2920: IP Routing Between VLANs

[Irfon-Kim]

I've got a pair of HP 2920-48G-PoE+ switches connected as a stack. I've got two VLANs configured -- one is the DEFAULT_VLAN (vlan 1) and one is Montreal_Link (vlan 18). I'm using that to link with our Montreal office using a point-to-point MetroLAN connection.

DEFAULT_VLAN (vlan 1)has IP address 192.168.23.1 and serves the 192.168.23.0/24 network. Our Firewall, which carries all external traffic, is at 192.168.23.7. It has all ports except for 2/20, 2/22, and 2/24 in its Untagged list.

Montreal_Link (vlan 18) has IP address 10.1.18.2 and serves the 10.1.0.0/16 network. It has 2/20 and 2/22 in its Untagged list, and trunk Trk2 in its Tagged (Static) list. Port 2/24 is set to Trunk mode for trunk Trk2. The MetroLAN connection is hooked up to this port. The switch on the other end of the link has IP address 10.1.18.1. 

I have a testing laptop connected to Port 2/20, and a bunch of live machines connected to various ports on DEFAULT_VLAN.

IP Routing is enabled.

The goal is to have machines on DEFAULT_VLAN, with IP addresses in 192.168.23.0/24, to be able to access the external world through the firewall, their own network, and the 10.1.0.0/16 network over the MetroLAN link, and to be able to gradually transfer those machines into our own local 10.1.18.0/24 network on the Montreal_Link VLAN while maintaining their ability to access all of the aforementioned resources. I believe (but am not sure) that this can all be accomplished at the switch level with appropriate routes.

Right now, I have the following routes:

Destination 0.0.0.0/0, Gateway 192.168.23.7, vlan 1, Type static, Metric 1, Dist. 1

Destination 10.1.0.0/16, Gateway 10.1.18.1, vlan 18, Type static, Metric 1, Dist. 1

Destination 10.1.18.0/24, Gateway Montreal_Link, vlan 18, Type connected, Metric 1, Dist. 0

Destination 127.0.0.0/8, Gateway reject, {no vlan}, Type static, Metric 0, Dist. 0

Destination 127.0.0.1/32, Gateway lo0, {no vlan}, Type connected, Metric 1, Dist. 0

Destination 192.168.23.0/24, Gateway DEFAULT_VLAN, vlan 1, Type connected, Metric 1, Dist 0

(When I say "see" below I'm always testing by pinging.)

Test case 1, testing laptop connected to the Montreal_Link VLAN on port 2/22, if I give it an IP of 10.1.18.200, mask of 255.255.255.0, and a gateway of 10.1.18.2, I can ping the local VLAN's IP (10.1.18.2), all the resources on 10.1.x.x on the other side of the MetroLAN link, and a seemingly random handful of addresses on 192.168.23.x -- in particular, the DEFAULT_VLAN address 192.168.23.1 and a very odd collection of random other addresses, but not most of them. I haven't figured out the pattern. I supposed that it might be that it was only machined on the same switch in the stack, but that doesn't immediately seem to be the case. I also can't see the outside world at all.

If I move the testing laptop to a port on DEFAULT_VLAN, give it an IP of 192.168.23.56, mask of 255.255.255.0, and a gateway of 192.168.23.1, I can see all the machines on DEFAULT_VLAN, and I can see the outside world. I can also see the local Montreal_Link (vlan 18) address of 10.1.18.2. However, I can't see anything on the other side of of the MetroLAN link (10.1.18.1, or any of the other devices on that end of things).

So... that's kind of where I'm at. I'm sure I'm missing something here, but I'm not sure what. Any help would be greatly appreciated.

[Chrisd131313]

Hi Irfon-Kim,

When you test the link from the 192.168.23.0/24 subnet and cannont get a response from the Montreal IPs, can you get a response from 10.1.18.1? Also, do you have the route entry on 10.1.18.1 to route back to the 192.168.23.0/24 subnet?

[Irfon-Kim]

No, when testing from the 192.168.23.0/24 subnet, I cannot get a reply from 10.1.18.1. I actually don't know if they have a route in place to route 192.168.23.0/24 traffic back over the trunk or not -- Montreal is managing that switch. That's a good question, though; I'll ask.