HPE 1950 Web Gui and Setting up VLANS

[rogerp_1]

Hi Guys,

Looking for some basic advice on how to setup a simple few VLANS using this Web Gui Interface, its very new to me.

So we have the following

Dray Internet Router GW LAN : 192.168.1.253 

HPE 1950 Switch Vlan 1 192.168.1.247

I have created below two Vlans IP Interfaces.

Vlan 10 192.168.10.24 & Vlan 20 192.168.20.247

Vlan 1 is fully working for internet access, however i cant for the life of my get either Vlan10 or 20 Routing out to the internet.

I have a route as follows 

Destination 0.0.0.0 / Mask 0 / next hop 192.168.1.253

Can someone please let me know what i'm doing wrong here?

Cheers

[akg7]

Hello @rogerp_1,
Are vlans communicating with earth other?
What about the routing on internet router towards HPE 1950 switch?
What is the HPE 1950 switch product number?

Thanks!

[rogerp_1]

Hi

Yes i have Vlans can comminucate with each other, which is not correct so i also need to stop that.  Both laptops can ping each other however none can ping the internet which is on port 1 on the switch.

Its a JH295A

[akg7]

Hello,
It's fine if inter Vlan are working.
Can you share the config or screenshots of the interfaces connecting to internet and Vlan 1 config screenshots?
Also internet router is accessible to you if yes then can you check routing into that?

Thanks!

[rogerp_1]

Sure i can, thanks for your help!.

Port 1 connected to the Draytek router

VLANS

I have full access to the router, nothing configured on it as its a basic wan & lan router, we want to use the 1950 as the routing switch.  Once this switch is working with the Vlans we have anotehr 10 1950 48 port switches which will hang off this switch.

[Ivan_B]

Hi @rogerp_1 !

Couple of questions:

- Could you clarify if VLAN 10 hosts can ping Router GW LAN 192.168.1.253 ?
- What is the IPv4 default gateway assigned to VLAN 10 hosts?
- Did you enable NAT for Vlan 10 192.168.10.0/24 & Vlan 20 192.168.20.0/24 subnets in your Drytek router?
- Did you set static route for Vlan 10 192.168.10.0/24 & Vlan 20 192.168.20.0/24 subnets in Drytek router to be reachable over HP 1950 Switch Vlan 1 192.168.1.247 ?

[rogerp_1]

none of any of the vlans can ping the switch gateway of 192.168.1.253

yes all of the vlan members can ping there own gateway, example vlan 10 192.168.10.247

as we do not want to use the draytek router as a router we have not configured anything on the router, it simple has a lan and wan ip address, nothing more. 

the idea is to use the switch as the routing device for the network

hope that helps

[akg7]

Hello @rogerp_1 ,

Vlan 1 is able to reach router because its directly connected to uplink but for other vlans routing is required.

I can see default route on HPE 1950 pointing to router but it should get reverse path in order to successful communication.

NAT is required if router is reaching to ISP in order to do private to public ip conversion for communication over itnernet.

Can you try to configure default route in router pointing to HPE 1950 vlan 1 gateway?

Thanks!

[rogerp_1]

Hi 

After adding the routes to the draytek for all the VLan subnets all communication is now working.  Thanks for that!.

I dont under stand why VLans can communicate with each other, how do we disable this ?  i'm trying to create seperate vlans for security so no point leaving this feature on?

[Ivan_B]

I dont under stand why VLans can communicate with each other, how do we disable this ?  i'm trying to create seperate vlans for security so no point leaving this feature on?

Very simple - because it's the primary job of every router - to route between networks. VLAN is a broadcast domain, so in other words it separates hosts on Layer 2. If you need separation on Layer 3, you need firewall. The sort of firewall is packet-filtering ACL applied on Vlan-interface/-s where you need to define what traffic is allowed (permit statements) and what is not allowed (deny statements).