Confusion configuring Vlan on procurve 1800-24G

[Jeremy Neufeld]

I have a Procurve 1800-24G switch. All my traffic is currently on the default Vlan 1. I have a server on port 14 I would like to have on Vlan 1 and Vlan 2. A server on port 16 should be only on Vlan 2. Essentially I'm trying to isolate the traffic between these two servers but yet have the rest of the network still have access to the first server attached to port 14.

I set up Vlan 2 and added both ports 14 & 16 to the Vlan config. I then went and removed port 16 from Vlan 1 and left port 14 in it. The problem is that I am unable to communicate between these two servers with this configuration.

When I make changes to the Vlan port config I seem to either loose connectivity to the server on port 14 from the rest of the network or I am unable to communicate between the two servers on Vlan 2. I've played around with the Packet type settings as well as the PVID settings but it seems that nothing is working.

What is the correct configuration in this type of setup so that communication to the server on port 14 is uninterrupted but yet only the server on port 14 can communicate with the server on port 16?

I've attached the config file, if that will help things make better sense.

Thanks for your assistance.

[Ezugo]

Create a trunk between the 2 vlans to allow communication

[Jeremy Neufeld]

I created a Trunk (T1) and added port 14 & 16 into it. I lost connectivity between all the other ports and port 14. Am I missing something here that needs to be done?

[Drew Redman]

Trunking on Procurve switches is link aggregation.. you don't want that.

NICs typically only operate on untagged vlans. In order to do want you want to do, you'll need a vlan-aware NIC in the server that's on port 14.

Otherwise, the server is not going to be able to communicate on two vlans simultaneously.

[Pieter 't Hart]

Ezugo's suggestion won't work
As drew said trunk on procurve is link agregation, and is used to have multiple physical links between two devices act as a single link.
So it wont do any good between the switch and two different servers!

Drew's suggestion to make the server on port-14 vlan-aware is a path to go.
other option is two NIC's each connected to a switchport with a different PVID.

The adresses on the NIC's (physical or vlan) need to lay in different subnets!
else the server doesn't know wich NIC to use when communicating with the other server or the clients.

[dave livingston_1]

I have tried the same thing with my Procurve 1800-24G and have come to the conclusion that something is broken within the Procurve.

The configuration outlined is classic use of PORT based VLANS for containing a broadcast domain. With PORT VLAN, the switch will send the packet that it receives on a port to the other ports that are part of the VLAN memberhsip.

In the example:
VLAN1
Port 16 Server1
Port 1 Laptop1
Port 2 Laptop2
Port 3 Laptop3
VLAN2
Port 16 Server1
Port 14 Server2

From my understanding of PORT VLAN:
1. a packet received on Port 1 will be sent to the ports that are members of VLAN1, ports 16,2 & 3. It would not be sent to port 14.
2. A packet from port 16 will be sent to both port 1,2,3 and port 14 since that port has membership in two VLANS.
3. A packet from port 14 will only be sent to port 16, since those are the only two ports in the VLAN.

After virtually the same amount of research, I do not think that Procurve 1800 only supports 802.1(Tagged) VLAN and not Port.

Adding another NIC to the server is not an acceptable answer. This is a simple network configuration, and a switch should be able to accomodate it.

[Pieter 't Hart]

>>>
2. A packet from port 16 will be sent to both port 1,2,3 and port 14 since that port has membership in two VLANS.
<<<

Dave, you misunderstand the mechanism of vlans.
Each packet is only sent to a single vlan!

At first : a packet "originates" in a certain vlan and will first be processed in this vlan.
If you got a standard server NIC, that is not vlan-aware the packet is sent without a vlan-id (vlan-tag).
The packet is recieved at the switchport and handled as addressed in the default/private/untagged vlan configured for this port .
Only a single vlan can be untagged/default/private vlan.
Default this is vlan1.

It will NOT be sent to the other vlans where the port is a tagged member!
Only tagged packets are forwarded to the corresponding vlan where the port is a tagged member.

results :
- an untagged packet from port 16 may be sent to both ports 1,2,3. (vlan-1)
as the switch maintains a mac-address table, the port that actually receives the packet will only be the one where the connected device has the correct mac-address!

if the connected device can send a vlan-tagged packets (switch or vlan aware-network driver) also :
- a vlan-1 tagged packet from port 16 may also be sent to both port 1,2,3.
- a vlan- tagged packet from port 16 will be forwarded to port 14.

(with the same restriction about mac-adresses).


After this process comes a next step.
if a tcp/ip packet needs to be transferred to another subnet, then a router may forward the packet to another subnet (commonly in another vlan).

[JokeJong]

Simple.. i used it and i played with the config, i seem to figure out the solution..

the problem is that in VLAN port config, VLAN AWARE ENABLED checkboxes are ticked..

untick all of them, and VIOLA.. your PVID works like magic.