1

We have new gen aruba (hpe) switches in our environment.

There is a backbone (5412R zl2) which all edge switches are connected to. The edge switches are also layer 3 (2930F). The backbone delivers traffic to our firewall for internet and other reasons.

We added new vlans for our domain network (vlan10,20,30). We want these vlans to talk to each other so we enabled ip routing and gave each vlan an ip address. Then we routed each vlan to the firewall gateway with a static route. Basically intervlan is working via SVI. There is no problem here. (We want the intervlan traffic managed by the backbone!)

On the other hand we have a switch management vlan (vlan3) where all of our switches (management IPs) are located. We do not want this vlan to be a part of the intervlan (svi) mentioned above. We want this vlan (3) to be controlled via router on a stick. The stick would be our firewall. The reason being we would like to control who can access the management vlan on our firewall using user/computer objects.

How can I exclude vlan 3 from being a part of the ongoing (L3/SVI) intervlan?

TLDR; VLAN10,20,30 should talk to each other directly on the (backbone) switch level.

But this shouldn't apply for vlan 3. vlan 3 should be configured as a router on a stick (via firewall).

example config; (IPs ending with 254 are firewall gateway interfaces)

ip route 0.0.0.0 0.0.0.0 192.168.3.254
ip route 0.0.0.0 0.0.0.0 192.168.10.254
ip route 0.0.0.0 0.0.0.0 192.168.20.254
ip route 0.0.0.0 0.0.0.0 192.168.30.254

ip routing
    
vlan 3
name mgmt
untagged xxx
tagged xxx
ip address 192.168.3.1 255.255.255.0

vlan 10
name floor1
untagged xxx
tagged xxx
ip address 192.168.10.1 255.255.255.0

vlan 20
name floor2
untagged xxx
tagged xxx
ip address 192.168.20.1 255.255.255.0

vlan 30
name floor3
untagged xxx
tagged xxx
ip address 192.168.30.1 255.255.255.0

if I can't find a solution I will have to go with ACLs on the backbone. Which is something we don't prefer for this situation.

Improve this question
5
  • 1
    The way to go would be a separate VRF. Do your switches support VRF? This is also called "VPN instance" on some HP products.
    – JFL
    Feb 9 at 7:26
  • Unfortunately there seems no VRF support on these models. (At least I couldn't find it)
    – shafuq
    Feb 9 at 7:47
  • @Zac67 it is a term I saw while researching ACLs. It might be a solution. I'm reading on it now to understand how it works and the implementation. I'll keep you posted.
    – shafuq
    Feb 9 at 7:57
  • that's not too bad as far as ACLs go: you just need to drop everything in and out of that one vlan
    – ilkkachu
    Feb 9 at 20:37
  • @ilkkachu I got it to work using ACLs. The issue (other than it not being via the fw - which is what i preferred) is i have to add the access-group into all of the vlans with SVIs. At first I tried to get the ACL to work by only putting it into vlan 3. But that (for some odd reason) does not work. Instead I have to add it as an "in" rule to all of the other vlans with SVIs. I might have 10+ vlans like that..
    – shafuq
    Feb 10 at 6:17

2 Answers 2

Reset to default
2

If you define a management VLAN it'll be excluded from normal IP forwarding/routing.

management-vlan [ <vlan-id> | <vlan-name> ]

In a more complex scenario you can use route policies/maps to create separate routing domains.

Improve this answer
1
  • My previous comment was too confusing so I wanted to delete it. That said, management-vlan only works if you disable oobm.. Also the routing to/from the firewall in this scenario gave me headaches. I'm looking into other options at the moment. Thanks tho!
    – shafuq
    Feb 9 at 13:54
1

If the management vlan idea doesn't work, you can simply move the 192.168.3.1 IP address from the switch SVI to the firewall interface on vlan 3 instead. Put a different IP address on the switch for management access if necessary. Have your switches use the firewall (now 192.168.3.1) as gateway. Now all traffic to/from VLAN 3 has to transit the firewall and you can apply policies there.

Improve this answer
3
  • Put a different IP address on the switch for management access won't really work as anyone from the other VLANs could access the management IP. Also, just obscuring the switch gateway in the management VLAN isn't really secure.
    – Zac67 ♦
    Feb 9 at 17:45
  • I have a different ip (svi) for every switches vlan3. for example sw1-vlan3-svi_ip 192.168.3.1 and sw2-vlan3-svi_ip 192.168.3.2.. and so on. this interface ip is how i access the switches. so as long as layer3 intervlan is enabled all other vlans with svi's will have access to this vlan. so basically it wont work the way you put it.
    – shafuq
    Feb 10 at 6:33
  • Ah yes, if you need to worry about security from the other networks, then ideally they should all transit the firewall. Otherwise you have to do ACLs on the switches (a management hassle) or find an out of band management solution. The 5514 at least does have an out of band management port. Not sure about the 2930F switches.
    – FrameHowitzer
    Feb 10 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.