HP 5412zl with slow InterVlan routing

[Colin-Tennyson]

Hello All,

I have a HP 5412zl running firmware version K.15.16.0011.

I have noticed that my inter vlan routing performance is very slow. When connecting two cablelled laptops running jperf on the same VLAN, I can push a max of 20 MegaBits. This has been tested when there are a minimum number of users connecting.

I have attached my config also, just in case someone is able to offer some recommendations. 

Cheers

[parnassus]

No config is attached.

By the way...Is your HP 5412zl Switch doing IP Routing among its defined VLANs or the routing task is performed by an external device such as a Router or a Firewall (which manages involved VLANs and their routing) connected to it?

[Colin-Tennyson]

My 5412 is providing the routing. Will not allow to to attach a .txt.

430 deny ip 10.12.100.0 0.0.0.255 10.22.0.0 0.0.0.255
440 deny ip 10.12.100.0 0.0.0.255 10.30.0.0 0.0.0.255
450 deny ip 10.12.100.0 0.0.0.255 10.30.4.0 0.0.0.255
460 deny ip 10.12.100.0 0.0.0.255 10.31.10.0 0.0.0.255
470 deny ip 10.12.100.0 0.0.0.255 10.32.10.0 0.0.0.255
480 deny ip 10.12.100.0 0.0.0.255 10.32.30.0 0.0.0.255
490 deny ip 10.12.100.0 0.0.0.255 10.33.10.0 0.0.0.255
495 permit ip 10.11.100.0 0.0.0.255 10.11.2.48 0.0.0.0
500 deny ip 10.12.100.0 0.0.0.255 10.33.30.0 0.0.0.255
510 deny ip 10.12.100.0 0.0.0.255 10.34.10.0 0.0.0.255
520 deny ip 10.12.100.0 0.0.0.255 10.34.30.0 0.0.0.255
530 deny ip 10.12.100.0 0.0.0.255 10.35.10.0 0.0.0.255
540 deny ip 10.12.100.0 0.0.0.255 10.35.30.0 0.0.0.255
545 permit tcp 10.11.100.0 0.0.0.255 10.11.2.20 0.0.0.0 eq 80
546 permit tcp 10.11.100.0 0.0.0.255 10.11.2.20 0.0.0.0 eq 443
550 deny ip 10.11.100.0 0.0.0.255 10.11.2.0 0.0.0.255
560 deny ip 10.11.100.0 0.0.0.255 10.11.0.0 0.0.0.255
570 deny ip 10.11.100.0 0.0.0.255 10.12.0.0 0.0.0.255
580 deny ip 10.11.100.0 0.0.0.255 10.10.4.0 0.0.0.255
590 deny ip 10.11.100.0 0.0.0.255 10.10.54.0 0.0.0.255
600 deny ip 10.11.100.0 0.0.0.255 10.50.0.0 0.0.0.255
610 deny ip 10.11.100.0 0.0.0.255 10.50.4.0 0.0.0.255
620 deny ip 10.11.100.0 0.0.0.255 10.51.0.0 0.0.0.255
630 deny ip 10.11.100.0 0.0.0.255 10.51.30.0 0.0.0.255
640 deny ip 10.11.100.0 0.0.0.255 10.52.10.0 0.0.0.255
650 deny ip 10.11.100.0 0.0.0.255 10.52.30.0 0.0.0.255
660 deny ip 10.11.100.0 0.0.0.255 10.53.10.0 0.0.0.255
670 deny ip 10.11.100.0 0.0.0.255 10.20.0.0 0.0.0.255
680 deny ip 10.11.100.0 0.0.0.255 10.20.4.0 0.0.0.255
690 deny ip 10.11.100.0 0.0.0.255 10.21.0.0 0.0.0.255
700 deny ip 10.11.100.0 0.0.0.255 10.22.0.0 0.0.0.255
710 deny ip 10.11.100.0 0.0.0.255 10.30.0.0 0.0.0.255
720 deny ip 10.11.100.0 0.0.0.255 10.30.4.0 0.0.0.255
730 deny ip 10.11.100.0 0.0.0.255 10.31.10.0 0.0.0.255
740 deny ip 10.11.100.0 0.0.0.255 10.32.10.0 0.0.0.255
750 deny ip 10.11.100.0 0.0.0.255 10.32.30.0 0.0.0.255
760 deny ip 10.11.100.0 0.0.0.255 10.33.10.0 0.0.0.255
770 deny ip 10.11.100.0 0.0.0.255 10.33.30.0 0.0.0.255
780 deny ip 10.11.100.0 0.0.0.255 10.34.10.0 0.0.0.255
790 deny ip 10.11.100.0 0.0.0.255 10.34.30.0 0.0.0.255
800 deny ip 10.11.100.0 0.0.0.255 10.35.10.0 0.0.0.255
810 deny ip 10.11.100.0 0.0.0.255 10.35.30.0 0.0.0.255
820 deny ip 10.10.104.0 0.0.0.255 172.16.0.0 0.0.255.255
830 deny ip 10.11.100.0 0.0.0.255 172.16.0.0 0.0.255.255
840 deny ip 10.12.100.0 0.0.0.255 172.16.0.0 0.0.255.255
850 permit tcp 10.11.100.0 255.255.255.0 10.11.2.48 255.255.255.0 eq 8014
1010 permit tcp 172.20.0.0 0.0.255.255 10.11.2.20 0.0.0.0 eq 80
1011 permit tcp 172.22.0.0 0.15.255.255 10.11.2.20 0.0.0.0 eq 80
1015 permit tcp 172.20.0.0 0.0.255.255 10.11.2.20 0.0.0.0 eq 443
1016 permit tcp 172.22.0.0 0.15.255.255 10.11.2.20 0.0.0.0 eq 443
1020 deny ip 172.20.0.0 0.0.255.255 10.11.0.0 0.0.63.255
1021 deny ip 172.22.0.0 0.15.255.255 10.11.0.0 0.0.63.255
1025 deny ip 172.20.0.0 0.0.255.255 10.12.0.0 0.0.63.255
1026 deny ip 172.22.0.0 0.15.255.255 10.12.0.0 0.0.63.255
1030 deny ip 172.20.0.0 0.0.255.255 10.10.0.0 0.0.63.255
1031 deny ip 172.22.0.0 0.15.255.255 10.10.0.0 0.0.63.255
1035 deny ip 172.20.0.0 0.0.255.255 10.21.0.0 0.0.63.255
1036 deny ip 172.22.0.0 0.15.255.255 10.21.0.0 0.0.63.255
1040 deny ip 172.20.0.0 0.0.255.255 10.22.0.0 0.0.63.255
1041 deny ip 172.22.0.0 0.15.255.255 10.22.0.0 0.0.63.255
1045 deny ip 172.20.0.0 0.0.255.255 10.50.0.0 0.0.63.255
1046 deny ip 172.22.0.0 0.15.255.255 10.50.0.0 0.0.63.255
1050 deny ip 172.20.0.0 0.0.255.255 10.51.0.0 0.0.63.255
1051 deny ip 172.22.0.0 0.15.255.255 10.51.0.0 0.0.63.255
1055 deny ip 172.20.0.0 0.0.255.255 10.52.0.0 0.0.63.255
1056 deny ip 172.22.0.0 0.15.255.255 10.52.0.0 0.0.63.255
1060 deny ip 172.20.0.0 0.0.255.255 10.53.0.0 0.0.63.255
1061 deny ip 172.22.0.0 0.15.255.255 10.53.0.0 0.0.63.255
1065 deny ip 172.20.0.0 0.0.255.255 10.30.0.0 0.0.63.255
1066 deny ip 172.22.0.0 0.15.255.255 10.30.0.0 0.0.63.255
1070 deny ip 172.20.0.0 0.0.255.255 10.31.0.0 0.0.63.255
1071 deny ip 172.22.0.0 0.15.255.255 10.31.0.0 0.0.63.255
1075 deny ip 172.20.0.0 0.0.255.255 10.32.0.0 0.0.63.255
1076 deny ip 172.22.0.0 0.15.255.255 10.32.0.0 0.0.63.255
1080 deny ip 172.20.0.0 0.0.255.255 10.33.0.0 0.0.63.255
1081 deny ip 172.22.0.0 0.15.255.255 10.33.0.0 0.0.63.255
1085 deny ip 172.20.0.0 0.0.255.255 10.34.0.0 0.0.63.255
1086 deny ip 172.22.0.0 0.15.255.255 10.34.0.0 0.0.63.255
1090 deny ip 172.20.0.0 0.0.255.255 10.35.0.0 0.0.63.255
1091 deny ip 172.22.0.0 0.15.255.255 10.35.0.0 0.0.63.255
1095 deny ip 172.20.0.0 0.0.255.255 172.16.0.0 0.0.255.255
1096 deny ip 172.22.0.0 0.15.255.255 172.16.0.0 0.0.255.255
2000 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
ip access-list extended "103"
10 permit tcp 172.16.2.15 0.0.255.255 0.0.0.0 255.255.255.255 eq 25
15 permit tcp 10.11.2.156 0.255.255.255 0.0.0.0 255.255.255.255 eq 25
20 permit tcp 172.16.2.30 0.0.255.255 0.0.0.0 255.255.255.255 eq 25
25 deny tcp 172.25.0.0 0.0.255.255 10.11.2.0 0.0.0.255
30 deny tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 25
40 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
ip access-list extended "105"
10 permit tcp 0.0.0.0 255.255.255.255 10.11.2.48 255.255.255.255 eq 8014
20 permit tcp 0.0.0.0 255.255.255.255 10.11.2.48 255.255.255.255 eq 7725
40 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
ip access-list extended "110"
40 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
ip access-list standard "10"
exit
ip route 0.0.0.0 0.0.0.0 10.0.1.5
ip route 10.8.0.0 255.255.255.0 172.16.2.61
ip route 10.9.0.0 255.255.255.0 10.8.0.26
ip route 10.9.0.0 255.255.255.0 172.16.2.61
ip route 10.9.4.0 255.255.255.0 10.8.0.26
ip route 10.9.4.0 255.255.255.0 172.16.2.61
ip route 10.9.22.0 255.255.255.0 10.8.0.26
ip route 10.9.22.0 255.255.255.0 172.16.2.61
ip route 10.20.4.0 255.255.255.0 172.21.112.2
ip route 10.20.104.0 255.255.255.0 172.21.112.2
ip route 10.30.4.0 255.255.255.0 172.21.112.2
ip route 10.30.104.0 255.255.255.0 172.21.112.2
ip route 10.50.4.0 255.255.255.0 172.21.115.2
ip route 10.50.104.0 255.255.255.0 172.21.115.2
ip route 10.60.4.0 255.255.255.0 172.21.115.2
ip route 10.70.4.0 255.255.255.0 172.21.117.2
ip route 10.80.4.0 255.255.255.0 172.21.115.2
ip route 10.121.0.0 255.255.255.0 172.16.2.61
ip route 10.121.4.0 255.255.255.0 172.16.2.61
ip route 10.121.100.0 255.255.255.0 172.16.2.61
ip route 172.15.55.0 255.255.255.0 10.8.0.6
ip route 172.15.55.0 255.255.255.0 172.16.2.61
ip route 192.168.69.0 255.255.255.0 10.0.1.5
ip router-id 10.200.1.3
ip routing
interface A19
name "CAT5 Uplink to ESX"
exit
interface A22
flow-control
exit
interface A23
speed-duplex auto-1000
exit
interface A24
name "***To_CCHA-RK1-R01_Gi0/0/0"
exit
interface B2
disable
exit
interface B4
name "Labgate - student DHCP"
exit
interface B10
name "*To_Mitel_ISS_User_Gateway"
exit
interface B11
name "*To_Mitel_VoIP_PBX_AW"
exit
interface B12
name "*To_Mitel_NuPoint_Server"
exit
interface B17
name "****StudentTracker****"
exit
interface B19
name "*To_3Com_PBX_MainChassis"
exit
interface B24
name " "
exit
interface C5
name "NVR"
exit
interface C6
name "NVR"
exit
interface C23
name "***to_Meru_Gi1_Temp"
exit
interface C24
name "Uplink to Activo ASA"
exit
interface D12
name "Oracle - Admin DHCP"
exit
interface D17
name "****StudentTracker****"
exit
interface D23
name "***to_Meru_Gi1"
exit
interface D24
name "***to_Meru_Gi2"
exit
interface E1
name "*Trunk_to_B1_flr1"
exit
interface E2
name "*Trunk_to_B2_flr1"
exit
interface E3
name "*To_Floor1_C1"
exit
interface E4
name "*To_Floor1_D1"
exit
interface E6
name "*To_Floor1_D2"
exit
interface E7
name "*To_FloorS1_E2"
exit
interface E8
name "*To_FloorS1_E1"
exit
interface E10
name "*To_FloorS2_G1"
exit
interface E12
name "*To_FloorS3_H1"
exit
interface E18
name "Uplink to Cisco_ESX_Admin_Vlan"
exit
interface E21
name "**Uplink to Cisco 24 Port**"
exit
interface E22
name "**Uplink to Cisco 24 Port**"
exit
interface E23
name "*Uplink_To_Cisco_Above_163"
exit
interface E24
name "*Uplink_To_Cisco_in_phone_room"
exit
interface loopback 0
ip address 10.200.1.3
ip ospf 10.200.1.3 area backbone
exit
snmp-server community "c0lumbia"
snmp-server host 10.11.0.82 community "public" trap-level all
snmp-server contact "Colin Tennyson"
router ospf
area 0.0.0.10
area backbone
redistribute static
enable
exit
vlan 1
name "DEFAULT_VLAN"
no untagged
A1-A4,A7,A10-A12,A19,A21,A23-A24,B1-B2,B4,B10-B12,B15,B17-B20,C1-C8,C13-C22,C24,D1-D24,E1-E4,E6-E8,E10,E12,E14,E21,E24
untagged A5-A6,A8-A9,A13-A18,A20,B3,B5-B9,B13-B14,B16,B21-B24,C9-C12,C23,E5,E9,E11,E13,E15-E20,E22-E23,Trk1
no ip address
exit
vlan 100
name "***To_Firewall_Forwarding"
untagged C24
ip address 10.0.1.6 255.255.255.252
exit
vlan 103
name "VLAN103"
no ip address
exit
vlan 110
name "***Floor1_Admin_Servers"
untagged C13-C18,D1-D6,D8-D24
tagged A9-A13,A15,A17,A19,B1,B3,B5,B7,C9-C12,E1,E3-E6,E8,E10,E12,E14,E18,E20-E24
ip address 10.11.2.1 255.255.255.0
ip helper-address 10.11.2.60
ip ospf 10.11.2.1 area 0.0.0.10
exit
vlan 111
name "***Floor1_Student_Servers"
untagged B1-B2,B4
tagged C7,E1,E3-E6,E8,E21,E23-E24
ip address 10.11.102.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.11.102.1 area 0.0.0.10
exit
vlan 112
name "***Floor1_Admin"
untagged A4,B15,C19-C22,D7
tagged A1,B3,E1,E3-E6,E10,E14,E21-E24
ip address 10.11.0.1 255.255.255.0
ip helper-address 10.11.2.150
ip ospf 10.11.0.1 area 0.0.0.10
exit
vlan 113
name "***Floor1_Student"
tagged E1,E3-E4,E6,E23-E24
ip access-group "102" in
ip address 10.11.100.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.11.100.1 area 0.0.0.10
exit
vlan 114
name "***Floor1_South_Admin_data"
tagged E7-E8
ip address 10.11.30.1 255.255.255.0
ip helper-address 10.11.2.150
exit
vlan 115
name "***Floor1_South_Stdnt_data"
tagged E8
ip address 10.11.130.1 255.255.255.0
ip helper-address 10.11.102.60
exit
vlan 116
name "***Floor1_North_Admin_data"
tagged E2,E8
ip address 10.11.10.1 255.255.255.0
ip helper-address 10.11.2.150
ip ospf 10.11.10.1 area 0.0.0.10
exit
vlan 117
name "***Floor1_North_Stdnt_data"
tagged E2,E8
ip address 10.11.110.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.11.110.1 area 0.0.0.10
exit
vlan 120
name "***Floor2_Admin"
tagged B3,E2
ip access-group "102" in
ip address 10.12.0.1 255.255.255.0
ip helper-address 10.11.2.150
ip ospf 10.12.0.1 area 0.0.0.10
exit
vlan 121
name "***Floor2_Student"
tagged E2
ip address 10.12.100.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.12.100.1 area 0.0.0.10
exit
vlan 124
name "***Floor2_South_Admin_data"
tagged E10
ip address 10.12.30.1 255.255.255.0
ip helper-address 10.11.2.150
exit
vlan 125
name "***Floor2_South_Stdnt_data"
tagged E10
ip address 10.12.130.1 255.255.255.0
ip helper-address 10.11.102.60
exit
vlan 126
name "VLAN126"
tagged E8
ip address 10.12.10.1 255.255.255.0
ip helper-address 10.11.2.60
ip ospf 10.12.10.1 area 0.0.0.10
exit
vlan 127
name "VLAN127"
tagged E8
ip address 10.12.110.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.12.110.1 area 0.0.0.10
exit
vlan 134
name "***Floor3_South_Admin_data"
tagged E12
ip address 10.13.30.1 255.255.255.0
ip helper-address 10.11.2.60
exit
vlan 135
name "***Floor3_South_Stdnt_data"
tagged E12
ip address 10.13.130.1 255.255.255.0
ip helper-address 10.11.102.60
exit
vlan 900
name "*Guest_VLAN"
ip address 192.168.1.1 255.255.255.0
ip ospf 192.168.1.1 area 0.0.0.10
exit
vlan 920
name "___InterimeVoiceVLAN_Admin"
tagged B3,C2,E1-E8,E10,E12,E23-E24
ip address 10.10.4.1 255.255.255.0
ip helper-address 10.11.2.150
ip helper-address 10.11.2.60
ip ospf 10.10.4.1 area 0.0.0.10
exit
vlan 921
name "___Interim_VoiceVLAN_Student"
tagged C3,C7,E1-E2,E8,E10,E12,E23-E24
ip address 10.10.104.1 255.255.255.0
ip helper-address 10.11.102.60
ip ospf 10.10.104.1 area 0.0.0.10
exit
vlan 922
name "___Interim_VoiceVLANSrver_Admin"
no ip address
exit
vlan 923
name "___Interim_VoiceSrvrs_Student"
no ip address
exit
vlan 955
name "___Interime_Server_VLAN"
untagged A21,B17
tagged A13,A15,A17,A19,B1,B3,B5,B7,E1-E21,E23-E24
ip address 172.16.1.1 255.255.0.0
ip ospf 172.16.1.1 area 0.0.0.10
exit
vlan 1010
name "***SwitchMGNT"
tagged E1-E21,E23-E24
ip address 10.10.10.1 255.255.255.0
ip ospf 10.10.10.1 area 0.0.0.10
exit
vlan 1090
name "***Data_VLAN_to_MB"
tagged A23,B16
ip address 172.21.12.1 255.255.255.0
ip ospf 172.21.12.1 area backbone
exit
vlan 1091
name "***Voice_VLAN_to_MB"
tagged A23,B16
ip address 172.21.112.1 255.255.255.0
ip ospf 172.21.112.1 area backbone
qos priority 7
exit
vlan 1092
name "***Data_VLAN_to_PH"
tagged A23
ip address 172.21.15.1 255.255.255.0
ip ospf 172.21.15.1 area backbone
exit
vlan 1093
name "***Voice_VLAN_to_PH"
tagged A23
ip address 172.21.115.1 255.255.255.0
ip ospf 172.21.115.1 area backbone
exit
vlan 1094
name "***To_151Front_via_Atria"
untagged A24
tagged A23
no ip address
exit
vlan 1097
name "***Data_VLAN_to_AR"
tagged A23
ip address 172.21.17.1 255.255.255.0
ip ospf 172.21.17.1 area backbone
exit
vlan 1098
name "***Voice_VLAN_to_AR***"
tagged A23
ip address 172.21.117.1 255.255.255.0
ip ospf 172.21.117.1 area backbone
exit
vlan 1100
name "***Voice_VLAN_Admin"
tagged C2,E1-E6,E8,E10,E12,E23-E24
no ip address
ip helper-address 10.11.2.60
exit
vlan 1101
name "***Voice_VLAN_Student"
tagged E1-E2,E8,E10,E12,E23-E24
no ip address
ip helper-address 10.11.102.60
exit
vlan 1102
name "***Voice_VLAN_Admin_Servers"
untagged B10-B12
ip address 10.10.54.1 255.255.255.0
ip helper-address 10.11.2.60
ip ospf 10.10.54.1 area 0.0.0.10
exit
vlan 1103
name "*Students_VoiP_VLAN"
untagged B18-B20
ip address 10.10.154.1 255.255.255.0
ip ospf 10.10.154.1 area 0.0.0.10
exit
vlan 1105
name "***AW_Cameras"
untagged A1-A3,A7,C1-C8
tagged D7,E1-E4,E6-E8,E10,E12,E23-E24
ip address 10.10.5.1 255.255.255.0
ip helper-address 10.11.2.60
ip ospf 10.10.5.1 area 0.0.0.10
exit
vlan 1110
name "***AW_WiFi_Admin"
tagged A1,D7,E1-E4,E6-E8,E10,E12,E14,E23-E24
ip address 10.10.6.1 255.255.255.0
ip helper-address 10.11.2.60
ip ospf 10.10.6.1 area 0.0.0.10
exit
vlan 1111
name "VLAN1111"
no ip address
exit
vlan 1112
name "VLAN1112"
no ip address
exit

[Vince-Whirlwind]

If your laptops are on the same VLAN, you aren't testing inter-VLAN routing.

Does this affect all VLANs?

What's in the switch logs?

What is the CPU and MEM showing?

What are the switchport statistics and errors?

You seem to have a whole bunch of ACLs - this is a switch, not a firewall, and ACLs don't provide much security anyway. Maybe the switch doesn't like having so many ACL lines? Ideally you should have an IP addressing scheme which would allow you to summarise all that into far fewer lines?
If you need to separate Student from Admin and Server networks, the best thing would be to create them as separate zones and don't route between them on the switch but home each subnet on a firewall.