Aruba 2530-24 PoE LACP problem

[Andy_Fly]

Hello

I was try to configure my Aruba 2530 switch, but i stop on LACP connection. On this config:

hostname "ARUBA_2530"
trunk 25-28 trk1 lacp
timesync sntp
sntp unicast
sntp server priority 1 10.20.10.43
time timezone 1
ip default-gateway 10.20.81.1
ip timep manual 10.20.10.43
snmp-server community "public" unrestricted
vlan 1
name "DEFAULT_VLAN"
no untagged 1-24
tagged Trk1
no ip address
exit
vlan 7
name "devices"
untagged 1-24
tagged Trk1
no ip address
ipv6 enable
ipv6 address autoconfig
exit
vlan 81
name "MGM"
tagged Trk1
ip address 10.20.81.47 255.255.255.0
ipv6 enable
ipv6 address autoconfig
exit
primary-vlan 81
management-vlan 81
spanning-tree Trk1 priority 4

I couldn't get in to core switch to vlan7 from vlan7 in this switch, but i can get in from core to management VLAN from core.

Could someone tell me where i make mistake with this configuration.

[parnassus]

Hi!

Ports 25, 26, 27 and 28 are aggregated members of logical interface Trk1 (with LACP). You have made the logical interface Trk1 as tagged member of VLAN 1, 7 and 81 AND you set VLAN id 81 as the Management VLAN (thus that VLAN doesn't route or be routed as the others <- the Aruba 2530 doesn't support IP Routing -> it can't act as a Router). Is it correct for your scenario?

What you have in your Core?

[Andy_Fly]

Thank you for your answer.

Ok then, if i want to connect vlan7  with vlan7 in core and could connect MGM vlan with Vlan 81 on core I must add vlan 81 untagged on trk1 and disbled on it Managment?

Core side(cut):

trunk 11-12 trk12 lacp (connection core with configurating switch)

ip default-gateway 10.20.81.1

vlan 1
name "Lan"
...
untagged 1,7,Trk12
...
no ip address
exit

...

vlan 7
name "VLAN7"
tagged 50-52,Trk12
no ip address

...

vlan 81
name "v081-MGM"

tagged 1,51-52,Trk12
ip address 10.32.20.42 255.255.255.0
exit

primary-vlan 81

spanning-tree Trk12 priority 4

Routing on Vlans I do on fortigate

[parnassus · Accepted solution]

Hi! disabling VLAN 81 as "Management VLAN" will help, I mean...the VLAN 81 should be, like the others, a standard VLAN without the "Management" option enabled.

For the Trk interface tagging: the rule is that you must configure the Port Trunk(s) on your Core and on your 2530 to match (actually, from what I see, Trk12 is configured to be an untagged member of VLAN 1 and a tagged member of VLAN 7 and 81) so you need to fix that on the Aruba 2530 side (Trk1 should be set to be  an untagged member of VLAN 1 and a tagged member of VLAN 7 and 81 BUT, currently, it's tagged on VLAN 1, 7 and 81 which is a mismatch exactly on the VLAN 1 part).

Once matched the Aruba 2530 will become a - permitted VLAN on Trk1 2530 side per permitted VLAN on Trk12 Core side - a L2 extension of your Core and (I presume, since you cited that a Firewall is the router for your network) then the Firewall will be able to reach the 2530 on the IP address you assigned on VLAN 81 () exactly as it reaches the Core on the IP Address it has on the very same VLAN 81 (10.32.20.42), if actually it is already capable of doing it.

SO pay attention...on the 2530 you set VLAN 81 IP Address on 10.20.81.47 BUT on the Core you report for the VLAN 81 the IP Address 10.32.20.42, since the mask is /24 (255.255.255.0) there is an error...I presume you wanted to assign 10.32.20.47 to the VLAN 81 on Aruba 2530 and not the 10.20.81.47. Isn't it?

So fix the VLAN matching on Trk1 and the IP Address of VLAN 81 on 2530 and it should work. 

[Andy_Fly]

Hello.

Thanks for this solution, I will check it and give you feedback

[Andy_Fly]

This resolve the problem. Thank you very much.