Inter-VLAN Routing Issue - HP 5130EI & HP ProCurve 2530

[FluxCapacitor]

Hello. I am experiencing a wierd intervlan routing issue in the network.  I've attached a network diagram of the enviroment. I cant seem to get to VLAN 60 (User VLAN) from VLAN 30,101 but can get to it from VLAN 100 (Guest WiFi). I've performed the following but none of them seem to work.

The HP5130EI is the core Layer2/Layer 3 switch in the network and I'm able to get to the User VLAN (60) from it but I cannot get to it from the ProCurve SW i.e I ping 10.21.1.14 from ProCurve SW I dont get a ping reply. 

1 ) Checked the SW routing table 

2)Re-created the VLAN101 interface 

3) Checked the F/W to see if there are any routing issues there. 

Any ideas on where to go from here? 

---

[Apachez-]

Could you paste the configs instead (dont forget to replace any sensitive data with <REMOVED>)?

Things to verify:

1) On each host is the default gateway correctly setup?

2) Different VRFs?

3) Various private/protected VLAN configs?

[FluxCapacitor]

As requested please see configs attached for CORE/5130 and Access/ProCurve SW

[Vince-Whirlwind]

Based on the network configs, you should have connectivity.

Can the hosts on VLAN 60 ping their default gateway? Is their default gateway 10.21.1.1?

Can the Procurve switch ping its default gateway?
 
(I haven't used 2530s, but as they are not routing switches, I seem to recall Procurves need this command added:
"management-vlan 30"

[FluxCapacitor]

Both ProCurves on VLAN 30 and Servers & Hosts on VLAN 60 can ping thier respective G/W (CORE SW HP 5130).  Im not sure what else could be causing it.

The firewall is on PVID 30 for access and trunked for the other VLANs is that the correct config? 

Thanks

[Vince-Whirlwind]

I'm not sure where the FW comes into it - your "core" doesn't seem to have any config in it that redirects inter-VLAN traffic to the FW..?

So, the hosts on VLAN60 - they can ping their default gw on the core switch - next step - can they ping the VLAN30 IP address 10.21.30.1 on the "core" switch?

[sdide]

Hi FluxCapacitor

could you post the routing table on the core-01.

]display ip routing-table

Regards

[FluxCapacitor]

@Vince

I cannot ping the G/W of VLAN 30 from any device VLAN 60 (10.21.30.1) 

The F/W has static routes back to the CORE-SW for any traffic leaving the CORE-SW

Since it's just inter vlan traffic it should'nt even leave the CORE-SW .

@sdide Please see below.

IP Routing Table 

Destination/Mask Proto Pre Cost NextHop Interface
0.0.0.0/0 Static 60 0 10.21.30.254 Vlan30
0.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
10.21.1.0/24 Direct 0 0 10.21.1.1 Vlan60
10.21.1.0/32 Direct 0 0 10.21.1.1 Vlan60
10.21.1.1/32 Direct 0 0 127.0.0.1 InLoop0
10.21.1.255/32 Direct 0 0 10.21.1.1 Vlan60
10.21.30.0/24 Direct 0 0 10.21.30.1 Vlan30
10.21.30.0/32 Direct 0 0 10.21.30.1 Vlan30
10.21.30.1/32 Direct 0 0 127.0.0.1 InLoop0
10.21.30.255/32 Direct 0 0 10.21.30.1 Vlan30
10.21.101.0/24 Direct 0 0 10.21.101.1 Vlan101
10.21.101.0/32 Direct 0 0 10.21.101.1 Vlan101
10.21.101.1/32 Direct 0 0 127.0.0.1 InLoop0
10.21.101.255/32 Direct 0 0 10.21.101.1 Vlan101
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.0/32 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
127.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0
172.16.100.0/24 Direct 0 0 172.16.100.1 Vlan100
172.16.100.0/32 Direct 0 0 172.16.100.1 Vlan100
172.16.100.1/32 Direct 0 0 127.0.0.1 InLoop0
172.16.100.255/32 Direct 0 0 172.16.100.1 Vlan100
224.0.0.0/4 Direct 0 0 0.0.0.0 NULL0
224.0.0.0/24 Direct 0 0 0.0.0.0 NULL0
255.255.255.255/32 Direct 0 0 127.0.0.1 InLoop0

[Vince-Whirlwind · Accepted solution]

If a Host in VLAN60 can ping the Core switch VLAN60 interface, but not ping the core switch VLAN30 interface, this would point at:

 - Host has its GW set wrong

 - Host has its subnet mask set wrong

(I'm guessing it's not going to be this easy...)

From your host in 10.21.1.0/24 that can't ping 10.21.30.1, do a 

ipconfig /all

[Vince-Whirlwind]

In fact, from your "core" config, I can see this on each VLAN:
 dhcp relay server-address 10.21.30.254

Which is the FW, right?

Also, in your original description you say your 172... subnet has no problem communicating with your 10.. subnets, but the 10... subnets using DHCP addresses are having trouble.

I'd say your DHCP scope on your firewall has defaulted to the classful default subnet mask for a 10... subnet.

So the hosts have no way to get to a different subnet in the 10... range.

Change your DHCP scope subnet masks.