Routing – HP V1910, VLAN routing – what did I miss

aclclihproutingvlan

First time posting in this part of stack exchange and I'm a novice regarding advanced network configuration – plug & play switch installation I can handle ;o)

I got myself a HP V1910-48G (former 3com 2900 series) switch and I want to make some VLANs on my network to insure scalability for the future. The choice is based on price and from what I read in the specs HP sells this model as a light layer 3 capable switch.

My network diagram:
Network diagram of a firewall connected to a HP V1910-48G switch - VLANs

I'm trying to achieve the following:

  1. Small boardcast domains.
  2. Separation of concern regarding ip addresses.
  3. Scalability.

I've started with the basics to insure that I could make it work but with no succes:

  • VLAN_1 is configured on the switch on all ports – except for port 11
    & 12.
  • The Cisco ASA is connected to port 2 using a manual configured
    IP address – 10.203.5.1/24.
  • The VLAN_1 interface is assigned the IP address 10.203.5.2/24.
  • VLAN_10 is configured on the switch on ports
    11 & 12.
  • A VLAN interface is created on the switch and assigned the IP address 10.203.10.1/24 handling the VLAN_10.
  • The server (serverA) is connected to port 11 and configured
    with a manual IP address 10.203.10.11/24 and running a DHCP scope for
    the 10.203.10.0/24 network. Scope options is pointing Default Gateway to 10.203.10.1.
  • A test client (clientA) is connected to
    port 3 configured manually with the IP address 10.203.5.20/24.
  • A test client (clientB) is connected to port 12 and is receiving a IP
    address (10.203.10.100) from the DHCP service running on the serverA.

Test scenarios and results.

Positive:

  • clientA can ping VLAN_1 interface & Cisco ASA and also connect to the
    internet.
  • clientB can ping serverA, VLAN_10 interface & VLAN_1 interface.
  • serverA can ping VLAN_10 interface & VLAN_1 interface.
  • switch can ping 8.8.8.8 from the web management interface. (added)

Negative:

  • clientA can't ping clientB.
  • clientA can't ping serverA.
  • clientB can't ping clientA.
  • clientB can't ping Cisco ASA.
  • clientB can't connect to the internet.

I've been searching all day for clues on the internet and I can see I'm not the only one have issues with this model and the VLAN routing. I have managed to open telnet and SSH so I'm able to use the CLI. I know about the secret command list , the code: 512900 and system-view command. From my knowledge the OS/CLI inside is based on Comware 5 or a subset derived from that.

I did find a few post out there saying something about that the switch isn't shipped with routing enabled and lots of commands trying to enable ip routing. I've have tried them all but most of the wasn't able to run at all. I know the switch i a 3com 2900 and some of the post I'm finding might confuse the search engines.

I have read all relevant posts on www.vmfocus.com where he post a great deal of blog entries target toward the HP V1910. But I can't get my head around the ACL or the need of that, to handle ip routing from VLAN_10 to VLAN_1. Maybe my problems start here?

I'm no expert and I'm trying to make a decent solution, but my skills (or the product) couldn't bring me any further than this. I hope some of you can guide me in the correct direction so I can use the full potential of my HP V1910. If my network design is flawed with obvious mistakes please bare with me.

I just need to make VLAN_10 work in the first place after that works I think I will be able to configure the remaining VLANs by myself.

Best Answer

Your problem is, indeed, with routing. Things in VLAN 1 are using 5.1 as the gateway, right? 5.1 doesn't know about any other internal networks. (i.e. VLAN 10) Likewise, the hosts in VLAN 1 don't know about VLAN 10.

When clientA tries to ping serverA, the packets go to the ASA and die as it doesn't know where to send them. (it's default route would send them to the internet!) When serverA tries to ping clientA, the packets go to the switch and then to clientA, but then the replies, as before, go away.

For this reason, it's common to keep the "routing hardware" and "hosts" in different networks. VLAN 1 being just the ASA and Switch. And then VLANs 10 and 11 for the two internal networks. The switch would then be the gateway for VLAN 10&11, with it's default being the ASA. The ASA would have to have static routes added telling it about the internal networks -- routed to the switch. Without this, either the ASA has to "hairpin" traffic back to the switch to reach VLAN 10, or every host in VLAN 1 needs its own route to VLAN 10 (via the switch.)

Related Topic