New VLAN & Router Setup on 5308xl

[Forrest Baker]

A little more information on our network topology, the 5308 server room switch has a trunked fiber connection down to our basement MDF 4208 switch.

All desktop switches connect back to this 4208vl switch. There is currently no port or switch control over IPs within a subnet for lab computers connect to a certain switch. It is a mixed environment.

Forrest

[Marco Wessel]

No, the A1 port can be simply untagged in all cases. In the separate vlan case, just put in in vlan 201 (or something that makes more sense for you) and make it the only port in that vlan. Then, assign an IP to the vlan and set the default route to the cisco.

Unless you enable RIP on the cisco as well, you need not run RIP on the 5308. Running RIP on both will make sure that all routes are available on both boxes. If you make the cisco originate a default route you don't even need to tell the 5308 about that.

As for the multiple vlan deal, this is wat 802.1q, or vlan tagging, is for. As I said before, you can put one port (or aggregated group of ports) in multiple vlans using tags. The switch will, before sending a frame out that port, insert a tag in the frame so the receiving end will know what vlan the frame belongs to. This is what's really called a trunk. (That 'other' trunk is actually called link aggregation, which is the exact opposite of real trunking and a very unfortunate misnomer.)

Think of a vlan trunk as having a really fat cable with, in this case, 256 individual fiber pairs in it. Each of those can be used to carry exactly one vlan. Of course in reality, there's only one fiber pair, the maximum number of vlans is 4096 and with double tagging more than one vlan can be carried per pair, but on a logical level that's essentially what's happening. (And you now see why link aggregation is the /exact/ opposite of trunking: multiple channels over one physical connection vs. one channel over multiple physical connections.)

So as a real-life example, a quick snippet from one of my switches (a 4204vl):
vlan 300
name "BeganeGrond"
no ip address
tagged A19,B23-B24
exit
vlan 500
name "kpnodsl"
untagged B19-B20
tagged A19,B23-B24
exit
vlan 400
name "Z&J"
untagged B5
tagged B23-B24
exit

On port B23 is an Alteon that I use for routing, port B24 connects to a 6108 for servers and A19 is my desktop. Any other ports mentioned have random things on them. Tagged ports don't have any untagged vlans.

Up here I have three VLANs. One, vlan 300, only has tagged ports because really it's only passed through to the other switches (and my desktop, which is a special case) Notice that vlan 500 has exactly the same tagged ports: this vlan is available on the alteon, 6108 and at my desktop as well. Vlan 400 is available on the other switches but not at my desktop. So there be three vlans, each sharing a bunch of ports. (And there are more of those, of course.)

Two of the VLANs also have untagged ports. This is where regular computers and such connect. B5 is in vlan 400 and B19 and B20 are in vlan 500. So if a computer were to be connected to those ports, it'd end up in those vlans. If a computer were to be connected to any of the tagged ports above, not much would happen because I didn't set up any untagged vlans and the computers don't generate frames with tags in them (with, again, the exception of my desktop.)

So you should set the ports that connect your switches to eachother as tagged members of all vlans. Then, set the ports that computers connect to as untagged members of the appropriate vlans.

Treat the cisco as a computer: untagged in its vlan.

[Forrest Baker]

Thank you Marco - your explanation and example was a great help. I think the tagging all makes sense now - I'll start testing it.
A couple quick follow-up questions:

- the IP address of the separate cisco VLAN, untagged A1 port, will be from a separate 201 network - the same network as the IP assigned to the cisco router interface. Should I assign 201.1 (as a gateway for that network) to the VLAN201 on the 5308 or to the Cisco router interface? or does it matter?

- then should I set the 5308 default route to the VLAN201 IP address or to the cisco interface IP address?

- and same for the cisco router, should the route go back to the VLAN201 IP or to the 200 IP address of the 5308 switch?

Thanks a million!
Forrest

[Marco Wessel]

> the IP address of the separate cisco VLAN, untagged A1 port, will be from a separate 201 network - the same network as the IP assigned to the cisco router interface. Should I assign 201.1 (as a gateway for that network) to the VLAN201 on the 5308 or to the Cisco router interface? or does it matter?

Doesn't matter, really. It's just a number, so whatever makes the most sense to you. I've seen situations where they standardized on having the lowest number the closest to their border routers, or whatever. You might also just want all the .1s on your 5308, etc.

> then should I set the 5308 default route to the VLAN201 IP address or to the cisco interface IP address?

To whatever the ip on the actual cisco is. You're telling it, 'for any destination you don't know, send the packets to this box over here at this IP address'.

> and same for the cisco router, should the route go back to the VLAN201 IP or to the 200 IP address of the 5308 switch?

You should set a route for your entire network (that is, the full subnet you've been allocated) to the HP's 201 addy. So for example if you were to have been allocated an entire /16 out of 10.0.0.0/8, you might tell it that it can reach all of 10.0.0.0/16 at 10.0.201.1. It'll have a more specific route for that 201 subnet which is directly connected, so you don't have to make an exception for it or anything.

[Forrest Baker]

Thanks again Marco - that's cleared up then.

However, I now have my test environment running to mirror our production environment and I'm not able to route between subnets. Here is the config of my 5308:

; J4819A Configuration Editor; Created on release #E.11.03

hostname "HP Procurve Switch 5308XL"
max-vlans 256
vlan 1
name "VLAN200"
untagged A2-A15,B1-B24,C1-C4,D1-D24,E1-E24,F1-F24,G1-G4,H1-H24
ip address 134.39.200.1 255.255.255.0
tagged A16
no untagged A1
exit
vlan 10
name "VLAN186"
ip address 134.39.186.1 255.255.255.0
tagged A16
exit
vlan 20
name "VLAN187"
ip address 134.39.187.1 255.255.255.0
tagged A16
exit
vlan 100
name "Cisco-Uplink"
untagged A1
ip address 134.39.201.1 255.255.255.0
exit
qos protocol IP priority 7
ip route 0.0.0.0 0.0.0.0 134.39.201.2

********************
The 5308 port A1 is the Cisco uplink and port A16 is tagged for the multiple VLANs. I have a HP 4000 switch with a 200 IP address connected to 5308 port A7. The switches can ping each other, both in the 200 network, but the 186 and 187 computers connected to the 4000 cannot ping each other or the switch or the VLAN ip. What am I missing?

When the VLAN routing worked before, I believe the 186 and 187 networks showed in the route table. Here is what I show for ip routes:

Destination Gateway VLAN Type Sub-Type Metric Dist.
------------------ --------------- ---- --------- ---------- ---------- -----
127.0.0.0/8 reject static 0 250
127.0.0.1/32 lo0 connected 0 0
134.39.200.0/24 VLAN200 1 connected 0 0

******************
Thanks again

[Marco Wessel]

The 4000M is connected to A7? According to your config that should be A16. And IP routing isn't enabled in that bit of the config at least.

[Marco Wessel]

Also, if the VLAN doesn't have any ports that are up, the vlan itself will be down also. So if A16 isn't connected to anything and it's the only port in a vlan, the vlan will be down.

[Forrest Baker]

That's true, I had the 4000M connection to A16 but couldn't ping anything - when I moved it to the untagged VLAN200 port A7, I could. But, it is back in A16 and that port is up.
What is a good way to test subnet routing?
Because I have have a 186 computer and 187 computer connected to the 4000M switch and I can't ping the 4000M 200 IP address, and I can't ping the 186 gateway address on the 5308 switch.

From the 5308 switch I can ping all the subnet VLAN IPs of course, but not the 4000M switch or any computer.

Do I need more then the one static route out to the Cisco configured on the 5308 to handle subnet routing?

[Forrest Baker]

I do see all the ip routes now with the 4000M connected to A16 on the 5308 and all VLANs tagging that port:

134.39.200.0/24 VLAN200 1 connected
134.39.186.0/24 VLAN186 1 connected
134.39.187.0/24 VLAN187 1 connected

But clients from the various subnets connected to the 4000M cannot see anything else on the network.

[Marco Wessel]

the 4000M of course needs the port with which it is connected to the 5308 to be set with the same vlan tags as the 5308. If you had been connecting it to an untagged port before and that worked, it likely isn't configured correctly.