ProCurve 2824 VLAN Routing Issue

[Steven Keefe]

Hi,

I'm new to configuring switches but getting up to speed quickly.

I have ProCurve 2824 with ip routing enabled but unable to get routing to work between two VLANs on the switch.

I updated Software/ROM to latest:

Software revision : I.10.77
ROM Version : I.08.07

and started with most simplest config

; J4903A Configuration Editor; Created on release #I.10.77

hostname "ProCurve Switch 2824"
ip routing
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged 1-2,4-24
ip address 192.168.2.1 255.255.255.0
no untagged 3
exit
vlan 3
name "VLAN3"
ip address 192.168.3.1 255.255.255.0
tagged 3
exit


I configured a host with static IP on each network and observed the following:

-Host on VLAN 1 can ping GWs on both VLAN 1 and 3.

-Telnet to switch, can ping GWs on both VLANs and host on VLAN 1. But unable to ping host on VLAN 3. I see smoke.

-Host on VLAN 3 unable to ping it's GW 192.168.3.1 but can ping itself. Now there's a fire.

To rule out any cable/config issue with host on VLAN 3 I plugged into VLAN 1 and configured IP according and behaved just like the other host on VLAN 1.

What did I miss here?

My plan is to enable routing between those vlans (networks) with separate broadcast domains. Then I will plug into Verizon FIOS router for internet access.

I've read and tried so many different configs and ways of creating the configs but just hitting a wall here.

Any help would be much appreciated.

Thank you.

[Pieter 't Hart · Accepted solution]

vlan 3
name "VLAN3"
ip address 192.168.3.1 255.255.255.0
tagged 3
exit

should be
vlan 3
name "VLAN3"
ip address 192.168.3.1 255.255.255.0
untagged 3
exit

Because "normal" windows clients can only handle untagged packets, I assume you do not have a host connected to port 3 that can handle vlan-tagged packets?
Many windows server NIC-drivers can be configured to handle vlan-tagged packets, but by default do not.

[Steven Keefe]

Thank you for the quick response on a holiday!

You're spot on. I knew it had to be something obvious but just had the blinders on.

I will add some Windows servers to the mix and set the VLAN in NIC.

My next step, connected 2824 to home router (Verizon FIOS model# MI424-WR) and added a route back to VLAN 3 and PING is working all around, but not from host on VLAN 3 to Internet IP. I assume if I tag VLAN 3 and configure NIC but will know shortly.

Thanks again!

[Steven Keefe]

Still unable to get hosts on tagged VLANs to connect to Internet thru the Verizon FIOS Router. They can load the web mgmt page of the Verizon router 192.168.1.1 but nothing on the Internet. Confirmed domain names are resoleving to IP so issue is in network layer.

Here's updated 2824 config:

; J4903A Configuration Editor; Created on release #I.10.77

hostname "ProCurve Switch 2824"
ip routing
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged 1-24
ip address 192.168.1.2 255.255.255.0
exit
vlan 2
name "VLAN2"
ip address 192.168.2.1 255.255.255.0
tagged 5,7
exit
vlan 3
name "VLAN3"
ip address 192.168.3.1 255.255.255.0
tagged 19
exit

The goal is to have ESX 4.0 server with port groups, hence the need for tagged VLANs.

Any help?

[Pieter 't Hart]

>>> added a route back to VLAN 3 and PING is working all around<<<
Looks like at ip level connectivity is OK.

>>> but not from host on VLAN 3 to Internet IP <<<
As the router has "Fully customizable firewall with Stateful Packet Inspection"
you may need to enable the extra subnets in the firewall rules???

[Steven Keefe]

I suspected NAT / Firewall to be the issue. Temporarily shutdown firewall and no love. This weekend I'll replace Verizon router with a pfSense firewall / router which will give me complete control so I can get to the bottom of this. Update to follow...