Solved

Routing issue with VLANs on Procurve 2650

Posted on 2009-04-14
3
665 Views
Last Modified: 2012-05-06
I am trying to implement VLANs using an HP Procurve 2650 but cannot get the default route working properly. My test setup is as follows:

2650 with VLAN 2(primary), VLAN3 & VLAN4.
v2 IP 192.168.11.254
v3 IP 192.168.6.254
v4 IP 192.168.7.254

DEFAULT VLAN not used and IP is disabled for that VLAN.

IP routing is enabled. GVRP disabled.

I have added the Default Route 0.0.0.0 0.0.0.0 192.168.11.1 (interface of the Sonicwall 4060 firewall to which the switch is connected, which is also configured with VLAN support (virtual interfaces v2: 192.168.11.1, v3:192.168.6.1 & v4: 192.168.7.1).

2650 is connected to SW port with single CAT5, port in trunk LACP mode and tagged for all VLANs.

I can get all clients happily talking across the VLANs by setting their D/Gs as the IP of the switch on the respective VLAN (e.g. 192.168.6.254 for a client on an untagged port in VLAN3 with an IP of 192.168.6.100). However with this setup, the clients cannot see the firewall or anything beyond it, despite the default route pointing to the firewall primary interface. But I can ping the firewall from the switch CLI okay. I can also ping the clients and all VLAN IPs from the Sonicwall.

If I then change the D/G of each client to be the Sonicwall virtual interface IP (e.g. 192.168.6.1 in the example from the previous paragraph) then the client can ping all VLAN clients (so long as their D/Gs also point to the Sonicwall) and can ping everything external okay. BUT this is not workable in a production environment because all inter-VLAN traffic is now going via the Sonicwall's miserly 100MB port and no longer via the 2650's backplane with built-in rouiting which is obviously much faster.

I plan to implement 3x HP 2650s with an HP 4104 core all linked with GB trunks (as the production system is now, albiet with just the default VLAN working as a standard switch) so there is no way I can leave all traffic passing through a 100mb port, the network would just collapse.

Everything I have read states that the VLAN clients MUST have their D/G as the respective VLAN IP on the switch, which makes sense as it then utilises the internal routing capabilities. But no matter what I try I cannot get that setup to route to the firewall or beyond ......

I must be missing a basic step but I cannot work out what it is?

Please help, it's driving me mad!! Thanks.
0
Comment
Question by:jfreckeltom
  • 2
3 Comments
 
LVL 28

Accepted Solution

by:
mikebernhardt earned 250 total points
Comment Utility
One option is to configure all hosts with 2 routes
route add -p 192.168.0.0 mask 255.255.0.0 192.168.[subnet].254
and a default route pointing to the local sonicwall interface

but you would be better off dropping the vlan support on the sonicwall (or at least not using most of the vlans), and leaving 192.168.11.1 as the default route. Then everything will route to the switch, and out to the sonicwall when required. This assumes that 192.168.11.0 is only used between the switch and the sonicwall, and no users are there.

The problem is that the users are going out one interface on the sonicwall (11.1), but then return traffic comes via another (6.1, etc.). Firewalls don't like that.
0
 

Author Comment

by:jfreckeltom
Comment Utility
Thanks Mike. I opted for the second solution. I had stupidly followed a Sonicwall technote that said it would work!! I have now dropped the VLAN settings on the SW and instead created address objects for each VLAN subnet and created routes to those via the SW trunked port using the primary IP of the switch as the gateway. Now works perfectly!!!

Thank you so much, you're a life saver!! :-)
0
 

Author Closing Comment

by:jfreckeltom
Comment Utility
Thanks Mike.

I opted for the second solution. I had stupidly followed a Sonicwall technote that said it would work!! I have now dropped the VLAN settings on the SW and instead created address objects for each VLAN subnet and created routes to those via the SW trunked port using the primary IP of the switch as the gateway. Now works perfectly!!!

Thank you so much, you're a life saver!! :-)
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

I see many questions here on Experts Exchange regarding switch port configurations and trunks. This article is meant for beginners in the subject to help to get basic knowledge about Virtual Local Area Network (VLAN (http://en.wikipedia.org/wiki/Vir…
Tired of waiting for your show or movie to load?  Are buffering issues a constant problem with your internet connection?  Check this article out to see if these simple adjustments are the solution for you.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now