HP Procurve 2910al VLAN - can ping the other VLAN

[MackyBalba]

Hi,

I am certainly new to networking and I honestly do not know many things about VLAN. I have Procurve 2910al that act as my core switch and I have V1910. I am trying to setup 2 VLANS (1 for LAN and 1 for Wireless). 

hostname "MCN_CORE"
time timezone 480
module 1 type J9145A
ip routing
vlan 1
name "DEFAULT_VLAN"
untagged 1-24
ip address 10.1.0.1 255.255.252.0
exit
vlan 172
name "VLAN172"
ip address 172.100.1.1 255.255.254.0
tagged 19
exit
snmp-server community "public" unrestricted
no autorun
password manager

10.x.x.x ip cannot ping any hosts from 172.x.x.x range except 172.100.1.1.

My question is, is it normal that I can ping 172.100.1.1 even if my ip address is 10.x.x.x? When I am at 172.x.x.x ip, I cannot ping the 10.x.x.x. 

Is there a way that IP 10.x.x.x will not be able to ping 172.x.x.x?

Thank you in advance

[Chrisd131313]

Hi MackyBalba,

To understand you config, I see that VLAN 172 is tagged on port 19, I assume that this is your uplink to the V1910 switch? Are you able to supply the config of that switch?

Also are you able to confirm that the Default Gateway on the 172 devices is set to 172.100.1.1 and the subnet is the same as stipulated on the switch?

[MackyBalba]

Chrisd131313,

first of all, thank you for taking time to read and reply to my post.

the port 19 of the 2910al is tagged for vlans 1 and 172. At the same time, the port 47 of the v1910 is tagged under vlans 1 and 172.

if my ip is 172.x.x.x, i can all other devices under the subnet, including 172.100.1.1. 

now if i am at 10.x.x.x, i can also ping all other 10.x.x.x devices and 10.1.0.1. however i can also ping the 172.100.1.1 but not devices that have 172.x.x.x ip address, which is exactly what i wanted to do.

i tried to make an experiment wherein i disabled the vlan 1 (default vlan) and created another vlan (vlan 10) and moved the ip settings of vlan 1 to vlan 10. I actually got what i needed. 10.x.x.x is totally separated from 172.x.x.x, including the default gateway. but i noticed that I could not ping all v1910 switches so there is no way i can manage all switches.

So i came in to a conclusion that the reason why 10.x.x.x can ping the default gateway of 172.100.1.1 is because vlan 1 (default vlan) is the primary vlan on the 2910. Anyway, devices under 172.x.x.x could still not talk to 10.x.x.x and vice versa so i think i still got what i needed. I just hope it will not cause me more trouble in the future.

[Chrisd131313]

Hi,

If you are saying that you don't wanty the VLANs to be able to access each other then just setup a vlan ACL to deny access from one VLAN to the other, if you have to have routing enabled on the switch. You will always get a rsponse from the other VLANs DG because the switch sees it as a directly connected subnet, so the only way for this not to respond to pings is to setup a ACL to deny the traffic.

But from what you are saying it seems like you have managed to achieve what you were looking to do, so it's all good :)