I just implemented a VLAN to segregate my users from the servers, using my HP Procurve Layer 3 switch.  Ever since then, Servers in my DMZ cannot "see" the IP addresses of machines in that VLAN.

Posted on 2011-05-02
Last Modified: 2012-06-27
I just implemented a VLAN to segregate my users from the servers in my network, using my HP Procurve Layer 3 switch (running trunk lines to my Layer 2 switches).  Ever since then, Servers in my DMZ cannot "see" the IP addresses of machines in that reside in this new VLAN.  Furthermore, machines in this new VLAN seem to be having trouble accessing Active Directory; if I attempt to add a user's AD account into the local Administrators group of said machine, there is a very long delay.

With these symptoms, any idea what I missed in my VLAN configuration?
Question by:esphelpdesk
    LVL 7

    Assisted Solution

    This could come from many reasons:
    How is the network designed? Separated by firewalls?
    Do you have a layer 3 interface for all vlans and are all hosts using the these as their default gateway?
    Can you provide configs for the switches (layer 2 and 3)
    LVL 12

    Expert Comment

    please post your switch configs and maybe some info with IP addresses or a drawing

    Author Comment

    My core switch config is attached.  

    Author Comment

    Attachment got stripped.  I'll just paste text...

    hostname "5406-01"
    snmp-server contact "IT Helpdesk"
    snmp-server location "Data Center"
    time timezone -300
    time daylight-time-rule Continental-US-and-Canada
    no web-management
    web-management ssl
    no telnet-server
    module 1 type J8702A
    module 2 type J8705A
    module 3 type J8702A
    module 4 type J8702A
    module 5 type J8702A
    module 6 type J8702A
    interface B21
       name "Uplink to First Floor Switch"
    interface B22
       name "Uplink to Basement"
    interface E21
       lacp Passive
    trunk E2 Trk2 Trunk
    trunk E7 Trk3 Trunk
    trunk E8 Trk4 Trunk
    trunk E9 Trk5 Trunk
    trunk E10 Trk6 Trunk
    trunk E11 Trk7 Trunk
    trunk E12 Trk8 Trunk
    trunk E13 Trk9 Trunk
    trunk E14 Trk10 Trunk
    trunk E15 Trk11 Trunk
    trunk E16 Trk12 Trunk
    trunk E17 Trk13 Trunk
    trunk E18 Trk14 Trunk
    trunk E19 Trk15 Trunk
    trunk E20 Trk16 Trunk
    trunk B22 Trk36 Trunk
    trunk B21 Trk35 Trunk
    trunk B23 Trk37 Trunk
    trunk B24 Trk38 Trunk
    ip default-gateway
    ip routing
    timesync sntp
    sntp unicast
    sntp 600
    snmp-server community "snmppublic" Operator
    vlan 1
       name "10.1.1.x"
       untagged A1-A4,A6-A16,B1-B20,C1-C24,E1,E3-E6,E21-E24,F13-F20,Trk2-Trk16,Trk35-Trk38
       ip address
       no untagged A5,A17-A24,D1-D24,F1-F12,F21-F24
    vlan 2
       name "10.1.2.x"
       untagged D1-D24
       tagged Trk2-Trk16
       no ip address
    vlan 3
       name "10.1.3.x"
       ip helper-address
       ip address
       tagged Trk35-Trk38
    vlan 4
       name "10.1.4.x"
       ip helper-address
       ip address
    vlan 5
       name "192.168.254.x"
       untagged A5,A17-A24,F1-F12
       tagged Trk2-Trk16
       no ip address
    vlan 6
       name "172.16.64.x"
       untagged F21-F24
       no ip address
    vlan 7
       name "iSCSI"
       ip address
       tagged Trk2-Trk16
    vlan 8
       name "vMotion"
       ip address
       tagged Trk2-Trk16
    vlan 9
       name "FT"
       ip address
       tagged Trk2-Trk16
    mirror 1 port B19
    mirror 2 port D23
    sntp server priority 1
    ip route
    ip route
    ip route
    ip route
    ip route
    spanning-tree Trk2 priority 4
    spanning-tree Trk3 priority 4
    spanning-tree Trk4 priority 4
    spanning-tree Trk5 priority 4
    spanning-tree Trk6 priority 4
    spanning-tree Trk7 priority 4
    spanning-tree Trk8 priority 4
    spanning-tree Trk9 priority 4
    spanning-tree Trk10 priority 4
    spanning-tree Trk11 priority 4
    spanning-tree Trk12 priority 4
    spanning-tree Trk13 priority 4
    spanning-tree Trk14 priority 4
    spanning-tree Trk15 priority 4
    spanning-tree Trk16 priority 4
    spanning-tree Trk35 priority 4
    spanning-tree Trk36 priority 4
    spanning-tree Trk37 priority 4
    spanning-tree Trk38 priority 4
    vlan 1
       monitor all Both mirror 1
    vlan 2
       monitor all Both mirror 2
    password manager
    password operator
    LVL 17

    Accepted Solution

    The routing:
    I F    the routing between these vlans are ment to take place in this L3-switch, I would only have one IP ROUTE to dgw:
    ip route
    no ip route
    no ip route
    no ip route
    no ip route

    -however in router there should be routes back to relevant networks
    ip route mask  gw
    ip route mask  gw
    .. etc
    and as mentioned by ironmannen each clients should have network setup matching vlan, with same netmask and IP of vlan as dgw.
    I think routing is the main thing here.

    For a particular link the tagging/untagging  of vlans should closely mach in both ends.

    Mirror ports can be fine for temporary troubleshooting but is said to burden ordinary operation.


    Author Comment

    I was able to fix this issue... apparently my Firewall was NATing the traffic from this VLAN on its way to my DMZ, so I created an exclusion rule.  Thanks for your help!

    Author Closing Comment

    Thank you for spending time on this.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Suggested Solutions

    The worst thing when starting a new job is when the previous Network Administrator left behind no documentation. How do you get into the devices? If you've been in this situation or just accidently mistyped your password, this article will hopefully…
    I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now