• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 5089
  • Last Modified:

Creating DHCP Scopes for multiple VLANs on a HP 2910al

Hello All,

To be Short, my company has expanded and thus ran out of IP addresses for the current DHCP Scope. I have created a VLAN on the 2910 with a new IP address, I am trying to configure the windows 2003 DHCP server to dish out IPs in the new scope for the VLAN.

This is my current configuration:

DHCP Server: 192.168.123.6
VLAN IP: 192.168.126.253
new DHCP Scope: 192.168.126.0-254

Below is the config for my HP 2910:


Running configuration:

; J9145A Configuration Editor; Created on release #W.14.38

module 1 type J9145A

ip default-gateway 192.168.123.254
ip routing
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-2,4-11,13-24
   ip address 192.168.123.253 255.255.255.0
   no untagged 3,12
   exit

vlan 6
   name "VLAN6_West"
   untagged 12
   ip helper-address 192.168.123.6
   ip address 192.168.126.253 255.255.255.0
   exit
dhcp-relay option 82 append
dhcp-snooping
dhcp-snooping authorized-server 192.168.123.6
dhcp-snooping vlan 1-100

NOTE: I have excluded some data, if you require more please let me know

Please let me know what I am missing in order to have the new DHCP scope kick IPs out on port 12.

Thank you in Advance.
0
drnfx
Asked:
drnfx
  • 27
  • 18
  • 5
  • +1
1 Solution
 
rfc1180Commented:
Your new vlan6 does not require any dhcp help addresses as the DHCP server is on the same broadcast domain as the DHCP clients. Is there something that is not working, or are you requesting confirmation prior to deployment?
0
 
JAN PAKULAICT Infranstructure ManagerCommented:
using subnet mask 255.255.255.0 for  192.168.123.254 and same for 192.168.123.6 makes them in different subnets. - for this to work you have to enable some kind of routing protocol (RIP)

Where is your sh ip int?

Jan MA CCNA
0
 
JAN PAKULAICT Infranstructure ManagerCommented:
seccond addres should be 192.168.126.0-254
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
drnfxAuthor Commented:
What is not working is I am not getting IPs from the DHCP of scope 192.168.126.0

the two vlans are on seperate subnets thus different broadcast domains ergo i need the ip-helper.

From my PC (.123.xxx) I am able to ping .126.253. I have an open route and ip routing enabled on the switch.


0
 
JAN PAKULAICT Infranstructure ManagerCommented:
did you crate new DHCP Scope under sites and services?
0
 
drnfxAuthor Commented:
Yes I did, under scope options i have the following:
Router - 192.168.126.253 (VLAN 6 IP)
DNS - internal DNS serve
WINS - internal DNS server

0
 
JAN PAKULAICT Infranstructure ManagerCommented:
0
 
drnfxAuthor Commented:
Will this work for HP ProCurve 2910?
0
 
JAN PAKULAICT Infranstructure ManagerCommented:
ios is similar- give it a go
0
 
drnfxAuthor Commented:
Unfortunately, the commands do not transfer. :(
0
 
rfc1180Commented:
>the two vlans are on seperate subnets thus different broadcast domains ergo i need the ip-helper.
K, just wanted to make sure this was the case; you have dhcp-relay option 82 append with ip routing enabled, so your config is pretty much complete. Maybe a wireshark capture at the server to see what is happening.
0
 
rfc1180Commented:
Also, one thing to rememebr, If the DHCP server is not configured to handle the packets with option 82, it ceases to allocate the address to that request.
0
 
drnfxAuthor Commented:
what should I set the Remore ID on the dhcp-relay option 82 ? right now it is set to mac, should I change that?
0
 
drnfxAuthor Commented:
I am running Windows Server 2003, how do I configure that to handle option 82
0
 
rfc1180Commented:
dunno, not a windows guys, but I am sure the links would help; did you review the links?
0
 
drnfxAuthor Commented:
I did, that didn't make a difference. I have pin pointed the problem I think to a routing problem:

I placed my laptop directly connected to port 12 and assigned it a static 192.168.126.2 IP

I am able to ping 192.168.126.253 but I am unable to ping anything on the 123.x network

from my desktop (123.x) I am able to ping 192.168.126.253 but not 126.2

From the switch I am able to ping everything (thank fully)

So far this is where my troubleshooting has left me.
0
 
roger_karamCommented:
IP helper address is a one line config and it seems right.

Can you post your whole config file?  When you set the laptop with a static IP do you put the gateway as the local IP VLAN (126.254)?

Also, try the  tracert command from your desktop and see where the packet goes.

Your routing table (show ip route) should display both the 192.168.126.0 and 192.168.123.0 networks.

-RK
0
 
roger_karamCommented:
sorry, the gateway should read 126.253.
0
 
drnfxAuthor Commented:
If i do a tracert from my desktop it only shows the one hop to .126.253.

The static gateway is set as 192.168.126.253 as it should be.

when i get in tomorrow I will check the routing table on the switch... if i recall it wasnt in there,

I am new to HP switches, how do I add a route... i have an idea but what should be the route...

if i do a :

Switch(config)# ip route etc? or do i have to add a network 192.168.126.0 somewhere??
0
 
drnfxAuthor Commented:
And to add; there are two routes shown below:

ip route 0.0.0.0 0.0.0.0 192.168.123.254
ip route 192.168.123.0 255.255.255.248

.248 is another switch on the network.
0
 
roger_karamCommented:
it should be "ip route Address/mask nexthop"

Here is an example straight from the manual:

Default Route:
ProCurve(config)# ip route 0.0.0.0/0 208.45.228.35

Static Route:
ProCurve(config)# ip route 207.95.7.0/24 207.95.6.157

are you sure about the 255.255.255.248 address you sent? Because 255.255.255.x is not a valid IP afaik.
0
 
drnfxAuthor Commented:
Here is the bottom portion of the config.



dhcp-snooping
dhcp-snooping authorized-server 192.168.123.6
dhcp-snooping vlan 1-100
timesync sntp
ip route 0.0.0.0 0.0.0.0 192.168.123.254
ip route 192.168.123.0 255.255.255.0 192.168.123.246
interface 3
   dhcp-snooping trust
   exit
interface 12
   dhcp-snooping trust
   exit
0
 
roger_karamCommented:
you should remove the "ip route 192.168.123.0 255.255.255.0 192.168.123.246" line.

Since 192.168.123.0 is directly connected through VLAN 1, that line is unnecessary and probably does not go into your routing table.
0
 
drnfxAuthor Commented:
Man, I am blowing up this post... but I think i realized whats the problem...

The DHCP server is not on the same switch, its connected in the other IDF.

I am unable to ping 192.168.126.253 from that switch. I am unfamiliar with HP switches and all I have done is enabled ip routing.

How do I add a network to the route table?

i know i need to add somthing like: network 192.168.126.0
0
 
drnfxAuthor Commented:
West Switch:

 
                                 IP Route Entries

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  0.0.0.0/0          192.168.123.254 1    static               1          1
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0
  192.168.123.0/24   DEFAULT_VLAN    1    connected            1          0
  192.168.126.0/24   TEST            3    connected            1          0


East Switch:
 IP Route Entries

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  127.0.0.0/8        reject               static               0          250
  127.0.0.1/32       lo0                  connected            0          0
  192.168.123.0/24   DEFAULT_VLAN    1    connected            0          0

on the east switch do i add:

ip route 192.168.126.0 255.255.255.0 192.168.126.253 ?


0
 
roger_karamCommented:
Since 192.168.126.0 is a VLAN on that switch, you don't need to add a the network, you just need to add the VLAN to the correct port, in your case VLAN 6:

vlan 6
untagged port X, Y

where X and Y are ports that need to talk to that IP range.

0
 
roger_karamCommented:
On the east switch add the following route:

ip route 192.168.126.0/24 192.168.123.254
0
 
drnfxAuthor Commented:
So i have to create the vlan on the East Switch?

I think i just confused everyone.
0
 
roger_karamCommented:
(since VLAN 6 is not on the east switch, you have to point it to VLAN 3 on the West switch, because West knows where VLAN 3 and VLAN 6 are....)
0
 
roger_karamCommented:
Hehe, I am a little confused, but to avoid adding the VLAN on East, just put up the route i mentioned and it should work.
0
 
drnfxAuthor Commented:
I modified the command for:

ip route 192.168.126.0/24 192.168.123.253 and I was able to ping 192.168.126.253 from the East Switch.

I am going to see if I can pull a DHCP from the new scope now.
0
 
drnfxAuthor Commented:
I am able to ping 192.168.126.2 when it is statically assigned everywhere on the network... However i cannot obtain a DHCP from the server..

My laptop is running ubuntu and when i use the sudo dhcpclient command this is what i see :

DHCPDISCOVER sent on eth0 to 255.255.255.255
packet_send: Network is down
0
 
roger_karamCommented:
try disabling dhcp snooping and option 82 append. If it works, we can figure out what is wrong with those commands.
0
 
drnfxAuthor Commented:
I have DHCP-relay option 82 disabled currently.


West_GB_2910# sh dhcp-relay
  DHCP Relay Agent         : Enabled
  Option 82                : Disabled
  Response validation      : Disabled
  Option 82 handle policy  : append
  Remote ID                : mac


  Client Requests       Server Responses

  Valid      Dropped    Valid      Dropped
  ---------- ---------- ---------- ----------
  46267      0          0          0


gonna disable snooping and see
0
 
roger_karamCommented:
The switch did not receive a single response from the server. Can you send screenshots of you Windows DHCP configuration?
0
 
drnfxAuthor Commented:
I have attached the scope options i have in place for the 192.168.126.0 scope.
dhcp.jpg
0
 
roger_karamCommented:
Can you send the address pool as well? and at the top (blacked out), is the server active/authorized (green)?
0
 
roger_karamCommented:
And check the windows 2003 event viewer, see if it is getting the requests

To open Event Viewer, click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.

http://technet.microsoft.com/en-us/library/cc737766(WS.10).aspx
0
 
drnfxAuthor Commented:
Yeah, I blacked it out because the active scope was on there of 192.168.123.0 and if I plug the laptop in a vlan 1 port i am able to pull an 123.x IP from the DHCP server.

0
 
roger_karamCommented:
It should work with both scopes. Windows sees from the IP it is receiving and uses the same for the specific scope. Event log might show if it received the requests and what it did to them....
0
 
drnfxAuthor Commented:
Do I need to enable option 82 for this to work? or standard dhcp-relay should be enough?
0
 
roger_karamCommented:
standard dhcp is enough, option 82 is for further auditing. If the command "dhcp-relay option 82 append" is still in there, please remove it for now
0
 
drnfxAuthor Commented:
I have wireshark running on the DHCP server and I am filtering my Laptop's Mac address.

I also have wireshark running on my laptop. It send out the DHCPdiscover packet but thats it nothing else, and the server is not receiving anything from the laptop.

our gateway .254 is an astaro firewall... could that be preventing something?
0
 
roger_karamCommented:
Is the firewall between East and West? Also, don't filter with the MAC address, capture anything coming from the server IP. The relay will be sent from the Switch MAC if im not mistaken.
0
 
drnfxAuthor Commented:
can i filter with the ip of the vlan? 192.168.126.253 ?
0
 
drnfxAuthor Commented:
Okay I have included a .pcap from the DHCP server, i filtered by the IP address of the VLAN
0
 
drnfxAuthor Commented:
okay it didnt post.

But the server is sending out an DHCP offer, but it is not being received by the laptop.
0
 
roger_karamCommented:
I think you forgot the file :-p
0
 
drnfxAuthor Commented:
I changed the extension to .h change it back to .pcap to view.
DHCP.h
0
 
roger_karamCommented:
Ok, well it seems like the packet is going. Can you capture the port from the switch to the laptop you are testing? You want to filter any DHCP  (on wireshark, filter: bootp.dhcp).


Actually, just found something very interesting on the release notes. You should update your firmware...

Fix on version 14.39

DHCP (PR_0000044256)— The switch does not properly forward the DHCP response to
clients.

0
 
drnfxAuthor Commented:
Okay, I am going to update the firmware tonight and post as soon as it is finished.

I want to thank you in advance if this works :)
0
 
drnfxAuthor Commented:
It works!! I also disabled dhcp-snooping... I realized that the DHCP server was receiving acks but nothing else, and as soon as i disabled dhcp-snooping everything worked.

THank you for your assistance roger_karam.
0
 
roger_karamCommented:
No problem! Thanks for the points!

You could also enable DHCP snooping, just make sure to follow the manual:

enable dhcp snooping:
dhcp-snooping
dhcp-snooping authorized-server 192.168.123.6
dhcp-snooping vlan 1-100
dhcp-snooping trust X (where X is the port list where the DHCP server is coming in from)
no dhcp-snooping verify mac

and you can check if it is dropping packets by:
show dhcp-snooping stats

http://cdn.procurve.com/training/Manuals/2910-ASG-Feb09-W_14_03.pdf

best of luck!

-RK
0
 
drnfxAuthor Commented:
Ahh! I had everything configured except for no dhcp-snooping verify mac

0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 27
  • 18
  • 5
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now