Solved

Reconfigure network from flat layer 2 to routing switch and VLANs.

Posted on 2010-11-16
6
709 Views
Last Modified: 2012-05-10
I am charged with re-configuring a network that has moved from wireless modems to fiber optic.  VLANs for each remote site have been created to organize the network by location and function. A VOIP VLAN will span the entire network.  The traffic for the remote sites is being tunneled by a third party and terminates on Port 1 of an HP ProCurve 3500yl-48 routing switch.  The routing switch connects via Port 12 to a layer 2 top switch that connects to the firewall and other switches.  The top switch and all other switches not connected to the routing switch have co-mingled IP addresses (192.0.0.0/24 and 192.168.0.0/24).  All devices on those two segments are statically assigned.  DHCP has been implemented for the VLANs at the remote sites.  That is working fine.
Just recently I implemented VLAN 103 and found workstations with Windows 7 (192.168.103.x) can not stay connected to Outlook (192.0.0.246). They continue to build sessions to a maximum and then error out.  A tracert from workstation to the email server fails to the count of 30.  A ping is returned in <1ms.  When I checked the other VLANs for traceroutes, I found they all fail at their gateways (192.168.xx.5).  The routing switch fails as well (192.168.100.5).  I've included information in attached files to help show current configurations.  I've also included the results of traceroutes from each VLAN top switch at the remote sites to the email server (192.0.0.246) and another server (192.168.0.214).  The VLAN 103 switch is the only switch that is connected directly by fiber to the routing switch at Port 47.
I need another set of eyes to see if there is a misconfiguration or a better way of implementation.  
MyNetworkTopologyNowandFuture.vsd
FW-VLANConfiglayout.xlsx
0
Comment
Question by:cityofpasco
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 12

Expert Comment

by:Fidelius
ID: 34160272
Hi cityofpasco,

First of all, thanks for supplied vsd. It helps a lot, but please name the switches (something like SW1, SW2...etc). This way it is easier to know which switch we are talking about.

As a first suggestion you should change 192.0.0.0/24 range to some 192.168.x.x range. You can find explanation here: http://whois.domaintools.com/192.0.0.0
Pay attention to following paragraph: Addresses from this range SHOULD NOT be used  as an alternative to the private IPv4 address ranges assigned by the IETF in the Best Current Practice document, RFC 1918.

Second, try to have 1 IP range = 1 VLAN it will simplify communication and we will be able to troubleshoot easier.

Few questions to clarify situation:
Your topology now is the same as Goal topology?
Who has the address 192.168.100.203?
Please provide routing tables from firewall and 3500 switch.

Thanks in advance!

Regards,
--
Fidelius
0
 

Author Comment

by:cityofpasco
ID: 34160673
Thank you for responding to my question.  I have modified the .vsd and attached it for your review.  Please note the Current topology has a layer 2 switch (SW2) between the routing switch (SW1) and the Firewall.  My intent is to remove that and make it a subordinate to the routing switch. The Goal .vsd depicts that.

As far as the 192.0.0.0/24 address range goes, I have inherited this network and it is my intention to move as many devices off this segment and onto the 192.168.xx.xx/24 with this redesign.  There are numerous AD, DNS, DHCP, and WINS servers on the 192.0.0.0 segment and by moving workstations and other devices first onto DHCP and new 192.168.xx.xx segments, it will be easier to configure through the scopes any changes in those all important functions.  Right now every workstation is statically assigned and a person must touch each one to make any changes.  

I had included a rough .xls spreadsheet with my original question submission.  Did you not see it there?  I will attach it again for your review.  It has Firewall and switch information as well as traceroutes and pings results.
MyNetworkTopologyNowandFuture.vsd
FW-VLANConfiglayout.xlsx
0
 
LVL 12

Expert Comment

by:Fidelius
ID: 34166317
Hi,

Thanks for clarification. Sorry, I missed routing info in .xls.

If I understood correctly, first 24 lines in .xls are regarding firewall, and from 26 to 48 is for SW1. Correct me if I'm wrong.

OK. Traceroute fails probably because of firewall. By default firewalls do not allow traceroute. You probably already checked that, but I'm trying to cover every possible place for problem. As I can see all traceroute attempts are failing after first hop, and second hop is firewall.

Simplest solution as I can see is to disconnect SW2 from firewall, and connect SW1 directly to firewall, and transfer all routing to SW1. Only default route should be pointing to firewall
This scenario will be most efficient transient solution to achieve goal topology.

Result of this transient solution will be, elimination of firewall as source of problems, and it will simplify routing troubleshoot.

Same effect, without physical reconnection can be achieved by putting IP address on VLAN1, so all the routing between VLANs will be done on SW1.

I hope this helps, keep me informed about progress, so we can troubleshoot further.

Regards,
--
Fidelius
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:cityofpasco
ID: 34166890
Thank you for your explanations.  Yes, you are correct on the .xls lines of information for firewall and SW1.

I have a question about your suggestion regarding VLAN1.  What IP address would I use?  How does the routing get moved over to SW1 without disconnecting the 192.0.0.0 and 192.168.0.0 devices?  VLAN 99 and VLAN100 do not have any members yet because of STP.  

Thanks.

0
 
LVL 12

Accepted Solution

by:
Fidelius earned 500 total points
ID: 34168974
Hi!

You can add two IP addresses to VLAN interface. I think it is something like this:
3500# vlan 1 ip address 192.168.0.254 255.255.255.0
3500# vlan 1 ip address 192.0.0.254 255.255.255.0

In this example I used .254 as host address. You can use whichever is available.

You will just need to set default gateway on hosts to addresses set above. Try it first on hosts used in traceroute commands. This setup will not affect hosts which have firewall as default gateway.

Regards!
0
 

Author Comment

by:cityofpasco
ID: 34169425
Thank you for explaining and now that I see it, I understand.  Thank you for taking time to look this over for me.  I am going to accept your answer and close the issue now.

Go in peace.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question