HPE 1920 48G poe+ WebGUI timeout, and no internet access

[AaronDal]

Config Here: https://pastebin.com/hFHLNTsp

Some background info:

This switch is on a subnet of 192.168.1.0/24, we will call this subnet B. I am on subnet A, 192.168.0.0/24. Subnet A and B are linked over a WAN with fortigate firewalls and ipsec tunnelling.

The switch, on subnet B, can ping subnet As firewall, it can ping the machine that I am typing this on, it can ping subnet Bs firewall, and it can ping a laptop I have connected to it on subnet B.

Subnet Bs firewall can also ping everything.

I, on subnet A, cannot ping the laptop sitting behind this switch (192.168.1.22 in case I reference it later) < This is problem 1. The laptop cannot get internet, thus this switch isn't passing traffic back to the firewall properly from its ports.

Problem 2: when I try to log into the webgui from subnet A, it times out, and ping to the switch is interrupted. I can log into the webgui from subnet B. What is going on here? Am I missing port configs somewhere? I only have 1 vlan and all I want it to do is simple switching.

I also have a LAG set up on ports 45-48, which are set up to a twin switch just for more ports.

[AaronDal]

An update: I had some wrong info there, The switch on subnet B cannot ping subnet A's firewall, or anything on subnet A for that matter. Subnet A can ping everything on subnet B, and I was able to even open a vnc connection to this laptop behind the switch, but it is EXTREMELY slow, its like it is timing out like the webgui is.

[parnassus]

Apparently there isn't nothing you can do Switch side (at least speaking about the 1920-48G about which you provided the configuration).

Your HPE OfficeConnect 1920-48G sits on the Subnet B (192.168.1.0/24) with IP Address 192.168.1.22 assigned to its VLAN 1 (Default VLAN, the only one that exist); the Switch has a Static Route (any address/any subnet mask) to 192.168.1.1 (which, I presume, is the IP Address of the Default Gateway of Subnet B...so the IP Address assigned to a LAN Port on your Fortinet Fortigate Firewall on Subnet B).

So far, so good.

That IP configuration is not necessary for hosts sitting on Subnet B to connect with hosts sitting on Subnet A: the routing work should be done, on each side of the site-to-site VPN Trunk, by involved Firewalls and the Switch hasn't a routing role (only a switching role)...that configuration is useful just for the Switch so it can be able to reach all networks that aren't its subnet (so the Internet but also the Subnet A, if Firewalls are properly configured to permit that).

So simply an host of Subnet B should be correctly routed to another host of Subnet A and vice-versa (generally that's what is needed, Firewall policies, if any, excluded from the whole picture).

So pinging from the correctly addressed Switch 1920-48G or pinging from a correctly addressed host on Subnet B to A (or Subnet A to B), provided that the Switch is (as is) correctly configured, should work if the VPN Trunk is correctly configured (so routes A to B and B to A are working and proper routing rules are set on both Fortigate Fortinet Firewalls).

A side note about the way you configured the LAG (Link Aggregation Group) with member ports 1/0/45, 1/0/46, 1/0/47 and 1/0/48: I have a similar scenario (two 1920-48 trunked together with 4 ports LAGs)...in my case the configuration of LAG and member ports is:

...
#
interface Bridge-Aggregation1
 port link-type trunk
 port trunk permit vlan 1
 link-aggregation mode dynamic
#
...
#
interface GigabitEthernet1/0/x
 port link-type trunk
 port trunk permit vlan 1
 port auto-power-down
 stp edged-port enable
 port link-aggregation group 1
#
...

Note the differences with your configuration (especially the port link-type trunk and port trunk permit vlan 1 respectively on LAG and LAG's member ports sections.

Probably, in your case, disabling PoE feature on those ports will be a good idea exactly like disabling (a thing I should do too) the auto-power-down option.

[AaronDal]

That is correct on all points. Regarding the LAG, would this be a broadcast storm issue? I have 2 cisco switches on subnet A with LAG and LACP enabled and there was no issue.  I will disable PoE on those ports as well.

So anyway, from my understanding, traffic is just routing EXTREMELY slow then. I will talk to my ISP to see what the deal is with the speed, but barring that, any other configuration thing I can look at? I am running out to the remote site tomorrow and I would rather not be there for 13 hours like I was 3 days ago :(.

It is so weird that I can access the webgui login page fine, but when I go to actually log in, it just drops (from subnet A at least, on site on subnet B it logs in fine).

[AaronDal]

I have made a gif of the issue as well. It is such a weird issue. Packets must be getting lost somewhere. This is me attempting to log into it from subnet A (192.168.0.0/24)

http://i.imgur.com/t6766yv.gif

[parnassus]

Hi, to troubleshoot what is happening you should simplify your test scenario; provided that:

1. there aren't IP Addresses conflicts on hosts members of Subnet (A and B),
2. host to host (select an host of site A and one of site B to be used for test) ICMP Pings (that's the minimum, testing other available protocols/application - see RDP, SMB, etc. - would be a plus) are all successful when performed between Switches (or just withing the same Switch) belonging to the same Subnet A for Site A (and Subnet B for Site B),
3. each Subnet - A and B - has a well defined Default Gateway on each VLAN (you basically are working on VLAN 1 which is the Default VLAN and the Switch doesn't perform routing for other hosts than itself),

you can start doing other tests from a well known scenario: switching within the same Subnet - A and B - is working correctly. Sites are, from this point of view, tested singularly.

The next step could be to focus on the routing part between sites (that's Firewalls' task): from the same hosts used on point 2 above does a ping/traceroute against the other host on the other Site/Subnet actually work? if it doesn't (considering you can also test other form of communication: HTTP/HTTPS/RDP/SMB/etc.) then the issue is on the Firewalls and, probably, on the VPN Site-to-Site configuration (VPN Trunk can be up but routing A-to-B and B-to-A could be the real issue).

[AaronDal]

tracert works from subnet A to the laptop on subnet B.

Ping works fine between all hosts now. The firewall configuration is fine. I could drop in the old HP procurve 2626 switch and it would work perfectly. These switches are new and there is still some weirdness going on. I am running out to the site shortly, and the first thing I am going to try, is to delete the old static routes that were in the switches by default. I added the 0.0.0.0/0 nexthop Gateway route, but didn't delete any old ones. Hopefully that makes a difference.

Could the switch be faulty if the network traffic is extremely slow/timing out?

[parnassus]

If you're referring to this configuration line:

#
 ip route-static 0.0.0.0 0.0.0.0 192.168.1.1
#

that's exactly what I found on mine (clearly I use different IP Address) and all looks quite good.

A doubt: what is the Switch's port connected to the FortiNet FortiGate Firewall on Site B (Subnet B)? is it the 1/0/1?

I ask because I saw:

#
interface GigabitEthernet1/0/1
 port link-type hybrid
 port hybrid vlan 1 tagged
 speed 100
 duplex full
 port auto-power-down
 poe enable
 stp edged-port enable
#

I doubt it could be an issue with the Switch itself...eventually about its configuration.

When you say you can drop in an HP ProCurve 2626 (J4900A) instead of the HPE OfficeConnect 1920-48G and traffic starts to flow flawlessly...then...what is the configuration of HP ProCurve 2626's port connected to the Firewall?

[AaronDal]

config of old switch: 

; J4900A Configuration Editor; Created on release #H.10.38

hostname "sw1br"
snmp-server contact "%%%%%%%"
snmp-server location "Brooks"
time timezone -420
time daylight-time-rule Continental-US-and-Canada
cdp run
interface 21
speed-duplex 100-full
exit
interface 23
speed-duplex 100-full
exit
interface 24
speed-duplex 100-full
exit
ip default-gateway 192.168.1.1
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged 2-20,22,25-26
ip address 192.168.1.35 255.255.255.0
tagged 1
no untagged 21,23-24
exit
vlan 5
name "VCNet"
untagged 21,23-24
tagged 1
exit
ip authorized-managers 192.168.0.0 255.255.0.0
ip authorized-managers 192.168.0.13
ip ssh version 1-or-2
password manager

[parnassus]

There is something strange on 2626 configuration: authorized managers belong to 192.168.0.0/16 subnet (exactly 192.168.0.13) where VLAN Id 1 IP assigned address (so the Switch management address) - it is 192.168.1.35 - belongs to 192.168.1.0/24 subnet instead ...so you should figure out if that configuration make sense and, if so, why it is.

The 2626 then, with respect to what is configured on 1920, has two VLANs configured: VLAN Id 1 (Default) with IP Address given above and VLAN Id 5 without IP Address assigned...this make me think that routing, if any, between hosts connected to tagged ports of VLAN Id 5 and hosts connected to untagged ports of VLAN Id 1 should be performed by a third party device (the Firewall)...given configuration of ports 21, 23 and 24...will be intersting to understand how the 1920 can be considered a "drop-in" replacement of the 2626, and vice versa.

How was/is the 2626 connected to the Firewall? how is/are configured Firewall's LANs ports?