8212zl IP Routing setup

[Ron Havlen]

Pieter, I've slowly started working on setting the IP addresses in my default_vlan. My original one was 172.29.190.100. I've added 199.199.190.100 as a secondary. For now I have not turned on IP routing, want to make sure I have things correct.
If I show ip it shows both address with correct subnet mask as manual for default_vlan. Currently, my original address of 172.29.190.100 shows No under Proxy and No under ARP. My new address of 199.199.190.100 does not show anything in these columns, and I'm wondering if it is supposed to.
I have added a static ip route of 0.0.0.0/0 172.29.199.254. It is my understanding that my current default gateway only functions when the switch is in Layer 2 mode, and will not work when in Layer 3. Therefore, I am reading that I had to put this static route in before I turne on IP routing.
This static route is supposed to take anything that does not match the two subnets we are planning on routing in the switch and sends them to this address which is one of the LAN addresses on my Sonicwall. I'm wondering if this is the only static entry I need to make.

I just want to be sure I have everything right, so at the moment I have found that as soon as I added the 199.199.190.100 address to the switch, I lost my telnet connection to the switch, and cannot get it back from my current machine. I experimented both with telnet and a browser in the following fashion.
The switch original IP is 172.29.190.100, the IP address of my computer is 199.199.0.8, with a gateway of 199.199.199.254, my sonicwall router in this subnet. If I try to attach to the switch with address 199.199.190.100, it works perfectly.
To further experiment, I used another machine, and set it to a static address of 172.29.63.100, just somewhere in the 172.29.x.x address range. With a gateway of 172.29.199.254, the address of my sonicwall router. If I attach to 172.29.190.100 it connects to the switch perfectly. But does not at all to 199.199.190.100. However, if I change the gateway to 172.29.190.100, the switch address, then I can connect to 199.199.190.100, even though IP routing is not yet enabled. However, I do not then connect to the internet, which I suspect is correct.

My question here, is this supposed to work this way as I currently am without IP routing enabled? I'm just taking it one step at a time. I want to be sure I am correct leading up to turning on IP routing.

thanks for all your help.
Ron

[Pieter 't Hart]

>>> I have added a static ip route of 0.0.0.0/0 172.29.199.254. It is my understanding that my current default gateway only functions when the switch is in Layer 2 mode, and will not work when in Layer 3. Therefore, I am reading that I had to put this static route in before I turn on IP routing <<<

Yes the statement "ip default-gateway" just has no function with "ip routing" enabled.
you must use the "ip route 0.0.0.0 ..." statement instead (to reach the same â default-gatewayâ ).
The default-gateway statement was ment to reach the management ip-adress of the switch from other subnets, not for any routing functionality on other hostst in the network!

==========
>>> I'm wondering if this is the only static entry I need to make. <<<
Yes this time it is the only static needed.
The other two subnets used are â directly connectedâ to the switch with two ip-adresses and the switch will not use a gateway for this.

==========
>>> I just want to be sure I have everything right, so at the moment I have found that as soon as I added the 199.199.190.100 address to the switch, I lost my telnet connection to the switch, and cannot get it back from my current machine. <<<

When adding the 199.199.190.100 address to the switch, the switch and your workstation should be in the same subnet and should be able to communicate directly without any router. Check if both devices use the same subnet mask.
Of course the current session was set up using the router and you must set up a new connection to access the switch directly. Maybe you need to clear the arp-cache of your workstation.
try "tracert

" to check if the direct path to the switch is chosen.

==========
>>> To further experiment, I used another machine, and set it to a static address of 172.29.63.100, just somewhere in the 172.29.x.x address range. With a gateway of 172.29.199.254, the address of my sonicwall router. If I attach to 172.29.190.100 it connects to the switch perfectly. But does not at all to 199.199.190.100. However, if I change the gateway to 172.29.190.100, the switch address, then I can connect to 199.199.190.100, even though IP routing is not yet enabled. However, I do not then connect to the internet, which I suspect is correct.<<<

I assume the sonicwall is not just a router but is a firewall?, you may need to adjust some rules to enable access?

==========
>>> My question here, is this supposed to work this way as I currently am without IP routing enabled? I'm just taking it one step at a time. I want to be sure I am correct leading up to turning on IP routing<<<

Enabling ip routing on the switch only has effect on hosts that have the switch configured as gateway, and for management access to the switch.
The switch will still forward traffic adressed to the sonicwall (as router) on L2.
So this will not interfere with other communication that uses the sonicwall as a router.

regards,
Pieter

[Ron Havlen]

Thank you Pieter. I believe that clears up any concerns I had expressed. One more question before I actually turn on IP routing, which I think you have almost answered.

I have a couple other Vlans on this switch, which do not have IP addresses.

One Vlan is the MSM765zl management Vlan, which is how the controller manages all the MSM422 access points. No IP address on this vlan.

Two other vlans I have are meant to direct traffic specifically to one of two paths to the internet, and not touch any of my network at all.

One vlan is tied by ports to all the MSM422 units, for a specific ssid that gets directly to my secondary ISP, an untagged port on the switch for this vlan only. The other vlan ties to the ports and AP's that are in a specific area where we lease the space to another party. This vlan goes to a specific port on my Sonicwall, and then to the internet, it is not routed back to my network, even by my firewall.
These vlans do not have IP addresses.

Do you see any affect of turning IP routing on, with this information, on these other vlans?

If not, then I'll be turning IP routing on very soon.

Thank you for your help.

Ron

[Pieter 't Hart]

If the switch has no interface (ip-adress) in a vlan, it willnot/cannot route traffic from/to other vlans.
Only L2 forwarding within this vlan will be done. Just as this vlan is a separate network.
So a vlan where the switch has no interface will behave as before ip routing is enabled.

[Ron Havlen]

Pieter, I have enabled IP routing on my switch. As you said, it didn't affect anything adversely.
However, at this point, it doesn't seem to be working properly. If I take a test client, and give it a static ip within either range, and then the appropriate gateway address, the client can ping anywhere on both subnets. However, it is unable to run or find anything else.

For example, my 8212 main ip address is 172.29.190.100, which is within the 172.29.x.x/16 bit subnet. My second ip address on the 8212 is 199.199.190.100 which is in the 199.199.x.x/16 subnet.

If I set a client for 172.29.63.10, for example, with the gateway of 172.29.190.100, I can ping pretty much anywhere on both subnets.
However, if I want to run an application, or browse, I get nothing. As an example, I have a citrix server on 199.199.50.101. From the above configured client, even though I can ping that server, I cannot connect to citrix. I have a sharepoint services server on 199.199.199.248. Again, I cannot access sharepoint. Even a simple file share on a server in the other subnet is inaccessible.

Also, the internet is inaccessible, even though my default gateway on the switch for vlan 1 points to the ip address of the sonicwall router that is within this same subnet.
That is, my static ip route of 0.0.0.0/0 points to 172.29.199.254, which is my sonicwall router, which should take it to the internet. Get nothing.

So even though I have enabled IP routing, I have not been successful in getting traffic other than ping to cross between the two subnets, nor to the internet.

As you stated, all the clients are still pointing thier gateways to the sonicwall router, so no one is noticing. So if you have a suggestion for getting the two subnets to cross and get to the internet through my sonicwall router, I'd appreciate it.
Thanks for all your help so far.

Ron

[Ron Havlen]

Pieter, I've managed to get my test machine to get to the internet, though not the other subnet of my multinetted vlan.
I looked through the docs, and turned on RIP, turned on ICMP. Not sure if that helped.

In looking through the docs, there is a piece that makes me wonder if I shouldn't be adding a couple static routes to the switch. In the docs, it tells us that when we turn on IP routing, that the default gateway of the switch stops working, so we should add a static ip route to the switch.

The only static IP route I added to the switch was 0.0.0.0/0 172.29.199.254, which was to say that anything not on my subnets route to this address on my sonicwall router.
If I show ip route, I currently also see 199.199.0.0 with a gateway of default_vlan, and 172.29.0.0 with a gateway of default_vlan.

Should I make a static route of 172.29.0.0/16 172.29.190.100, and a route of 199.199.0.0/16 199.199.190.100?

These would have the networks point to a gateway of thier own ip address of the vlan. Or would it then suddenly develop an infinite loop and crash the switch?

Not sure what I need to do to have both subnets on the default_vlan see each other totally.

Ron

[Pieter 't Hart]

look at my post Oct 6, 2010 07:12:34 GMT Unassigned

--------------------------------------------------------------------------------
Yes the statement "ip default-gateway" just has no function with "ip routing" enabled.
you must use the "ip route 0.0.0.0 ..." statement instead (to reach the same default-gateway).
The default-gateway statement was ment to reach the management ip-adress of the switch from other subnets, not for any routing functionality on other hostst in the network!
<<<
in the same post :
>>>
The other two subnets used are "directly connected" to the switch with two ip-adresses and the switch will not need/use a gateway for this.

[Pieter 't Hart]

remeber the sonicwall does more than just routing!

what i think happens is:
imagine host-1 (172 with gateway to switch)
and host-2 (199 with gateway to sonicwall)

host-1 sends packets to host-2
it does this by using it's default-gateway (the switch)
the switch forwards packets to host-2
host-2 sends packets back
but does this using the sonicwall as gateway!

the sonicwall does not know there was no session active from host-1 to host-2 (using the switch)
and (as its a firewall) won't forward packets back from host-2 to host-1
=> check logfiles of sonicwall for dropped traffic to confirm this

[Ron Havlen]

That makes perfect sense. I'm going to experiment with a second client configured on the other subnet, with the switch as the gateway.
It looks like if I want to migrate slowly, I'll have to figure out how to make the Sonicwall "see" the other traffic as valid, and forward it back.

Thank you for all your help. I'm going to continue on, and see where this takes me.

Ron

[Pieter 't Hart]

Ron,
Good luck with the project
thanks for the points,
Pieter