5300XL Vlan and Active Directory

[FlyFast]

Hi,

I have two directly connected 5300 switches, one for the 1st floor and one for the 2nd floor. I have vlans on both switches which are working fine. My problem is that I am only able to "browse Active Directory" (network neighborhood) on one of the vlans (happens to be the first vlan I created, HR). Does anyone have any ideas regarding this? I can supply configs if necessary. All my vlan ports are untagged. I am using helper ip's for DHCP addresses (MS 2003 Server) and that works fine. All users have internet access. No problems there.

[Mohieddin Kharnoub]

Hi

Can you tell us little about the network topology you have and the configuration of one of the 5300 ?

If you have routing between your vlans and internet access as well, then you shouldn't have any other problems.
Good Luck !!!

[FlyFast]

OK,

I can browse AD on the default vlan on both switches. I can also browse AD in the "HR_Vlan" on AnOfSw52,
I cannot browse AD from the other vlans. All Vlans are getting DHCP addresses from 10.108.1.5, DNS from 10.108.1.6.

I am not having inssues with LAN connectivity, Internet access, all pc's picking up a
DHCP address from the 10.108.1.5 address. Switch AnOfSw52 is directly connected to 10.108.1.254 (router).
The two switches are connected together on port A2 on each switch. This port is in the default vlan on
both, untagged.

IP routing has been enabled. As I said, I want to be able to browse Active Directory from all vlans, and I
cannot understand why the HR_Vlan is working and the others are not.

I have these routing statements on 10.108.1.254 which is a cisco router:

ip route 10.108.16.0 255.255.255.0 10.108.1.52
ip route 10.108.17.0 255.255.255.0 10.108.1.51
ip route 10.108.18.0 255.255.255.0 10.108.1.51
ip route 10.108.19.0 255.255.255.0 10.108.1.52
ip route 10.108.20.0 255.255.255.0 10.108.1.51

10.108.1.51

hostname "AnOfSw51"
max-vlans 10
module 2 type J4820B
module 3 type J4820B
module 4 type J4820B
module 5 type J4820B
module 1 type J4907A
module 6 type J4820B
module 7 type J4820B
ip default-gateway 10.108.1.254
sntp server 10.108.1.253
ip routing
ip udp-bcast-forward
timesync sntp
sntp unicast
vlan 1
name "DEFAULT_VLAN"
untagged A1-A16,B1,B3-B10,B13-B24,C1-C24,D1-D14,D16-D24,E1-E6,E8-E24,F1-F24,G
1-G5,G7-G11,G13-G24
ip address 10.108.1.51 255.255.240.0
no untagged B2,B11-B12,D15,E7,G6,G12
exit
vlan 2
name "IS_Test"
untagged B12
ip address 10.108.17.1 255.255.255.192
ip helper-address 10.108.1.5
tagged B11
ip igmp
exit
vlan 4
name "LUCI_VLAN"
untagged G12
ip address 10.108.20.1 255.255.255.192
ip helper-address 10.108.1.5
ip helper-address 10.108.1.6
exit
vlan 5
name "DMZ_VLAN1"
untagged B2,E7,G6
ip address 10.108.17.105 255.255.255.248
ip helper-address 10.108.1.6
ip helper-address 10.108.1.5
exit
vlan 3
name "Forestry"
untagged D15
ip address 10.108.18.65 255.255.255.192
ip helper-address 10.108.1.5
ip helper-address 10.108.1.6
exit
ip route 0.0.0.0 0.0.0.0 10.108.1.254
spanning-tree




10.108.1.52

hostname "AnOfSw52"
module 1 type J4907A
module 2 type J4820B
module 3 type J4820B
module 4 type J4820B
module 5 type J4820B
module 6 type J4820B
ip default-gateway 10.108.1.254
sntp server 10.108.1.253
ip routing
ip udp-bcast-forward
timesync sntp
sntp unicast
vlan 1
name "DEFAULT_VLAN"
untagged A1-A16,B8-B9,B11,B18,B20,C1-C24,D1-D24,E1-E6,E9-E11,E13-E24,F1-F24
ip address 10.108.1.52 255.255.240.0
no untagged B1-B7,B10,B12-B17,B19,B21-B24,E7-E8,E12
exit
vlan 2
name "IS_Test"
untagged E7-E8,E12
ip address 10.108.18.1 255.255.255.224
ip helper-address 10.108.1.5
ip helper-address 10.108.1.6
exit
vlan 3
name "HR_Vlan"
untagged B1-B7,B10,B12-B17,B19,B21-B24
ip address 10.108.16.65 255.255.255.224
ip helper-address 10.108.1.5
ip helper-address 10.108.1.6
ip helper-address 10.108.1.10
exit
vlan 4
name "DMZ_VLAN2"
ip address 10.108.16.105 255.255.255.248
ip helper-address 10.108.1.6
ip helper-address 10.108.1.5
exit
ip route 0.0.0.0 0.0.0.0 10.108.1.254
spanning-tree

[Mohieddin Kharnoub]

Hi

You have a Router connected to AnOfSw52, and this switch connected to AnOfSw51, the connection is on port A2 which is untagged to the default_vlan on both switches.
This means, no other than Vlan1 traffic can cross this link.

I guess what you should do, is disable UDP broadcast forwarding on both routing switches

Read this:
http://support.microsoft.com/kb/q190930/
http://support.microsoft.com/kb/135464/EN-US/

Let us know the situation.

Good Luck !!!

[FlyFast]

Thanks for the information, I will take a look at it. For the 5308 switches connected by ports A2, should I set these to "Tagged" so other traffic can cross this link?

[FlyFast]

Well, after trying some additional configurations, I move my test vlan off blade E and onto blade C. I then moved a port into my test vlan and I am now able to browse AD. So, I am trying to figure out what would be different with blade E? What would cause this issue. The vlan config is the same, just on a different blade.

[Mohieddin Kharnoub]

Hi

Check Microsoft article in the link i gave you, and see what Operating System you have on the non-working blade.

Good Luck !!!

[André Beck]

Hi,

> Well, after trying some additional
> configurations, I move my test vlan off
> blade E and onto blade C. I then moved a
> port into my test vlan and I am now able
> to browse AD. So, I am trying to figure
> out what would be different with blade E?

Maybe nothing. Sometimes you just find out you had something configured the wrong way on the first try. Did you try to move it back?

> What would cause this issue. The vlan
> config is the same, just on a different
> blade.

On the 5300xl platform, it's entirely possible you might have a broken module. As the backplane is mostly passive, broken modules can make all sorts of strange problems that might be local to that module or might span the chassis. Once I had a module that would work well in most respects but failed to establish OSPF adjacencies that happened to go through it...

I'd check firmware level, reload the switch, reseat the module and if the problem persists through all these steps, try to swap the module with another one of the same type. Either the error stays with the module (so RMA the module) or it stays with slot E (so RMA the chassis).