.

I have added the Default Route 0.0.0.0 0.0.0.0 192.168.11.1 (interface of the Sonicwall 4060 firewall to which the switch is connected, which is also configured with VLAN support (virtual interfaces v2: 192.168.11.1, v3:192.168.6.1 & v4: 192.168.7.1).

2650 is connected to SW port with single CAT5, port in trunk LACP mode and tagged for all VLANs.

I can get all clients happily talking across the VLANs by setting their D/Gs as the IP of the switch on the respective VLAN (e.g. 192.168.6.254 for a client on an untagged port in VLAN3 with an IP of 192.168.6.100). However with this setup, the clients cannot see the firewall or anything beyond it, despite the default route pointing to the firewall primary interface. But I can ping the firewall from the switch CLI okay. I can also ping the clients and all VLAN IPs from the Sonicwall.

If I then change the D/G of each client to be the Sonicwall virtual interface IP (e.g. 192.168.6.1 in the example from the previous paragraph) then the client can ping all VLAN clients (so long as their D/Gs also point to the Sonicwall) and can ping everything external okay. BUT this is not workable in a production environment because all inter-VLAN traffic is now going via the Sonicwall's miserly 100MB port and no longer via the 2650's backplane with built-in rouiting which is obviously much faster.

I plan to implement 3x HP 2650s with an HP 4104 core all linked with GB trunks (as the production system is now, albiet with just the default VLAN working as a standard switch) so there is no way I can leave all traffic passing through a 100mb port, the network would just collapse.

Everything I have read states that the VLAN clients MUST have their D/G as the respective VLAN IP on the switch, which makes sense as it then utilises the internal routing capabilities. But no matter what I try I cannot get that setup to route to the firewall or beyond ......

I must be missing a basic step but I cannot work out what it is?

Please help, it's driving me mad!! Thanks.
0
Comment
Question by:jfreckeltom
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 28

Accepted Solution

by:
mikebernhardt earned 1000 total points
ID: 24151299
One option is to configure all hosts with 2 routes
route add -p 192.168.0.0 mask 255.255.0.0 192.168.[subnet].254
and a default route pointing to the local sonicwall interface

but you would be better off dropping the vlan support on the sonicwall (or at least not using most of the vlans), and leaving 192.168.11.1 as the default route. Then everything will route to the switch, and out to the sonicwall when required. This assumes that 192.168.11.0 is only used between the switch and the sonicwall, and no users are there.

The problem is that the users are going out one interface on the sonicwall (11.1), but then return traffic comes via another (6.1, etc.). Firewalls don't like that.
0
 

Author Comment

by:jfreckeltom
ID: 24152852
Thanks Mike. I opted for the second solution. I had stupidly followed a Sonicwall technote that said it would work!! I have now dropped the VLAN settings on the SW and instead created address objects for each VLAN subnet and created routes to those via the SW trunked port using the primary IP of the switch as the gateway. Now works perfectly!!!

Thank you so much, you're a life saver!! :-)
0
 

Author Closing Comment

by:jfreckeltom
ID: 31570194
Thanks Mike.

I opted for the second solution. I had stupidly followed a Sonicwall technote that said it would work!! I have now dropped the VLAN settings on the SW and instead created address objects for each VLAN subnet and created routes to those via the SW trunked port using the primary IP of the switch as the gateway. Now works perfectly!!!

Thank you so much, you're a life saver!! :-)
0

Featured Post

The Ideal Solution for Multi-Display Applications

Check out ATEN’s VS1912 12-Port DP Video Wall Media Player at InfoComm 2017. Kerri describes how easy it is to design creative video walls in asymmetric layouts and schedule detailed playlists ahead of time with its advanced scheduling feature.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question