Question about Configuring HP 2920

Question

I'm trying to configure an HP 2920 to do routing between VLANs. I'm working on setting up a guest wireless network and I want to prevent clients on the guest VLAN from accessing our main VLAN.

Before adding ACLs, I'm just trying to get the routing to work, but I'm having trouble with that. I've done the same type of configuration on an HP 1910, but never on an HP 2920.

My main VLAN subnet is 10.10.61.0, with the default gateway being 10.10.61.254. The Guest VLAN subnet is 172.16.254.0. The 2920 has an IP on the main VLAN of 10.10.61.250 which shows up below as the MAIN_OFFICE_, and the IP on the Guest VLAN is 172.16.254.250, which shows up below as INC_Guest_VLAN.

 Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  0.0.0.0/0          10.10.61.254    1    static               1          1
  10.10.61.0/24      MAIN_OFFICE_... 1    connected            1          0
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0
  172.16.254.0/24    INC_Guest_VLAN  100  connected            1          0

The client computer on the guest VLAN has an IP of 172.16.254.1/24 with the default gateway of 172.16.254.250. It can ping 172.16.254.250 and 10.10.61.250, but it can't ping any of the machines on the 10.10.61.0 network, including the router.

I clearly need to get this route working before worrying about ACLs. I've tried setting up computers on the main VLAN to use the internal IP address of the HP 2920 as the default gateway to eliminate any firewall configuration issues, but I don't think the 2920 is routing properly between the VLANs.

Can anyone help me with this configuration?

Thank you in advance!

--Kent

Answer 1

First, you need to turn on routing on the 2920: ip routing.

Then, each VLAN you want to route into or out of requires an IP address (which you've got).

Your clients should use the 2920 as the default gateway and you set your former default gateway as default route on the 2920 (seems you've got that as well).

Don't forget to configure a route to 172.16.254.0/24 on the default route gateway/firewall. If you set up a routing protocol between the 2920 and your firewall you don't have to set up static routes.

If you don't want any communication between guest and production VLANs you can add a simple ACL to the guest VLAN

 1000 deny ip 172.16.254.0/24 10.10.61.0/24
 9999 permit ip any any

Any allowed communication would require an appropriate ACL entry before line 1000, e.g. for DNS request to 10.10.61.2 and ping replies to all nodes

100 permit udp 172.16.254.0/24 10.10.61.2/32 eq dns
110 permit icmp 172.16.254.0/24 10.10.61.0/24 eq echo-reply

Another way is to configure no IP address for the guest VLAN on the 2920 but trunk the VLAN to the firewall where you sort everything out (which I'd prefer).

Answer 2

It would seem to be a problem with the 10.10.61.254 router not knowing to send traffic for the 172.16.254.0 network to 10.10.61.250. You either need to put in a static route on that router pointing to the switch, or you need to run a routing protocol between the switch and the router.

Routers learn routes in three ways:

1. Directly connected networks
2. Statically configured routes
3. Through dynamic routing protocols

Since the 10.10.61.254 router is not directly connected to the 172.16.254.0/24 network, option 1 is out, and you need to use either option 2 or option 3 for it to know where to send traffic for the network. If a router doesn't have a route to a network, it will discard packets to that network, or more likely, the router has a default route to the Internet, and it is sending the traffic for your network to the default route because it doesn't have a more specific route to your network.