5300xl Switch, VLANS and Routing

[Andrew Davenport]

Hi All,

Having a few problems and need some help!
Configuring VLANS on the 5300xl with a port trunked to a Sonicwall Pro 4060 providing routing and firewalling between VLANS. It all seems to be working fine however there appears to be some problems with comms from one VLAN to another. Principally clients on VLAN6 have problems staying connected to the exchange cluster on VLAN5. The outlook client switches to disconnected, if you change the folder you are looking at or reconnect it work immediately then later disconnects again.
You can ping the servers, tracert to them and even browse them but outlook will not stay connected on any other VLAN.
We have tried swapping the Sonicwall out for a Linux box instead and the same happens.
Any idea?
Latest firmware on all devices btw and the servers are all HP Proliant DL380s.

[Sergej Gurenko]

Enable routing on the 5300xl (just add appropriate addresses to the VLAN interfaces) and try one more time. This is definitely not HP Procurve problem.
I think it can be an MTU or advanced RPC inspection handling problem. Enabling SSL security (somewhere under Outlook connection properties) will give a temporary fix.

P.S. Putting FW between clients and server will give you more pain than benefits.

[Andrew Davenport]

Hi,

Thanks for the quick reply.
I have tried to enable the routing on the switch but i am not sure if i did it right.
At the moment there is an IP address on each interface on the sonicwall for each VLAN, all clients/servers on each VLAN use these addresses as their default gateways.
Do i leave these addresses there, add addresses to the VLANS on the switch and enable IP routing and it all works or will i need to change the addresses on the firewall?
The MTU size was a question that came to light, we can change this on the firewall, can it be changed on the switch?
We have to have the firewall in place do to the structure of the companys in question, they are a group but cannot be able to see each other on the LAN.
Maybe you could give me a brief step by step on enabling the ip routing so i get it right.
at the moment on the firewall we have..
VLAN1 (not used) 192.168.100.254
VLAN2 lan1 192.168.2.254
VLAN3 lan2 192.168.3.254
VLAN4 lan3 192.168.4.254
VLAN5 data centre 192.168.1.254
VLAN6 old lan 192.168.101.252

The switch has the ports assigned to the lans as appropriate and the defaut VLAN has ip address 192.168.100.1 dg=192.168.100.254

[Sergej Gurenko]

Just add an IP address to each VLAN (this will be a default dateway for VLAN attached hosts)

Connect Firewall to the special point-to-point VLAN (subnet). Only two IP addrese configured there: first the 5300xl second you firewall inside address.

Add default route towards FW on the 5300xl.
Add subnet routes toward 5300xl on the FW.

[Andrew Davenport]

Ok i understand some of that.
Can i just ask for clarification on something.
Lets say i use port A1 to connect to the firewall, do i have to make this a trunk port with all VLANS added?
As far as the IP Address on the firewall and switch is concerned do i configure this on the default VLAN or on one of the other VLANS, or would you advise to make a special VLAN to handle this?

[Sergej Gurenko]

Rote all internal VLANs on the 5300. Route the internet on the FW.
You do not need Q-trunk from FW to 5300