Switches, Hubs, and Modems
1748003 Members
4852 Online
108757 Solutions
New Discussion юеВ

Vlans and Firewall

 
Goldy
Occasional Contributor

Vlans and Firewall

Hi
I have to split my Core switch (HP 5406) to 10 Vlans.
Each Vlan in deferent Subnet, and all the workstations in all 10 Vlans, has to get the DHCP from one DHCP Server.
The Switch is layer 3 and doing all the routing between the Vlans.
Every VLAN gets its own IP according to its VLAN.
Main LAN (Vlan 1): 10.100.0.0/16
VLAN 2: 10.120.0.0/24
VLAN 3 : 10.130.0.0/24тАж.
Theoretically, all I hade to do is configure my Firewall routing back to the Vlans to the 5406 and add the VLANS to in the DNS.
Unfortunately I have a very strange behavior.
From within Vlans 2 & 3, I can ping the firewall, IтАЩm getting IP resolving for External IPs, which mean I can talk with Astaro, BUT I cannot get out to the internet.
We have tried all we could think of тАУ disable all kind of protection on the firewall which might block itтАЩ all sort of routing and configuration тАУ Nothing!!!
Configuration of the workstation on Vlan 3:
IP:10.130.0.40
Sub: 255.255.255.0
GW: 10.130.0.1
DNS: 10.100.254.254 (Main GW тАУ the Firewall)

Since the DNS configured manually I can see it in the firewall, but we cannot see any other packets from 10.130.0.40
Another thing тАУ Ping works, but Tracert donтАЩt.

Any idea if and what IтАЩm doing wrong?

Best regard,
Goldy
2 REPLIES 2
Mohieddin Kharnoub
Honored Contributor

Re: Vlans and Firewall

Hi

With this workstation:
IP:10.130.0.40
Sub: 255.255.255.0
GW: 10.130.0.1
DNS: 10.100.254.254

I assume the GW is Vlan3 IP address on the 5400 Routing Switch.

Also i assume that you have configured a default route on the 5400 to route internet or any unknown traffic to your firewall.

Since the ping is working, so your routing tables are working perfectly between the 5400 and the Firewall.

In this case i would like to ask you what kind of Firewalls you are using? and what policy you have configured on this firewall for a traffic from Vlan1-Vlan10 to outside (internet).
Can you attach the configuration of the 5400 after removing any private information.

Good Luck !!!
Science for Everyone
Goldy
Occasional Contributor

Re: Vlans and Firewall

Thanks for the fast answer.
My firewall is ASTARO.
The policy for the traffic from Vlan-10 (my current LAN) outside is Kind of NAT called "masquerade" From the LAN interface (10.100.0.0) to the wan interface.
We have tried adding another masquerade from VLAN 30, but no change.