VLAN and Routing Questions - i just don't get it

[Stephan G]

Hello everyone,

after reading the important pieces from the three big manuals .. i'm stuck.

What i achieved till today:
Setup RADIUS with Microsoft IAS
Setup a VLAN where unauthenticated clients will be assigned to

What i have not achieved ;)
Routing between the VLAN
DHCP server configuration for the VLAN (it's a microsoft dhcp server)

The config and some stats are in the text file. WOuld be great if someone has an advice for me.

Greets
Stephan

[Stephan G]

I forgot to mention what it should looks like in the end.

I want a defaultvlan (for the employees). And a guest_vlan for the other.

The guest_vlan should only access the internal dns, dc, dhcp server and the internet (for dc/dns for new notebook that need to be registred with AD).

greets
stephan

[Stephan G]

Ok I have it all done. Now my firewall routes and restricts the traffic.

But there's another thing i don't get. I've read somewhere that you don't need an ip on the VLAN if you don't use the ip routing.

But when i don't set an ip up my client doesn't get an ip address from the dhcp server defined with the ip helper address (other VLAN).
When i set up an ip everything works fine.

Can someone explain please ?

Thanks
Stephan

[Mohammed Faiz]

Hi,

The answer is sort of in your question. The switch needs an IP on that VLAN in order to forward the DHCP packets on to the helper address.
Your DHCP server also knows what range to offer an address on based on that source IP.
I'm also assuming that the default gateway for your clients on VLAN 99 is that '192.168.99.254' address.

hth,

Mo

[Stephan G]

Thanks for your answer.

I think i can add every vlan on every switch an ip address. I already implemented it now on every switch.

My gateway is now my firewall. Which is connected directly with an extra interface to the vlan. IP Address 192.168.99.1.

But now i came across a different problem. And i don't understand why it is like this.

I have sort of a core switch. HP Procurve 6400cl-6XG. Which has all ports untagged VLAN1 and all ports tagged VLAN99 (which is my unauth VLAN).

There are 5 connections to the switch.

On 1 port there is one 2900-48G with the connection to the coreswitch untagged vlan1 tagged vlan 99. I can ping the vlan ip from the core switch and back.

On another port there is another 2900-48G with the connection to the coreswitch untagged vlan1 tagged vlan 99. I can't ping the vlan ip from the core switch and back. Same config !! (except the ip addresses). Problem is: On this switch there are almost all the other switches which service the client network.

ip routing is disabled. But the firewall is handling this.

Is there a problem with spanning-tree or something like this ?

Any help appreciated.

[Tijl van der Steeg]

There might indeed be a loop. You can do a "show span" to check if that port is blocked. You still should be able to reach it the other way though

[Mohammed Faiz]

I'm little unclear on which IPs you're referring to. Are you pinging from a VLAN 1 ip on the core switch to a VLAN 1 ip on each of the 2900's? (A look at the configs might help clarify things)

[Stephan G]

There is indeed a port blocked on the core switch.

show span on core:

Port Type Cost Priority State | Designated Bridge
----- --------- --------- -------- ---------- + -----------------
1 10GbE-CX4 2000 128 Disabled |
2 10GbE-CX4 2000 128 Forwarding | 001c2e-187240
3 10GbE-CX4 2000 128 Forwarding | 001c2e-187240
4 10GbE-CX4 2000 128 Blocking | 001ffe-1ffdc0
5 10GbE-CX4 2000 128 Forwarding | 001c2e-91ffc0
6 10GbE-CX4 2000 128 Forwarding | 001c2e-187240

show span on switch 2:
45 1000LX | 20000 128 Forwarding | 001f28-051840 2 Yes No
46 100/1000T | Auto 128 Disabled |
47 1000LX | 20000 128 Forwarding | 001ffe-1ffdc0 2 Yes No
48 1000LX | 20000 128 Forwarding | 001ffe-1ffdc0 2 Yes No
A1 | Auto 128 Disabled |
A2 10GbE-CX4 | 2000 128 Forwarding | 001ffe-1ffdc0 2 Yes No
A3 10GbE-CX4 | Auto 128 Disabled |
A4 | Auto 128 Disabled |


This might seems to be the problem. It's a bit strange because the other connections to this switch are not 10gbit links.

I will disconnect the other redundant links from switch 2 on monday and tell you if that solves it.

Is there a way to configure spanning tree (especially on the core switch) that these ports should never be blocked ?

Thanks for the help.

[Tijl van der Steeg · Accepted solution]

You can configure BPDU-filtering.
For example: spanning-tree A5 bpdu-filter

But I'm against this
- The next administrator will not know you configured this
- If you connect an additional switch, you might run into similar problems.

Better to solve the loop by getting the root bridge priorities straight. Think it's best to make a Visio layout of your environment and decide from there on what's best.

[Stephan G]

Thanks a lot for the help with spanning tree. This was the problem.

I just disconnected the redundant connections and i'm good to go :)

As long as there is so much attention on this thread. Is there a possibility to put clients that start with a particular mac address vendor (in my case: 001AE8 (Siemens IP telephones)) automatically into a VLAN ? Or do i need to define a protocol VLAN?

Greets from Stuttgart
Stephan