Solved

Inter Vlan and routing between subnets with their individual ISP providers.

Posted on 2015-01-12
25
157 Views
Last Modified: 2015-01-19
Good day all,

Hope i can explain this situation well. Here goes.

Goal:

to have a single HP3500yl (layer 3 switch) to host config for an inter-vlan communication with multiple HP Procurves 1800 switches having multiple subnet (Vlan 10, 50, 200 and 201)
Vlan 10….ip address 10.0.0.x/24 gateway 10.0.0.1
vlan 50….ip address 192.168.50.x/24 gateway 192.168.50.1
vlan 200….ip address 192.168.200.x/24 gateway 192.168.200.1
vlan 201….ip address 192.168.201.x/24 gateway 192.168.201.1

I have created the vlans and assigned .254 ip address. Trunked ports between to pass vlans.

here is the tricky part. each subnet have independent ISPs. I would like communications from all subnets to 201.x subnet as this Vlan housed a SAN that i would like to save all data from the different subnets.

if i missed anything out i apologize as i am pretty new to this.

regards,
0
Comment
Question by:IBSIT
  • 13
  • 10
  • +1
25 Comments
 
LVL 17

Expert Comment

by:jburgaard
ID: 40545641
As I read your Q , the HP3500yl with IP routing configured have some network address's x.y.z.254 and the internal address of   the routers to ISP's have IP's like x.y.z.1
If so on the 10.0.0.1-router add an
IP ROUTE 192.168.201.0  255.255.255.0  10.0.0.254   to reach vlan 201 network via L3-switch (on interface known to 10.0.0.1-router)
And for packets to come back,
on the 192.168.201.1-router add an
IP ROUTE 10.0.0.0   255.255.255.0  192.168.201.254  to reach vlan10 via L3-switch

Similar routes are needed for the other vlans
HTH
0
 

Expert Comment

by:jamesl001
ID: 40545725
I usually set up the core (main l3 switch) to be the router. I configure all of the VLANs on the core switch and create a RVI (routed virtual interface - Some vendors call it the vlan interface. I add routes to for the external network that I need to direct specific traffic flow toward. At that point I configure all of my respective DHCP options to hand our IPs on their requesting network. For each requesting client return the vlan interface/l3 interface IP of the switch as the gateway for each client.

At this point your should have routing between the VLAN subnets and the active routes to your ISP should become active when the switch sees a request for that particular IP route.

If you need filtering or security between VLANs you can typically use filters on the switch or route everything through a central firewall and set all of your routes up on the firewall. If you do not filtering and advanced security then I would not use the firewall option. Using the switch as the central router for the network reduces latency and complexity of design.

Hope some of this helps.
0
 
LVL 11

Expert Comment

by:naderz
ID: 40546040
Is "IP routing" enabled on the HP3500yl?
0
 

Author Comment

by:IBSIT
ID: 40546755
Ip routing is enabled. Now if i add a route in my router/firewall, will it affect the through-put as it is limited to 10/100. I am trying to have a full gigabit transfer rate between all Vlans.
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40547963
"Now if i add a route in my router/firewall, will it affect the through-put as it is limited to 10/100. I am trying to have a full gigabit transfer rate between all Vlans."
Yes that is fair to assume you will run into limits.

Now assume you had a software version and the needed level of support on the switch to handle PBR.
Can it handle Policy based routing?
If so, you could perhaps set def.gw. for vlans to point to L3-switch (handle inter-vlan routing) and set up some 'next hop router' conditions.
I do not own a 3500yl, so i do knot know if such a setup would work OK in real life.
HTH
0
 

Author Comment

by:IBSIT
ID: 40548970
Ok can you let me know if this will work:

Source switch 3500yl (L3) Routing enabled. Create all Vlans, SVI each Vlan with .254 address. Client Switches, assign .254 as gateway and trunk ports between Source and client, create the appropriate vlans on the clients. I should have bidirectional access? then once all has been completed i will set a Static Route in order to get out to the internet through ISP router. Please let me know if i am on the right track as i seem to have a problem so far. I am able to see VLAN 200 from my source switch and all devices on that subnet, but when i go to the actual vlan200 and plug in a client it is getting a dhcp address from source and not the vlan200 DHCP Server, and even though i am getting an ip from Source VLAN, i am not able to ping or no kind of communication to the source VLAN.
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40549123
...will set a Static Route in order to get out to the internet through ISP router...
One or more ISP to internet?

-more ISP's is a problem as
On your L3 switch you can only have one static default route to internet, like
IP  ROUTE  0.0.0.0   0.0.0.0  192.168.200.1

Perhaps output from your core-switch(L3) 'show running' command
and DHCP-server-details (switchport, IP of server(s), Asigned range, client-IP, client-netmask, client-DGW)
and PC-switchport
could help us help you with the DHCP-problem
0
 

Author Comment

by:IBSIT
ID: 40549156
ok i have three different subnets, all of which have their own dedicated isp, one source HP Procurve 3500YL and the rest  HP Procurve 1800. Is there any way to get it to work? btw i don't have any switchports on the switch, is there a way to not go via switchports as we have two 3500yl that is using PoE and it is maxxed out?
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40549889
"Is there any way to get it to work?"
In short: no, I am afraid not.
I have been reading the 'advanced traffic manual': the 3500yl does NOT support PBR
You do not want routing over 10/100Mb
You can only have one default route to internet

My mentioning of switch-ports combined with other config questions is just was my way to find out in detail what you have.
0
 

Author Comment

by:IBSIT
ID: 40549929
So routing to multiple routers is a no, but can i still maintain a gigabit through but between switches and their respective VLAN? If so can you assist?
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40550131
yes,
yes, but details please in a way I can understand.
'I should have bidirectional access? '?  
so specific as you can-->
if I try from my PC with IP <x.y.r.t>, dgw<x.y.r.d> and  connected to access-port <p> on switch <S> in vlan <V> ping to PC.. / to gateway ... /to router  ........ I get ..., is that to be expected ?
0
 
LVL 17

Accepted Solution

by:
jburgaard earned 500 total points
ID: 40551872
So now on L3-switch (='source switch' ?) you have configured IP ROUTING
and set up an IP for each vlan x.y.z.254 (fx 10.0.0.254 in vlan 10) all having net mask 255.255.255.0

Between 3500 and each of the 1800 the link is configured same way in both ends (fx with all vlans tagged on ports in both end of link) so all relevant vlans are present on the 1800's.

If you set up 2 PC's with static IP assignment, then they can ping each other as long as the connection to 1800 is in an untagged port and the network matches the vlan.
The PC should have an unused IP like the one the DHCP-server should dish out , net mask 255.255.255.0 and default gateway matching the vlan on the L3-switch
(fx PC connected to an untagged vlan10-port: IP=10.0.0.17 mask=255.255.255.0 gw=10.0.0.254 and PC connected to an untagged vlan50-port: 192.168.50.17 mask=255.255.255.0 gw=192.168.50.254 )

-Whether in same vlan on different switches (proving basic connectivity within vlans)
-or in different vlans (proving inter-vlan-routing)
This ping test should work both ways.

If you provide output from 'show run' and DHCP-server-details, then perhaps it will show whether IP helper address is in place.
Anyway you should double-check the scope-options (like default gateway)

HTH
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:IBSIT
ID: 40551996
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40552417
If 'main-switch' port 24 is connected to
'HP-E3500yl-24G' (alias switch2) on port 22
there will be no communication in vlan 1
vlan1: NO untag Trk10 ---- untag Trk10

-by the way the HP-term  'trunk'  is used for aggregation of multiple ports to make one link (where Cisco use the term for multiple vlans on one port fx)
0
 

Author Comment

by:IBSIT
ID: 40552491
Ok i don't want communication for vlan1 to pass through, i want vlan 4 and 200. the way it is setup will that work?
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40553699
Communication within vlan 4 should work between switches as vlan 4 is tagged same way on trk10 on 'main-switch' and trk10 on 'HP-E3500yl-24G'
and the same WITHIN vlan 200

If dgw on PC's are  192.168.201.5  / 192.168.200.250
and netmask's 255.255.255.0
then routing should also take place between vlans

HTH
0
 

Author Comment

by:IBSIT
ID: 40555411
With that configuration, somehow i am getting the main switch Vlan4 DHCP leases once i am on vlan200 and i am also not able to ping vlan 4 from vlan 200. I am sure i am missing something.
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40555651
Where is/are your DHCP-server(s) connected?
I do not see any 'IP Helper address'-statemens.
A helper address would be expected if fx one windows DHCP-server was dishing out in more vlans.
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40556247
One of the reasons for creating vlans in the first place is to avoid broadcast. Each vlan becomes a separate broadcast-domain.
DHCP works by means of broadcast, so if you do not want to set up a DHCP-server in each vlan, you have to do a trick.
On the L3-switch in each DHCP-client-vlan you would point to IP if the DHCP-server if the server is not there already
So this is configured in each vlan:
IP HELPER-ADDRESS <IP of DHCP-server>

HTH
0
 

Author Comment

by:IBSIT
ID: 40557838
Each Vlan have their independent DHCP Server, but i thought that the  dhcp would take presidence on its own VLAN.
0
 

Author Comment

by:IBSIT
ID: 40558077
Ok i have made some changes based on your recommendations and it seemed to work. Now its just a matter of routing isp
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40558078
without shortcuts and without helper-address I also would expect (DHCP-)broadcast to stay within broadcast-domain(=vlan )
and so not let DHCP-server and DHCP-client talk across vlans.
If you had a shortcut between the vlans, I would expect a broadcast-storm, you could however try the command on the switches where vlan 4  and 200 are present:
show lldp info remote
-if in a line a switch is shown with both local-port and remote-port, that is not good

If you try tracing back and forth between (evnt.static) clients in vlan 4 and vlan 200 do you hit 192.168.201.5  / 192.168.200.250 ??
(in windows fx tracert 192.168.201.17)
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40558081
ok then
0
 

Author Closing Comment

by:IBSIT
ID: 40558092
jbuurgard is very helpful. I thank you
0
 
LVL 17

Expert Comment

by:jburgaard
ID: 40558100
glad to help :)
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

The following recovery method will work on All Cisco Switchs that run ISO software. You will need a good copy of the IOS version you want you use saved on your PC and a Com's Cable. The software for these switches comes as a .tar file. Tar is …
If you’re like me and you like peace and quiet, saving money, and pretty lights, then this article is for you. For financial reasons, I buy all the Cisco equipment for my home lab second-hand. The first thing to wear out is usually one of the coo…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now