?
Solved

Dell PowerConnect 2748 Issue

Posted on 2011-05-04
18
Medium Priority
?
1,058 Views
Last Modified: 2012-06-21
Due to costs, I have setup a router-on-a-stick network using a Cisco ASA5510 connected to three interconnected PowerConnect 2748's. Last friday night I setup the VLANs on the all three and everything works great. My only issue, I am unable to ping / connect to any of the switches on the 192.168.100.2 (or any VLAN network for that matter other than the default VLAN 1)  network even when my machine I am trying to ping / connect to is on the same network. I am currently able to make changes to the config by leaving port 45 untagged on all three swithced and left alone on the default VLAN 1. Below is what I did to set this up....

 
Thoughts?

 
Switch 192.168.100.2

- VLAN Membership page: click "Create VLAN" radio button, enter 2 in the vlan field, set port 1 to 'T' (for tagged), set port 48 to 'T' (for tagged), set ports 2 through 44 to 'U' for untagged, click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 3 in the vlan field, set port 1 to 'T' (for tagged), set port 48 to 'T' (for tagged), click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 4 in the vlan field, set port 1 to 'T' (for tagged), set port 48 to 'T' (for tagged), click "Apply Changes"

- VLAN Port Setting page (Apply for ports 2 through 44): Change "Interface" to "Port #", set "PVID" to 2, click "Apply Changes"

- VLAN Port Setting page (Apply for ports 1 & 48): Change "Interface" to "Port #", set "PVID" to 2, set to “Allow All” and click "Apply Changes"

 

Switch 192.168.100.3

- VLAN Membership page: click "Create VLAN" radio button, enter 2 in the vlan field, set port 48 to 'T' (for tagged), set port 47 to 'T' (for tagged), set ports 1 through 44 to 'U' for untagged, click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 3 in the vlan field, set port 48 to 'T' (for tagged), set port 47 to 'T' (for tagged), click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 4 in the vlan field, set port 48 to 'T' (for tagged), set port 47 to 'T' (for tagged), click "Apply Changes"

- VLAN Port Setting page (Apply for ports 1 through 44): Change "Interface" to "Port #", set "PVID" to 2, click "Apply Changes"

- VLAN Port Setting page (Apply for port 47): Change "Interface" to "Port # 47", set "PVID" to 2, set to “Allow All” and click "Apply Changes"

- VLAN Port Setting page (Apply for port 48): Change "Interface" to "Port # 48", set "PVID" to 2, set to “Allow All” and click "Apply Changes"

 

  Switch 192.168.100.4

- VLAN Membership page: click "Create VLAN" radio button, enter 2 in the vlan field, set port 48 to 'T' (for tagged), click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 3 in the vlan field, set port 48 to 'T' (for tagged), set ports 1 through 36 to 'U' for untagged, click "Apply Changes"

- VLAN Membership page: click "Create VLAN" radio button, enter 4 in the vlan field, set port 48 to 'T' (for tagged), set ports 37 through 44 to 'U' for untagged, click "Apply Changes"

- VLAN Port Setting page (Apply for ports 1 through 36): Change "Interface" to "Port #", set "PVID" to 3, click "Apply Changes"

- VLAN Port Setting page (Apply for ports 37 through 44): Change "Interface" to "Port #", set "PVID" to 4, click "Apply Changes"

- VLAN Port Setting page (Apply for port 48): Change "Interface" to "Port # 48", set "PVID" to 2, set to “Allow All” and click "Apply Changes"
0
Comment
Question by:jhakie
  • 11
  • 7
18 Comments
 
LVL 4

Expert Comment

by:dbright5813
ID: 35697911
You'll need to assign an IP interface for each switch on each VLAN. I'm not sure if the 2700 series firmware has the ability to do this or not.
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35697947
er... assign an IP address to each VLAN interface on each switch.

Grammar failing - must have coffee...
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35697983
Here's an example from a 3500 series (CLI based, you'll have to do the equivelent in the web interface on the 2700)

interface vlan 1
ip address 172.16.1.1 255.255.255.0 
exit
ip default-gateway 172.16.1.254

Open in new window

0
SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

 
LVL 1

Author Comment

by:jhakie
ID: 35698020
So essentially its about the default gateway? Because currently I have it set 192.168.100.1 which is ASA5510.
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35701042
Not necessarily. It's about setting the IP address (and optionally, default gateway) for the management interface of each VLAN.

Since you've set each port in the vlan to use a PVID, there is no way for frames from a port in 1 VLAN to pass to another VLAN without going through a router or an L3 switch first.

Think of it this way:
Each VLAN is a separate network.
Each switch within each VLAN has to have a management IP address.

To be able to view the webserver, you need to either :
be in the management VLAN (typically VLAN 1) and have an IP address set on each switch for the for the switch as a whole,

-or-
Put a management IP address on the webserver for that switch within each VLAN that you want to be able to access the admin page from.

-or-
Create a 5th VLAN for untagged packets that goes nowhere, and enforce VLAN tagging on all your endstations, then add a management IP address for the switch in that VLAN.
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35701076
I'm not familiar with the ASA, but if it were my network, I'd see if it can act as a GVRP server and use it to dynamically assign the VLANs based on the endstation user and/or endstation MAC.
0
 
LVL 1

Author Comment

by:jhakie
ID: 35701309
"Put a management IP address on the webserver for that switch within each VLAN that you want to be able to access the admin page from."

I have given each switch an IP address from the VLAN network that I want access from and I still can't ping/connect to the web interface...
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35701375
Oh, and you'll want to set the port(s) that feed to the ASA to trunk mode
0
 
LVL 1

Author Comment

by:jhakie
ID: 35701444
Right and I have already done that too. Everything works ok except this one thing...WEIRD!
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35702070
Which port(s) are you using to uplink to the ASA and the next switch in the physical LAN?

Is there any situation where the ASA would send untagged frames?
0
 
LVL 1

Author Comment

by:jhakie
ID: 35702113
I am using port1 on the main switch as a Trunk to the ASA then I have a trunk on port 48 on the same switch then on switch two i have trunk ports on 47 and 48 and another trunk on port 48 on switch three.
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35703065
OK, I believe I have a solution, but I want to make sure my assumptions are correct. Let me know if any of the following statements are wrong:

Each VLAN is in a different IP subnet and the ASA handles all inter-VLAN routing
All traffic from the ASA is tagged
All ports except the Trunk ports are in Access mode
Ports e45-e47 on all switches except SW2 (192.168.100.3) e47 are in the Management VLAN (VLAN 1) and may talk to each other
All ports except the management and trunk ports may only talk to within their assigned VLAN
Physical access to the segments on the Management ports is secure
Devices in the management VLAN may talk to devices outside the management VLAN without using the ASA, but only if the traffic is tagged
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35703074
Oops, almost forgot:
Only devices in the management VLAN may access the switches' configuration page
0
 
LVL 4

Expert Comment

by:dbright5813
ID: 35703196
Just found your previous question, and I think I understand what you're wanting to do now.

To allow any device in VLAN 2 to control the switches, set the IP address of the switch to something in VLAN2's range (which I assume you did), and set the Interface to VLAN2, then hit "Apply Changes"

Here's a screenshot from a 3524:
 Assign IP address to VLAN 2
0
 
LVL 1

Author Comment

by:jhakie
ID: 35703231
That looks more like. I will try tomorrow and let you know. thanks!
0
 
LVL 1

Author Comment

by:jhakie
ID: 35705167
This is exactly what I need to do but this option is not available on the 2748...Thanks for you help on this. I really appreciate it.
0
 
LVL 4

Accepted Solution

by:
dbright5813 earned 2000 total points
ID: 35705648
If the ASA can tag frames, the alternative is to put sw1 e(1,48); sw2 e(47-48); and sw3 e48 as tagged in VLAN 1, set VLAN 1 to allow tagged only and reserve a subnet for admin.
0
 
LVL 1

Author Closing Comment

by:jhakie
ID: 35705762
Great idea. Thanks!
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is a collection of issues that people face from time to time and possible solutions to those issues. I hope you enjoy reading it.
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

599 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question