topic Re: VLAN Help (2626) in Switches, Hubs, and Modems

VLAN Help (2626)

Tony Barrett_2 — Fri, 18 Nov 2005 07:12:45 GMT

This is probably simple, but I need to get it clear in my head.

I have an HP2626 that uplinks to the core switch (5308xl) on port 25 (Gb).

I want to create VLAN's on the 2626 so;

ports 1-12 can all talk to each other (but not to ports 13-24) and out to the main network on port 25.

ports 13-24 can all talk to each other (but not to ports 1-12) and out to the main network on port 25.

It is important that both ports 1-12 and ports 13-24 can connect as normal over port 25.

There are no other VLAN's in use on the network.

I've tried various tagging settings, but it's not working as it should.

Can someone give me an example of how this should work?

TIA

Re: VLAN Help (2626)

MIBA NSD — Fri, 18 Nov 2005 17:44:34 GMT

hi tony
do u have the 2 vlans in your network or do u only want to use it on the 2626?
and u have to specify address ranges for the 2 vlans!
is routing turned on on the 5308?
on what port on the core switch is the 2626 connected?

regards peter

Re: VLAN Help (2626)

Bruce Campbell_3 — Sat, 19 Nov 2005 19:46:44 GMT

If I understand what you want to do, you'll need to:

- create 2 vlans on the 2626
- put ports 1-12 untagged on one vlan
- put ports 12-24 untagged on the other vlan
- put port 25 tagged on both vlans
- create same 2 vlans on the 5308, and give each an ip address/mask
- put both vlans tagged on the link to the
2626
- enable routing on the 5308
- apply acls on the 5308 to prevent the
two subnets from talking to each other
- put your clients on ports 1-12 on
one subnet
- put your clients on ports 12-24 on
the other subnet

Now the clients on ports 1-12 can use
the internet etc, and likewise for
ports 12-24, but they cannot talk to
each other, because of the acls on the 5308.

Re: VLAN Help (2626)

Tony Barrett_2 — Mon, 21 Nov 2005 04:35:16 GMT

Cheers for the responses. I only have the DEFAULT_VLAN on the 5308, and don't route internally on that switch. I was really hoping just to be able to create a port-based VLAN on the 2626, and restrict access from there. I didn't really want to have to configure the switch as a basic router as I didn't think it would be necessary.

I guess the solution wasn't as wasy as I hoped it was going to be. I'd already tried setting 1-12 as untagged, 13-24 as untagged and 25 tagged across all. Didn't work at all.

I'll try a few other things and see what I can get working.

Thanks again

Re: VLAN Help (2626)

Kell van Daal — Mon, 21 Nov 2005 18:22:06 GMT

Hi Tony,

VLAN's aren't meant for that, but luckily the 2600 series support a feature that does just what you want: Source-port filters.
Read all about it in the manual:
ftp://ftp.hp.com/pub/networking/software/59906024-1004-Security-ch10-Traf-Security-Filts.pdf

In short, you have to make filter with the following commands:

2626(config)#filter source-port 1 drop 13-24
2626(config)#filter source-port 2 drop 13-24
.
.
.
2626(config)#filter source-port 12 drop 13-24

and

2626(config)#filter source-port 13 drop 1-12
2626(config)#filter source-port 14 drop 1-12
.
.
.
2626(config)#filter source-port 24 drop 1-12

Hope this helps,

Kell

Re: VLAN Help (2626)

Kell van Daal — Mon, 21 Nov 2005 18:23:47 GMT

ohh, I forgot.
Make sure all ports are in the same VLAN, en forward that VLAN untagged over port 25 to the 5300xl (assuming default VLAN config on the 5300xl).

Else you will have troubles getting all clients to the 5300xl, where you probably have your server etc.