Skip to ContentSkip to Footer
Start of content
- Community Home
- >
- Networking
- >
- Legacy
- >
- Switches, Hubs, Modems
- >
- Firewall and routing between VLANS...
Switches, Hubs, and Modems
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
-
-
Categories
- Topics
- Hybrid IT with Cloud
- Mobile & IoT
- IT for Data & Analytics
- Transformation
- Strategy and Technology
- Products
- Cloud
- Integrated Systems
- Networking
- Servers and Operating Systems
- Services
- Storage
- Company
- Events
- Partner Solutions and Certifications
- Welcome
- Welcome
- Announcements
- Tips and Tricks
- Feedback
-
Blogs
- Alliances
- Around the Storage Block
- Behind the scenes @ Labs
- Converged Data Center Infrastructure
- Digital Transformation
- Grounded in the Cloud
- HPE Careers
- HPE Storage Tech Insiders
- Infrastructure Insights
- Inspiring Progress
- Internet of Things (IoT)
- My Learning Certification
- Networking
- OEM Solutions
- Servers: The Right Compute
- Telecom IQ
- Transforming IT
-
Quick Links
- Community
- Getting Started
- FAQ
- Ranking Overview
- Rules of Participation
- Contact
- Email us
- Tell us what you think
- Information Libraries
- Integrated Systems
- Networking
- Servers
- Storage
- Other HPE Sites
- Support Center
- Enterprise.nxt
- Marketplace
- Aruba Airheads Community
-
Categories
-
Forums
-
Blogs
-
InformationEnglish
Firewall and routing between VLANS...
Topic Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
12-27-2006 04:03 PM
12-27-2006 04:03 PM
Firewall and routing between VLANS...
Firewall and routing between VLANS...
Hi -
Here is the issue. We have one HP 5308XL switch that is now basically in the out of the box configuration (no VLANS configured). connected to the switch are three subnets (10.109.x.x/16, 10.100.x.x/16, 10.101.x.x/16). Routing currently is achieved via a Novell Border Manager firewall that holds the gateway IP's on the private interface for the three subnets of 10.109.0.1, 10.101.0.1, and 10.100.0.1. All workstations have set as their DNS server the IP of 10.100.0.1 and their default gateway is set to the IP of the respective subnet on the Border Manager firewall. The Border Manager firewall on the public interface has an address (part of a class C range) assigned to us by the ISP. The default route that is set points to the ISP's router IP. And with this things work ok (NAT is enabled).
Now the plan is to try out VLANS and do routing between them by breaking up the ports that are connected to the three subnets. I created 3 VLANS in addition to the default VLAN and assigned the ports as untagged to the proper VLAN name (VLAN 101, VLAN 109, VLAN 100). The VLAN IP for 101 and 109 was assigned the gateway IP address that was on the Border Manager machine originally - VLAN 100 was assigned an IP of 10.100.0.10. The Border Manager machine was in VLAN 100 and the IP address of 10.100.0.1 syated on the Border Manager machine.
Routing was enabled and I was able to ping other workstations in other VLANS with no problem but I could not ping the 10.100.0.1 firewall address in VLAN 100. I tried creating static routes on the border manager box to point back to the respective VLANS and that did not make any difference. What did work for the Border Manager box as far as pinging was to change the default route from the ISP's router to the IP address assigned to VLAN 100 (10.100.0.10).
The deal was to try and not have to reconfigure the workstations in the 109 and 101 VLANS and have internet work. For the 100 VLAN the default gateway has to be changed but the amount of machines was minimal so that was ok to do. It seems like what I am trying to do though is not realistic so what does have to be done to the workstations in terms of DNS or default gateway settings to make this work? What about the Border Manager machine in terms of static and default routes?
Any info would be helpful - thanks....
Here is the issue. We have one HP 5308XL switch that is now basically in the out of the box configuration (no VLANS configured). connected to the switch are three subnets (10.109.x.x/16, 10.100.x.x/16, 10.101.x.x/16). Routing currently is achieved via a Novell Border Manager firewall that holds the gateway IP's on the private interface for the three subnets of 10.109.0.1, 10.101.0.1, and 10.100.0.1. All workstations have set as their DNS server the IP of 10.100.0.1 and their default gateway is set to the IP of the respective subnet on the Border Manager firewall. The Border Manager firewall on the public interface has an address (part of a class C range) assigned to us by the ISP. The default route that is set points to the ISP's router IP. And with this things work ok (NAT is enabled).
Now the plan is to try out VLANS and do routing between them by breaking up the ports that are connected to the three subnets. I created 3 VLANS in addition to the default VLAN and assigned the ports as untagged to the proper VLAN name (VLAN 101, VLAN 109, VLAN 100). The VLAN IP for 101 and 109 was assigned the gateway IP address that was on the Border Manager machine originally - VLAN 100 was assigned an IP of 10.100.0.10. The Border Manager machine was in VLAN 100 and the IP address of 10.100.0.1 syated on the Border Manager machine.
Routing was enabled and I was able to ping other workstations in other VLANS with no problem but I could not ping the 10.100.0.1 firewall address in VLAN 100. I tried creating static routes on the border manager box to point back to the respective VLANS and that did not make any difference. What did work for the Border Manager box as far as pinging was to change the default route from the ISP's router to the IP address assigned to VLAN 100 (10.100.0.10).
The deal was to try and not have to reconfigure the workstations in the 109 and 101 VLANS and have internet work. For the 100 VLAN the default gateway has to be changed but the amount of machines was minimal so that was ok to do. It seems like what I am trying to do though is not realistic so what does have to be done to the workstations in terms of DNS or default gateway settings to make this work? What about the Border Manager machine in terms of static and default routes?
Any info would be helpful - thanks....
1 REPLY
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
01-04-2007 01:34 AM
01-04-2007 01:34 AM
Re: Firewall and routing between VLANS...
Re: Firewall and routing between VLANS...
I assume we have:
ISP -- ISP RTR --Firewall -100-Switch -109/-101.
Your DNS is probably not happy because it is trying to use the Firewall as its default route and thus can't get back to the two vlans since the firewall does not want to play router. On the DNS you should add two static routes for the other Vlans and keep the default route pointing to the firewall.
The default route on the firewall should remain pointed at the ISP Router since that is where the internet is. The switch's default route: 0.0.0.0 0.0.0.0 should point at the firewall. It will not need any other routes. (If you log into it and do
sh ip route
you should see a route for each of the three subnets listed as connected and then the default route. The default gateway command is only used when ip routing is not turned on and is only used so that when you telnet it to it from somewhere else that it can get back to you)
Firewalls need to know about subnets that are on the good side but not directly connected. Usually this is done with a static route on the firewall. In each case this should point to the VLAN100 address of the switch.
You shouldn't have to make any changes to PCs on the 101/109 LANs.
Ron
PS. If you want to send me your config for the firewall directly rather than post it for all to see I'll be glad to look at it. rkinner AT att DOT net - put HP in the subject so I'll know it's not spam.
ISP -- ISP RTR --Firewall -100-Switch -109/-101.
Your DNS is probably not happy because it is trying to use the Firewall as its default route and thus can't get back to the two vlans since the firewall does not want to play router. On the DNS you should add two static routes for the other Vlans and keep the default route pointing to the firewall.
The default route on the firewall should remain pointed at the ISP Router since that is where the internet is. The switch's default route: 0.0.0.0 0.0.0.0 should point at the firewall. It will not need any other routes. (If you log into it and do
sh ip route
you should see a route for each of the three subnets listed as connected and then the default route. The default gateway command is only used when ip routing is not turned on and is only used so that when you telnet it to it from somewhere else that it can get back to you)
Firewalls need to know about subnets that are on the good side but not directly connected. Usually this is done with a static route on the firewall. In each case this should point to the VLAN100 address of the switch.
You shouldn't have to make any changes to PCs on the 101/109 LANs.
Ron
PS. If you want to send me your config for the firewall directly rather than post it for all to see I'll be glad to look at it. rkinner AT att DOT net - put HP in the subject so I'll know it's not spam.
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.
End of content
United States
Hewlett Packard Enterprise International
Communities
- Communities
- HPE Blogs and Forum
© Copyright 2018 Hewlett Packard Enterprise Development LP