2

We have added to our existing network an HP v1910 switch with the purpose of adding two VLANS. The computers in these two VLANS will need internet access, to communicate between the two VLANS and also to be able to contact computers that are still in the current network segment.

I have configured the VLANS on the HP switch and added a test computer in each VLAN. The following is what works and doesn't work. I have also included screenshots of relevant information and a diagram of the physical layout.

Devices in VLAN2(computer A) and VLAN3(computer B) can communicate with each other and access the internet without problems. I had to add the two static routes (as seen in the diagram) on the ASA 5505 to make this work. The problem is that devices on VLAN2 and VLAN3 cannot connect to devices on the original network outside of the HP v1910 switch. (as illustrated by computer C and the DHCP server) My feeling is there is another static route or routes that need to be configured either on the ASA or the HP switch. Advanced network routing is not my expertise but I do understand the basic concepts and can usually manage, but this has had me confused for days. Also, I'm not sure if I have the ports tagged right since I don't have a good understanding of that purpose so I just left everything as default untagged. Any help would be appreciated as I have scoured the internet for help to no avail. I'll try to attach images below if I can figure out how.

Physical Layout

VLAN Summary

VLAN Interfaces

HP v1910 Active Routes

Cisco ASA Static Routes

Improve this question
3
  • I'll pop in a more direct answer to your question below, but, if I might ask. Why add VLANs? What are you running into that makes you want to break your network up like this? Not that its a bad thing, I'm just curious as to the motive.
    – Jeff McAdams
    Commented Feb 12, 2015 at 21:28
  • Thank you for responding. The reasoning is that I'm running out of IP Addresses on the current network as it was configured years ago before I got here. It is setup as a flat network with only 256 IPs. I want to segment our clinic into one VLAN and our Nursing Home into the other which will free up IP addresses (main priority)and reduce broadcast traffic. The end all when I get this working is to add additional scopes on the DHCP server to service these network segments created by the VLANs. I'll have to configure the DHCP relay on the HP switch but for now that's another battle for later
    – Brady Wright
    Commented Feb 12, 2015 at 21:43
  • Enable routing by typing "ip routing" on the switch. Is it enabled?
    – Goodies
    Commented Feb 13, 2015 at 1:16

1 Answer 1

Reset to default
1

The computers (computer C and the DHCP server) will send traffic destined for the 192.168.x.0/24 blocks to the ASA, and apparently the ASA is not hair-pinning that traffic or sending ICMP redirects, which would not be terribly surprising for a firewall (or the computers aren't paying attention to the ICMP redirects).

A few options...

1) Put static routes on the DHCP server and computer C (and any other computers on that network) similar to the ones you put in the ASA.

2) Re-IP computer C and the DHCP server into a VLAN4 (or whatever) on the v1910 so that the v1910 is handling all of the internal routing...all of your endpoints can just use default routes, that point toward the v1910, and you would only have to put static routes on the ASA pointing towards the v1910. If you've got enough ports on the v1910 for your needs, you could ditch the unmanaged switch if you do this. (I like Procurves...if you've got enough ports, this or option 2a would be the way to go IMO)

2a) Re-IP the ASA in a similar way to option 2, meaning computer C and the DHCP server can keep their IP addresses.

3) There may be a way to get the ASA to issue ICMP redirects on the 172.16.3.x network so that the computers on that network can learn about the existence of the v1910. Alternatively, maybe there's a way to get the ASA to hair-pin the traffic...I don't know enough about ASA's to be able to answer that.

4) Move the v1910 to another port on the ASA, instead of daisy-chaining it off the unmanaged switch and route the traffic through the ASA as well. That would mean configuring whatever policy would be needed to get the traffic through the ASA appropriately.

Improve this answer
3
  • Very good suggestions there. Option3 would probably the simplest way to go if someone could state whether or not the ASA can do that. Otherwise option 2 or 2a is the way this may have to be done. I'll try your suggestions as soon as I can and let you know what happens. Thanks again for the help. Much appreciated.
    – Brady Wright
    Commented Feb 12, 2015 at 21:58
  • Option2 is what I ended up using. Connected the ASA(with static routes to the v1910, which I'd already added)directly to port 1(vLAN1) of the v1910. Made port2 also a member of vLAN1 and connected the existing network there(kept current IPs!). So now all of the existing network is part of vLAN1 on the v1910 switch. Made port 3 be vLAN2 and port 4 be vLAN3. Now,like you said,with the HP switch handling all the internal routing, all devices on all vLANS can communicate and have internet access. Also, after enabling DHCP relay on vLAN2 and 3, they receive DHCP addresses from the server on vLAN1.
    – Brady Wright
    Commented Feb 16, 2015 at 16:23
  • Also, for anybody who reads this, note that I had to make a change to the default gateway the DHCP server was handing out to devices on the original network which is now part of vLAN1. The old gateway pointed to the ASA. I had to change it so the new gateway for vLAN1 is the IP address of the HP v1910 switch(172.16.3.218 as in the diagram above) Also, created additional scopes for the vLAN2 and vLAN3 IP ranges on the DHCP server with the gateways for those to correspond to the vLAN interface IP addresses. Hope this clarifies everything for anyone having the issues I had.
    – Brady Wright
    Commented Feb 16, 2015 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.