2

I've been bashing my head against this for far to long. I'm hoping someone can help me out.

I'm rebuilding a clients network and this is my first kick at routing. I decided to keep things simple. We are using 3x HP ProCurve 2920's. Two of them service user connections and the third one will act as our router and be where our server and other network uplink to.

Here is my VLAN layout:

VLAN1 - Legacy / 192.168.11.0/24
VLAN10 - General Students / 10.0.0.0/23
VLAN11 - General Staff / 10.0.20.0/23
VLAN20 - Staff Wireless / 10.0.100.0/23
VLAN21 - Student Wireless / 10.0.120.0/23
VLAN22 - Public Wireless / 10.0.140.0/23
VLAN30 - Servers / 10.0.200.0/23
VLAN40 - Management / 10.0.220.0/23

VLAN1 is the existing flat network. I am trying not to disrupt network outages while I get things working so I've left it in place on the new ProCurves. VLAN1 is currently working just fine but I suspect that is because DHCP is still handing out the firewalls IP as the default gateway and not the new .254 address I've created.

Our firewall is a Cisco RV016 and is currently in gateway mode with RIP disabled. Once I get inter-VLAN routing working I suspect I either need to create a static route that points to the Cisco for 0.0.0.0/0.0.0.0 or enable RIP routing on the firewall. For now I want to get inter-VLAN routing work and I'll tackle the firewall after.

I've done the following on all three switches:

  • Enabled Routing
  • Defined VLANs
  • Configured tagging for the VLANs on the uplink ports

I've done the following on our routing switch:

  • Given each VLAN an IP address to act as the VLANs gateway (all end in .254)
  • Enabled RIPv2 on all VLANs (including VLAN1)

Here is the switch config of our routing switch:

; J9729A Configuration Editor; Created on release #WB.15.16.0008
; Ver #06:0c.fc.f3.ff.37.2d:e0

hostname "LKS-S-04"
module 1 type j9729a
trunk 45-46 trk1 lacp
trunk 47-48 trk2 lacp
sntp 300
sntp server priority 1 192.168.11.10
no telnet-server
time timezone -480
no web-management
ip routing
interface 45
   flow-control
   name "LKS-S-02:45"
   exit
interface 46
   flow-control
   name "LKS-S-02:46"
   exit
interface 47
   flow-control
   name "LKS-S-03:47"
   exit
interface 48
   flow-control
   name "LKS-S-03:48"
   exit
no snmp-server enable
oobm
   ip address 192.168.11.251 255.255.255.0
   ip default-gateway 192.168.11.1
   exit
router rip
   redistribute connected
   enable
   exit
vlan 1
   name "VLAN1 - School Scope (LEGACY)"
   untagged 1-44,A1-A2,B1-B2,Trk1-Trk2
   ip address 192.168.11.254 255.255.255.0
   ip rip 192.168.11.254
   exit
vlan 10
   name "VLAN10 - General Students"
   tagged Trk1-Trk2
   ip address 10.0.1.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.1.254
   exit
vlan 11
   name "VLAN11 - General Staff"
   tagged Trk1-Trk2
   ip address 10.0.21.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.21.254
   exit
vlan 20
   name "VLAN20 - Staff Wireless"
   tagged Trk1-Trk2
   ip address 10.0.101.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.101.254
   exit
vlan 21
   name "VLAN21 - Student Wireless"
   tagged Trk1-Trk2
   ip address 10.0.121.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.121.254
   exit
vlan 22
   name "VLAN22 - Public Wireless"
   tagged Trk1-Trk2
   ip address 10.0.141.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.141.254
   exit
vlan 30
   name "VLAN30 - Servers"
   tagged Trk1-Trk2
   ip address 10.0.201.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.201.254
   exit
vlan 40
   name "VLAN40 - Management"
   tagged Trk1-Trk2
   ip address 10.0.221.254 255.255.254.0
   ip helper-address 192.168.11.10
   ip rip 10.0.221.254
   exit
spanning-tree Trk1 priority 4
spanning-tree Trk2 priority 4
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

and here is one of my client access switches

; J9729A Configuration Editor; Created on release #WB.15.16.0008
; Ver #06:0c.fc.f3.ff.37.2d:e0

hostname "LKS-S-02"
module 1 type j9729a
trunk 45-46 trk1 lacp
sntp 300
sntp server priority 1 192.168.11.10
no telnet-server
time timezone -480
no web-management
ip routing
interface 45
   flow-control
   name "LKS-S-04:45"
   exit
interface 46
   flow-control
   name "LKS-S-04:46"
   exit
no snmp-server enable
oobm
   ip address 192.168.11.253 255.255.255.0
   ip default-gateway 192.168.11.1
   exit
router rip
   no redistribute connected
   enable
   exit
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-44,47-48,A1-A2,B1-B2,Trk1
   no ip address
   exit
vlan 10
   name "VLAN10 - General Students"
   tagged Trk1
   no ip address
   exit
vlan 11
   name "VLAN11 - General Staff"
   tagged Trk1
   no ip address
   exit
vlan 20
   name "VLAN20 - Staff Wireless"
   tagged Trk1
   no ip address
   exit
vlan 21
   name "VLAN21 - Student Wireless"
   tagged Trk1
   no ip address
   exit
vlan 22
   name "VLAN22 - Public Wireless"
   tagged Trk1
   no ip address
   exit
vlan 30
   name "VLAN30 - Servers"
   tagged Trk1
   no ip address
   exit
vlan 40
   name "VLAN40 - Management"
   tagged Trk1
   ip address 10.0.220.2 255.255.254.0
   exit
spanning-tree Trk1 priority 4
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

If I give a client a static IP on any of the new VLANs it can ping it's default gateway regardless of which switch it's physically plugged into. It can't go any further than that.

Here is a 'show ip route' from the routing switch:

LKS-S-04(config)# show ip route

                                                                     IP Route Entries

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  10.0.0.0/23        VLAN10 - Gen... 10   connected            1          0
  10.0.20.0/23       VLAN11 - Gen... 11   connected            1          0
  10.0.100.0/23      VLAN20 - Sta... 20   connected            1          0
  10.0.120.0/23      VLAN21 - Stu... 21   connected            1          0
  10.0.140.0/23      VLAN22 - Pub... 22   connected            1          0
  10.0.200.0/23      VLAN30 - Ser... 30   connected            1          0
  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0
  192.168.11.0/24    VLAN1 - Scho... 1    connected            1          0

and from a client access switch:

LKS-S-02(config)# show ip route

                                                                     IP Route Entries

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0

The routes aren't being picked up by the client access switches is my guess but I thought the whole point of RIP was that it took care of that for me.

Any assistance would be greatly appreciated.

Update 1 - 2015-06-18 @ 15:24

I've disabled routing on the two user access switches and disabled RIP on my RS.

It looks like I can put myself on any of those VLANs and ping any of the other new VLANs gateways but not other hosts that are currently on the new VLANs.

I still cannot get out to the internet (even with a default route on the RS to my firewall) AND I cannot access my 192.168.11.0 legacy network with or with out a static route to it assigned to my RS.

Here is the new config for the RS:

; J9729A Configuration Editor; Created on release #WB.15.16.0008
; Ver #06:0c.fc.f3.ff.37.2d:e0

hostname "LKS-S-04"
module 1 type j9729a
trunk 45-46 trk1 lacp
trunk 47-48 trk2 lacp
sntp 300
sntp server priority 1 192.168.11.10
no telnet-server
time timezone -480
no web-management
ip route 0.0.0.0 0.0.0.0 192.168.11.1
ip route 192.168.11.0 255.255.255.0 192.168.11.1
ip routing
interface 45
   flow-control
   name "LKS-S-02:45"
   exit
interface 46
   flow-control
   name "LKS-S-02:46"
   exit
interface 47
   flow-control
   name "LKS-S-03:47"
   exit
interface 48
   flow-control
   name "LKS-S-03:48"
   exit
no snmp-server enable
oobm
   ip address 192.168.11.251 255.255.255.0
   ip default-gateway 192.168.11.1
   exit
vlan 1
   name "VLAN1 - School Scope (LEGACY)"
   no untagged 8-9
   untagged 1-7,10-44,A1-A2,B1-B2,Trk1-Trk2
   ip address 192.168.11.254 255.255.255.0
   exit
vlan 10
   name "VLAN10 - General Students"
   tagged Trk1-Trk2
   ip address 10.0.1.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 11
   name "VLAN11 - General Staff"
   tagged Trk1-Trk2
   ip address 10.0.21.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 20
   name "VLAN20 - Staff Wireless"
   tagged Trk1-Trk2
   ip address 10.0.101.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 21
   name "VLAN21 - Student Wireless"
   tagged Trk1-Trk2
   ip address 10.0.121.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 22
   name "VLAN22 - Public Wireless"
   tagged Trk1-Trk2
   ip address 10.0.141.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 30
   name "VLAN30 - Servers"
   tagged Trk1-Trk2
   ip address 10.0.201.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 40
   name "VLAN40 - Management"
   untagged 8-9
   tagged Trk1-Trk2
   ip address 10.0.221.254 255.255.254.0
   ip helper-address 192.168.11.10
   exit
vlan 99
   name "ROUTING"
   tagged Trk1-Trk2
   ip address 10.0.250.4 255.255.255.0
   exit
spanning-tree Trk1 priority 4
spanning-tree Trk2 priority 4
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

and here is one of the client switches:

; J9729A Configuration Editor; Created on release #WB.15.16.0008
; Ver #06:0c.fc.f3.ff.37.2d:e0

hostname "LKS-S-02"
module 1 type j9729a
trunk 45-46 trk1 lacp
sntp 300
sntp server priority 1 192.168.11.10
no telnet-server
time timezone -480
no web-management
interface 45
   flow-control
   name "LKS-S-04:45"
   exit
interface 46
   flow-control
   name "LKS-S-04:46"
   exit
no snmp-server enable
oobm
   ip address 192.168.11.253 255.255.255.0
   ip default-gateway 192.168.11.1
   exit
vlan 1
   name "DEFAULT_VLAN"
   no untagged 47
   untagged 1-44,48,A1-A2,B1-B2,Trk1
   no ip address
   exit
vlan 10
   name "VLAN10 - General Students"
   tagged Trk1
   no ip address
   exit
vlan 11
   name "VLAN11 - General Staff"
   tagged Trk1
   no ip address
   exit
vlan 20
   name "VLAN20 - Staff Wireless"
   tagged Trk1
   no ip address
   exit
vlan 21
   name "VLAN21 - Student Wireless"
   tagged Trk1
   no ip address
   exit
vlan 22
   name "VLAN22 - Public Wireless"
   tagged Trk1
   no ip address
   exit
vlan 30
   name "VLAN30 - Servers"
   tagged Trk1
   no ip address
   exit
vlan 40
   name "VLAN40 - Management"
   untagged 47
   tagged Trk1
   ip address 10.0.220.2 255.255.254.0
   exit
vlan 99
   name "ROUTING"
   tagged Trk1
   ip address 10.0.250.2 255.255.255.0
   exit
spanning-tree Trk1 priority 4
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
password operator

and routes on the RS:

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  0.0.0.0/0          192.168.11.1    1    static               1          1
  10.0.0.0/23        VLAN10 - Gen... 10   connected            1          0
  10.0.20.0/23       VLAN11 - Gen... 11   connected            1          0
  10.0.100.0/23      VLAN20 - Sta... 20   connected            1          0
  10.0.120.0/23      VLAN21 - Stu... 21   connected            1          0
  10.0.140.0/23      VLAN22 - Pub... 22   connected            1          0
  10.0.200.0/23      VLAN30 - Ser... 30   connected            1          0
  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0
  10.0.250.0/24      ROUTING         99   connected            1          0
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0
  192.168.11.0/24    VLAN1 - Scho... 1    connected            1          0

and from the firewall: https://img.fizi.ca/di/DMIC/firewallRoutes.png

and a sample static routes I've configured on the firewall to access the new VLANs: https://img.fizi.ca/di/24OO/staticRoutes.png

So close!

Update - 2015-06-18 @ 16:49

Progress. I found the error I made configuring the routes on the RV016. I should have set the gateway to 192.168.11.254 (the IP for VLAN 1 that resides on my RS). That looks like it fixed everything.

Improve this question

1 Answer 1

Reset to default
1

Your access switches operate at layer-2 -- they're "just switches". At layer-2, everything funnels back to the routing-switch. The routing switch then moves ("routes") traffic between vlans. All of this looks fine, so far.

The issue is, you cannot ping anything in 192.168.11.0/24 from any of the other VLANs? (i.e. the firewall and thus the path to the internet) That's because nothing else in the network knows about the other networks. Traffic is getting to 192.168.11.0/24, but the reply will follow the default route to the firewall, or if you ping the firewall, it's default towards the internet.

You should be able to talk to things in the other vlans from any of the new vlans, because they're default gateway is the routing-switch.

(also, I cannot recommend the use of RIP. EVER. Your network is tiny and (mostly) static, so it's unnecessary. The firewall is the only thing that needs to know about the other networks.)

Improve this answer
4
  • Thank you. I did some more mucking around and got things working. I had to make the firewall aware of the other networks via the "Multiple Subnet Setting" page on it. Unfortunately this crappy Cisco RV016 can only have 5 "other networks" configured on it and I have 8. Once I configured 5 for testing and added a static default route to the firewall everything appears to be working fine... except that 3 of my VLANs can't be configured thanks to the limitations of the RV016. I'm going to deploy a PFSense VM Firewall which should take care of the RV016 limitations.
    – FiZi
    Jun 18, 2015 at 21:04
  • I also introduced a VLAN99 on all switches, configured each switch with an IP on VLAN99 and enabled RIP. All devices then showed the proper routes when doing a "show ip route". I'm thinking this was unnecessary as you said. I should be able to just disable routing on my client switches. I might also go the route you're recommending and drop RIP. Do I need a static route for each VLAN? or just one default route out to the internet for anything the switches can't figure out locally?
    – FiZi
    Jun 18, 2015 at 21:07
  • The RS needs one default route to the firewall. The firewall needs a route for each VLAN behind the RS -- i.e. any network to which it isn't directly connected.
    – Ricky
    Jun 18, 2015 at 21:13
  • I've added an update to my original question after implementing the changes you recommend. I'm sure I'm over looking something obvious.
    – FiZi
    Jun 18, 2015 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.