Setting up VLANs on 5308XL

[Gerrard Shaw]

Hi,

I'm working on a server project at work at the moment and we're just configuring the ProCurve switch with VLANs - hopefully as follows...

- most servers left on the default VLAN with IP addresses 192.168.88.x
- 2 fiber channels that communicate between our NAS boxes with IP addresses 172.168.89.x
- 3 Heartbeat connections for our Exchange Cluster with IP addresses 172.16.88.x

My question is that if we set up the 2 static VLANs in addition to the default one and set the ports as Untagged (same as on the default VLAN settings) will that seperate the traffic e.g. packets going between the NAS devices won't be transmitted to the main servers etc?

We tried testing that theory out before with a 192.168.88.x address on one of the new VLANs and tried a ping to another 192.168.88.x address on the other new VLAN. THe ping was successful - is that normal operation as I wondered if they should be able to "see" each other?

Sorry if this might sound a bit basic but I#m only 19 and in the last few weeks have installed all the rackmount kit, re-configured our SCSI arrays on the NAS box and am currently having "fun" with Clustering!

Thanks in advance,

Gerrard Shaw,
Network Technician,
Redbridge Institute of Adult Education

[Matt Hobbs · Accepted solution]

Hi Gerrard,

Sounds like you're having fun there...

When setting VLANs on the switch you are limiting the broadcast domain. So if you have 2 port-based VLANs set on the switch, 192.168.88.1/24 and 172.16.88.1/24, then these two networks will not be able to communicate to each other.

That is until you enable 'ip routing' on the 5300. When you have enabled ip routing, if the clients have their default gateways pointing to 192.168.88.1 and 172.16.88.1, then they will be able to communicate with each other.

In your test where you had 2 VLANs configured and had clients with the same IP address range on each VLAN, normally they should not be able to ping each other. The only situations in which I could imagine that happening would be if 'proxy-arp' was enabled or there was actually a second client on one of the VLANs that had the same IP address by accident.

By default though, even without VLANs normal unicast traffic will not be forwarded to other ports that do not require it (unlike hubs where traffic is flooded out all ports). It is only broadcast and multicast traffic that is seen on all ports.

I recommend you have a look through the ProCurve Networking Primer to understand some of these concepts better.

http://www.hp.com/rnd/training/technical/primer.htm

Matt

[Gerrard Shaw]

Thanks for the link - much appreciated :)

Think I've sorted the VLANs now - turns out the "HP" fiber card we bought is actually a rebadged Intel Pro 1000MT so because of that we labelled the connections up wrong initially! A quick renaming later et voila all works as expected :D

As a side point the Web UI seems to be a bit moody at times - it wouldn't remove ports from the new VLANs "error your configuration has not been saved". However using the config menu through Telnet let me change whatever I wanted - sometimes the retro ways work best eh ;)

Regards,

Gerrard