I'm trying to configure an HP 2920 to do routing between VLANs. I'm working on setting up a guest wireless network and I want to prevent clients on the guest VLAN from accessing our main VLAN.

Before adding ACLs, I'm just trying to get the routing to work, but I'm having trouble with that. I've done the same type of configuration on an HP 1910, but never on an HP 2920.

My main VLAN subnet is, with the default gateway being The Guest VLAN subnet is The 2920 has an IP on the main VLAN of which shows up below as the MAIN_OFFICE_, and the IP on the Guest VLAN is, which shows up below as INC_Guest_VLAN.

 Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----    1    static               1          1      MAIN_OFFICE_... 1    connected            1          0        reject               static               0          0       lo0                  connected            1          0    INC_Guest_VLAN  100  connected            1          0

The client computer on the guest VLAN has an IP of with the default gateway of It can ping and, but it can't ping any of the machines on the network, including the router.

I clearly need to get this route working before worrying about ACLs. I've tried setting up computers on the main VLAN to use the internal IP address of the HP 2920 as the default gateway to eliminate any firewall configuration issues, but I don't think the 2920 is routing properly between the VLANs.

Can anyone help me with this configuration?

Thank you in advance!


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:51

2 Answers 2


First, you need to turn on routing on the 2920: ip routing.

Then, each VLAN you want to route into or out of requires an IP address (which you've got).

Your clients should use the 2920 as the default gateway and you set your former default gateway as default route on the 2920 (seems you've got that as well).

Don't forget to configure a route to on the default route gateway/firewall. If you set up a routing protocol between the 2920 and your firewall you don't have to set up static routes.

If you don't want any communication between guest and production VLANs you can add a simple ACL to the guest VLAN

 1000 deny ip
 9999 permit ip any any

Any allowed communication would require an appropriate ACL entry before line 1000, e.g. for DNS request to and ping replies to all nodes

100 permit udp eq dns
110 permit icmp eq echo-reply

Another way is to configure no IP address for the guest VLAN on the 2920 but trunk the VLAN to the firewall where you sort everything out (which I'd prefer).

  • Thank you for the response. I'll try this and others and let you know what the solution is.
    – Kent Iler
    Nov 5, 2018 at 13:52

It would seem to be a problem with the router not knowing to send traffic for the network to You either need to put in a static route on that router pointing to the switch, or you need to run a routing protocol between the switch and the router.

Routers learn routes in three ways:

  1. Directly connected networks
  2. Statically configured routes
  3. Through dynamic routing protocols

Since the router is not directly connected to the network, option 1 is out, and you need to use either option 2 or option 3 for it to know where to send traffic for the network. If a router doesn't have a route to a network, it will discard packets to that network, or more likely, the router has a default route to the Internet, and it is sending the traffic for your network to the default route because it doesn't have a more specific route to your network.

  • Thank you for the response. I'll try this and others and let you know what the solution is.
    – Kent Iler
    Nov 5, 2018 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.