2

We have recently switched from HP Procurve series to HP Comware based switches. A configuration which has been working on Procurve doesn't seem to work on Comware. Here are the details:

The provider interface is Cisco based, network connectivity is delivered using a specific vlan (provider side), lets say vlan 600.

We have defined access ports on HP switches for internet access, using vlan 2. Port mode is access port. So I would expect the switch to discard the incoming vlan tag 600 and forward packets internally to all ports assigned to vlan 2. A 2nd access port on the switch with vlan 2 connects to the firewall wan port.

Configuration is as simple as it can get, first for HP Procurve, 2nd for Comware Switch:

Procurve:

vlan 2
   name "Wan"
   untagged 1-4
   tagged 15,43-44
   no ip address

Port 1 is connected to provider uplink, port 2 to Firewall WAN IF. WORKING!

Comware:

interface Ten-GigabitEthernet1/0/3
 port access vlan 2
interface Ten-GigabitEthernet1/0/4
 port access vlan 2

Port 3 is connected to provider uplink, port 4 to Firewall WAN IF. NOT working.

So where is the difference between Procurve and Comware Switch? Is there anything I'm missing? I would expect to see port 3 & 4 communicate, as they are forced to the same vlan 2. But I do only see a MAC address entry on port 3 (Firewall MAC), no MAC from provider uplink on port 4.

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 16, 2020 at 23:07

1 Answer 1

Reset to default
1

So I would expect the switch to discard the incoming vlan tag 600 and forward packets internally to all ports assigned to vlan 2.

That's not the way it works. When an incoming frame is associated with VLAN 600 it stays within that VLAN (you could route the encapsulated packet elsewhere though). So, you need to make both the ISP facing port and the firewall facing port part of VLAN 600, tagged or untagged as required.

When you've created the VLAN, on the port where you tag VLAN 600 you'd

interface Ten-GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
port trunk permit vlan 600
exit

and on a port you'd want VLAN 600 untagged

interface Ten-GigabitEthernet1/0/3
port link-mode bridge
port access vlan 600
exit
Improve this answer
3
  • Thank you for your answer, in fact I did try exactly that already, and as you described it works! Which means that when connecting to 3rd party networks you always have to take care that vlans match/do not overlap, right? Is there a better way to connect 2 networks while avoiding being forced to keep vlans in sync on both sides? Are you able to somehow "untag" a packet, or am I missing something and this is the wrong approach anyway? regards, Christian
    – ChristianH
    Commented Jan 21, 2020 at 12:53
  • Yes. Some switches have a feature that can rewrite (remap) VLANs between networks.
    – Ricky
    Commented Jan 21, 2020 at 15:33
  • @ChristianH You may vote for and accept the answer if it helped you. ;-) 3rd party or not - you always need to match VLANs because different VLAN IDs mean no L2 connectivity. Yes, you always need to keep them "in sync". You can untag tagged frames by configuring a tagged port and an untagged one. Unless the switch has some kind of translation facility (usually pricey), you cannot retag a frame (=translate VLAN ID). (Without going over an untagged link that is associated with different VLANs on each side - beware, this may have very undesired effects on MSTP etc).
    – Zac67 ♦
    Commented Jan 21, 2020 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.