VLAN routing not working after switch replacement

[F-One]

Hi there,

Last year I did set up a wireless guest network as follows:

aruba 7005 port3 <=> HP 2910al Port1 <=> Port 1 <=> www

on aruba 7005 für port3: trunk-mode, ID:100 

on 2910al:

Port   DEFAULT_VLAN ID:1   GUEST-WLAN   ID:100

  ---- + ------------  ------------   

    1    | Forbid        Untagged        (==> port with incoming traffic from Aruba 7005)

  23   | Untagged      Tagged        (==> port to www)

This was working fine.

Now I had to replace that 2910al for 10GB-reasons with a H3C S5800 (= HP JC100B or = HP 5800-24)

There I set up the same:

Port   DEFAULT_VLAN ID:1   GUEST-WLAN   ID:100

  ---- + ------------  ------------   

    1    | Forbid        Untagged       PVID 100  (==>"trunk"  port with incoming traffic from Aruba 7005)

  23   | Untagged      Tagged       PVID 1  (==> "hybrid" port to www)

But I cannot get traffice through this connection.

Ist there something missing?

[akg7]

Hi,

Can you please share affected interface config from both devices (Aruba 2910 & HPE 5800).?

Thanks!

[F-One]

Hi,

for the former 2910 it was easy to obtain port information:

                  | Intrusion                           MDI   Flow  Bcast

  Port  Type      | Alert     Enabled Status Mode       Mode  Ctrl  Limit

  ----- --------- + --------- ------- ------ ---------- ----- ----- ------

  1     100/1000T | No        Yes     Down   1000FDx    MDI   off   0

vlan 1

   name "DEFAULT_VLAN"

   forbid 1

   untagged 2-48,A1-A2

   ip address 192.168.10.193 255.255.255.0

   no untagged 1

   exit

vlan 100

   name "GAST-WLAN"

   untagged 1

   tagged 23-24

   no ip address

   exit

But this is the old and working switch I plugged off last week.

Now the H3C S8500 - it differs completely in CLi and the manual here  contains so many commands which are "unrecognized commands" on cli. Finally I clicked through the GUI to gather the information: 

Port GE1/0/1 (This is where the aruba 7005 is connected to)

Flow control: Off

Link Type: Trunk

Duplex: Auto

Jumbo Frame Forwarding: Enabled

Multicast Suppression: 100%

Default VLAN ID(PVID): 100

MDI: Auto

Speed: Auto

Broadcast Suppression: 100%

Unicast Suppression: 100%

Port XGE1/1/1  (this is the main uplink into www)

Flow control: Off

Link Type: Access

Duplex: Auto

Jumbo Frame Forwarding: Enabled

Multicast Suppression: 100%

Default VLAN ID(PVID): 1

MDI: Not Support

Speed: Auto

Broadcast Suppression: 100%

Unicast Suppression: 100%

On the aruba 7005:

interface gigabitethernet 0/0/3

    description "GE0/0/3"

    trusted

    trusted vlan 100

    no poe

    switchport mode trunk

    switchport access vlan 100

    switchport trunk native vlan 100

    switchport trunk allowed vlan 100

Cabeling is as follows

aruba7005 | Port GE0/0/3 <=====> Port GE1/0/1 |H3C S8500 | Port XGE1/1/1 | <=====> WWW

if you want me to provide further information, please give advice for cli on S5800 espacially.

thanks.

[akg7]

Hi,

Please share below commads output output from HPE 5800 switch cli:

display current-configuration interface GigabitEthernet 1/0/1

display current-configuration interface Ten-GigabitEthernet 1/1/1

Thanks!

[F-One]

display current-configuration interface GigabitEthernet 1/0/1

             ^

% Unrecognized command found at '^' position.

[F-One]

The "display" command gives me only these two options:

<H3C>display ?

  gvrp  VLAN Protocol 

  stp   Spanning tree protocol

furthermore the interface anotation "1/0/1" seems to be not the right typo, but GE1/0/1 is not working, too:

<H3C>display ?

  gvrp  VLAN Protocol 

  stp   Spanning tree protocol

<H3C>display g

<H3C>display gvrp ?

  local-vlan      GVRP local VLAN information 

  state           GVRP Machine information 

  vlan-operation  Operation Information 

<H3C>display gvrp vl

<H3C>display gvrp vlan-operation ?

  interface  Select an interface to display

<H3C>display gvrp vlan-operation GE1/0/1

                                 ^

 % Unrecognized command found at '^' position.

[akg7]

Hi,

<H3C>system-view
System View: return to User View with Ctrl+Z.
[H3C]display current-configuration interface GigabitEthernet 1/0/1
[H3C]display current-configuration interface Ten-GigabitEthernet 1/1/1

Thanks!

[F-One]

<H3C>system-view

     ^

 % Unrecognized command found at '^' position.

<H3C>

WTF...?

Is system-view only supported via console and not via telnet?

(I will check this out right now...)

[F-One]

[H3C]display current-configuration interface GigabitEthernet 1/0/1

#

interface GigabitEthernet1/0/1

 port link-type trunk

 undo port trunk permit vlan 1

 port trunk permit vlan 100

 port trunk pvid vlan 100

#

return

[H3C]

[H3C]

[H3C]display current-configuration interface Ten-GigabitEthernet 1/1/1

#

interface Ten-GigabitEthernet1/1/1

 port link-type hybrid

 port hybrid vlan 100 tagged

 port hybrid vlan 1 untagged

#

return

serial console did the trick!

[akg7]

Hi,

Kindly correct me if I am wrong

Aruba 7005   ---  VLAN 1  (trunk port)----5800 ----VLAN 100  (hybrid port)---WWW

Thanks!

[F-One]

Aruba 7005 (trunk port)   ---  VLAN 100  (trunk port)----5800 ----VLAN 1 + VLAN100  (hybrid port)---WWW

[F-One]

No one any furter idea on this?

[akg7]

Hi,

Can you check after removing these pvid from  Port GE1/0/1 |H3C S8500 | ?

undo  port trunk pvid vlan 100

If this will not work then I need some time to check into LAB because other side is Aruba.

Thanks!

[F-One]

Hi,

this is one of the things I crosschecked already twice.

It did not help either.

The only thing I have changed on aruba 7005 side was switching GE0/0/3 from access into trunk mode.

With the 2910 "access mode" was the working way. With 5800 neither "access" nor "trunk" makes any difference.

If there is an alternative way on aruba 7005 to forbid the subnet where the 5800 itself is in BUT to only allow the default gateway which is of course in the same subnet - I could live with a solution like this, too. (I know how to set rules on aruba for subnet denial but don´t know how to allow one single host in that very same subnet)   

[akg7]

Hi,

I have tested this into LAB and it was working fine for me.

Other side I kept another device of Aruba and kept only below config:

Aruba Side:

interface gigabitethernet 0/0/3

    description "GE0/0/3"

    trusted

    trusted vlan 100

    no poe

    switchport mode trunk

    switchport access vlan 100

    switchport trunk allowed vlan 100

HPE 5800 Side:

interface GigabitEthernet1/0/1
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 100

Kindly make changes like this and check and if won't work then please log a case with support.

Thanks!