vlan help procurve 2650

[ccarter81]

i have two vlans. My default vlan and then my guest. Trying to allow the guest network outside access to the internet through my firewall, but having difficulty figuring out how. Any help would be appreciated. 

[paulgear]

Hi ccarter81,

If you need help with this, a lot more information is needed. Start with your switch's configuration, your firewall's IP address and routing table, and your guest network's DHCP options. Also, explain what tests you have done so far, including which tests succeed and which tests fail.

[ccarter81]

Paul,

Thanks for the reply. My switch is configured with two vlans. One is the default and the other is a guest.

10.5.64.0/20 gw 10.5.64.1 - Default VLAN

192.168.10.0/24  - Guest VLAN 

IP Route Entries

Destination Gateway VLAN Type Sub-Type Metric Dist.
------------------ --------------- ---- --------- ---------- ---------- -----
0.0.0.0/0 10.5.64.1 1 static 1 1
10.5.64.0/20 DEFAULT_VLAN 1 connected 0 0
127.0.0.0/8 reject static 0 250
127.0.0.1/32 lo0 connected 0 0
192.168.10.0/24 Guest 2 connected 0 0

I don't have DHCP setup for the guest VLAN yet. Haven't gotten that far. I have a laptop on one switch on our first floor and am able to ping both first floor switch and our core switch Guest VLAN IP's using GVRP. This is as far as I have gotten. Tried creating a sub interface on our firewall for the Guest VLAN to get out, but not working. Surely I am doing something wrong here. 

[JohnLockie · Accepted solution]

You need to do "router on a stick" here. 

Basically, on your firewall create a new sub-interface or virtual interface.  Assign the gateway IP for your guest VLAN on this sub-interface, and also place it in the required VLAN.  The physical port that goes from your switch to router will need to be configured as a trunk (tag non-native VLANs).

Point all the guest clients default gateway to the sub-interface on the firewall.

This is the most secure and common way of doing this.  Plus, you have a layer 2 switch anyways.  You need the firewall/router upstream to handle the routes.  This way you can apply firewall policies to make sure guests cannot find their way in to your private LAN.

[JohnLockie]

Watch this.  The same principles apply no matter who your hardware is from (Cisco, HP, Juniper, Dell, Sonicwall, etc.)

http://www.youtube.com/watch?v=bO6nbkza008

[paulgear]

Note that a 2650 can actually do static L3 routing, but that doesn't really matter - John's recommended solution is definitely the way i would go.

[JohnLockie]

Indeed inter-vlan routing capabilities, which is pretty much a baseline requirement for layer 2 / SVIs

If the switche supports ACLs I would consider doing it there, but ideally you trunk up to a firewall.  Just a guess here, but you want to secure the "Guest" traffic as best as you can.

[ccarter81]

Thanks! That worked for me!