Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Vlans and Firewall

Goldy
Occasional Contributor

Vlans and Firewall

Hi
I have to split my Core switch (HP 5406) to 10 Vlans.
Each Vlan in deferent Subnet, and all the workstations in all 10 Vlans, has to get the DHCP from one DHCP Server.
The Switch is layer 3 and doing all the routing between the Vlans.
Every VLAN gets its own IP according to its VLAN.
Main LAN (Vlan 1): 10.100.0.0/16
VLAN 2: 10.120.0.0/24
VLAN 3 : 10.130.0.0/24….
Theoretically, all I hade to do is configure my Firewall routing back to the Vlans to the 5406 and add the VLANS to in the DNS.
Unfortunately I have a very strange behavior.
From within Vlans 2 & 3, I can ping the firewall, I’m getting IP resolving for External IPs, which mean I can talk with Astaro, BUT I cannot get out to the internet.
We have tried all we could think of – disable all kind of protection on the firewall which might block it’ all sort of routing and configuration – Nothing!!!
Configuration of the workstation on Vlan 3:
IP:10.130.0.40
Sub: 255.255.255.0
GW: 10.130.0.1
DNS: 10.100.254.254 (Main GW – the Firewall)

Since the DNS configured manually I can see it in the firewall, but we cannot see any other packets from 10.130.0.40
Another thing – Ping works, but Tracert don’t.

Any idea if and what I’m doing wrong?

Best regard,
Goldy
2 REPLIES
Mohieddin Kharnoub
Honored Contributor

Re: Vlans and Firewall

Hi

With this workstation:
IP:10.130.0.40
Sub: 255.255.255.0
GW: 10.130.0.1
DNS: 10.100.254.254

I assume the GW is Vlan3 IP address on the 5400 Routing Switch.

Also i assume that you have configured a default route on the 5400 to route internet or any unknown traffic to your firewall.

Since the ping is working, so your routing tables are working perfectly between the 5400 and the Firewall.

In this case i would like to ask you what kind of Firewalls you are using? and what policy you have configured on this firewall for a traffic from Vlan1-Vlan10 to outside (internet).
Can you attach the configuration of the 5400 after removing any private information.

Good Luck !!!
Science for Everyone
Goldy
Occasional Contributor

Re: Vlans and Firewall

Thanks for the fast answer.
My firewall is ASTARO.
The policy for the traffic from Vlan-10 (my current LAN) outside is Kind of NAT called "masquerade" From the LAN interface (10.100.0.0) to the wan interface.
We have tried adding another masquerade from VLAN 30, but no change.