5

I would like to replace a simple five port unmanaged desktop switch with a VLAN on our HP 5406 zl. I need to distribute our Internet connection to two firewalls and figured I could do with one less piece of hardware running on the rack and use a VLAN instead of the aforementioned desktop switch. I set up the VLAN and it works, but it times out every 10 packets or so when I ping an external site. If I plug the Internet line into a physical five port switch and bypass the 5406 altogether, everything works fine. So, it seems to have something to do with the VLAN. Tracert follows the correct (and the same) route when I'm using the VLAN and when I'm using the desktop switch.

I do not want other VLANs on the switch to be able to route to/from this VLAN, so I didn't give it an IP address. I just want it to blindly pass traffic to/from our firewalls, which do all the packet filtering and provide Internet access to the rest of our network. This is what the VLAN config looks like when I view it on the 5406's configuration report:

vlan 4 
name "wan1" 
untagged C20,C22,C24 
no ip address 
exit

One thing the report doesn't show is that the VLAN has the default gateway set to the IP that is the default route for the switch. However, I don't think it should matter because tracert shows that it doesn't send traffic to that IP anyway, which it shouldn't.

Something else I tried and might be worth mentioning: If I plug the Internet line into an unmanaged switch and then connect the unmanaged switch to the vlan on the 5406, I can hook my laptop up to that vlan and the connection works perfectly. If I take the unmanaged switch out of the picture and plug the Internet line right into the vlan, it starts timing out again. So, to sum it up:

Works: Internet -> unmanaged switch -> vlan (5406) -> ping from laptop
Works: Internet -> unmanaged switch -> ping from laptop
Doesn't work (times out frequently): Internet -> vlan (4506) -> ping from laptop

Any suggestions would be much appreciated!

Improve this question
6
  • Is there any message in the 5406 log by the time you experience the packet loss?
    – Daniel Yuste Aroca
    Jun 25, 2013 at 20:15
  • More details might help in identifying the problem. For instance, what was the 5-port switch connected to previously? What is your gateway device(s) and how is it connected before and after?
    – YLearn
    Jun 25, 2013 at 21:47
  • I only see one FCS Rx error for the port the Internet line is plugged in to and none for the port I plugged my laptop into for testing. The 5-port switch was previously connected to some regular desktop PCs on our network. The Internet line is connected directly to our ISPs box in our telco closet. I took our gateway device out of the picture because for testing because I determined that the timeouts are occurring due to the VLAN. If I plug right into our ISPs box, everything works fine, just as it does if I use the 5-port switch rather than the VLAN.
    – user1858
    Jun 26, 2013 at 14:09
  • Unfortunately I am not an HP expert but assigning ports to a VLAN should be totally seperate from creating a routing interface for a VLAN. Can you disable the interface all together (on Cisco and Enterasys you would do a "shutdown" of the interface. Unrelated to the problem: You should not use this setup as an attacker could potentially spoof the VLAN ID and thus bypass your firewalls if your configuration is not spot on. Source: en.wikipedia.org/wiki/VLAN_hopping
    – Thieron
    Jun 27, 2013 at 13:25
  • It would be really great if you could present your setup with a diagram. Try looking at the syslogs of the switch with the setup that gives you timeouts. you might find something interesting there.
    – AdnanG
    Aug 23, 2013 at 9:37

3 Answers 3

Reset to default
3

Your VLAN configuration shouldn't be causing any issues. I'd check for a duplex mismatch on one of the involved ports.

Improve this answer
1
  • The ports are set to auto detect duplex settings. For troubleshooting, I set them manually to half and full, but got the same result. I agree, it does seem like a duplex mismatch, but manually setting them didn't seem to help. Thanks for the suggestion.
    – user1858
    Jun 26, 2013 at 14:16
1

Had something (possibly) similar with a cluster of old checkpoint firewalls and a Cisco switch - both firewalls would present the same MAC address, so the switch would see one MAC in two places. This would work fine on an unmanaged hub/switch, but managed switches would object. The solution was, if I remember correctly, to add static mac entries for the firewalls in the switch config.

Improve this answer
1
  • For testing, I took the firewalls out of the picture - they aren't connected to this vlan for now. I plug my laptop directly into the vlan and get an IP from our ISP since they also have DHCP turned on even though they gave us a static IP. I updated my question above to show the configurations that work and the one that doesn't. Hopefully that clears up my scenario a bit. Thanks for the suggestion.
    – user1858
    Jul 1, 2013 at 15:53
0

I agree with Jeremy. I think the unmanaged switch is actually masking problems with your network. Check the 5400 switch logs for errors relating to that port. Spanning tree issues and broadcast limits are the first things I would be checking for. Showing your port counters and switch configs might help us make other useful suggestions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.