Enable WakeOnLAN using VLAN and Switch HPE 1920 Series

[Valerio Giorgi]

Good morning, I have this problem, I'm not able to use WakeonLAN from Office VLAN (n.5) and NAS Vlan (n.10), All Vlan are managed by HPE switch 1920 and InterVLAN routing configured in Watchguard Firewall correctly.

I can Ping, connect to webGui and SSH to my device in NAS Vlan, just Wakeonline doesn't work.

How can I enable this feature beetween VLAN??

Thanks a lot, bye.

[Ivan_B]

Hello Valerio!

Could you clarify one point - which device is the default gateway for the hosts in VLANs 5 and 10 - 1920 or Watchguard Firewall?

[Valerio Giorgi]

Good morning Ivan, the default gateway is the Watchguard Firewall .

[Ivan_B]

I see, so then your 1920 has very little to do with the problem. WoL packets can be either IP broadcast (destination address 255.255.255.255) or IP directed broadcast (destination address - broadcast address of the subnet, for example 192.168.0.255 in case the subnet is 192.168.0.0/24). From the Layer 2 switch point of view both types are broadcast Ethernet packets with destination address ffff-ffff-ffff and those packets always stay in their own VLAN. This is the logic of 1920 without Vlan-interfaces (SVIs) configured, e.g. when it works as a plain Layer 2 switch.

If WoL works inside a VLAN over the 1920, it means it doesn't block those packets and now everything depends on the router, in your case the Watchguard Firewall is the router for those VLANs, so it must have a mechanism to detect such packets and to forward them to the destination. In Comware world this mechanism is called UDP helper and IP broadcast forwarder,  for Watchguard I am not sure, but in general it should be some mechanism that intercepts directed IP broadcasts that have encapsulated UDP segments with destination ports 6 and 7 and forward those broadcast packets through the Vlan-interface that has IP in that subnet.

Example:

Watchguard settings:
Vlan 5 - 192.168.5.1/24
Vlan 10 - 192.168.10.1/24

If WoL magic packet is IP directed broadcast sent from Vlan 5 with destination IP 192.168.10.255 (broadcast IP of the Vlan10), then Watchguard must intercept that packet using UDP destination port 6 or 7 as criterion and forward it as a Ethernet broadcast through its Vlan-interface10, so it can reach its destination host and wake it up.

[Valerio Giorgi]

It's not a problem about VLAN configuration in the Firewall, because of there are a intervlan routing that enable all trasfer between the VLAN, but the problem is on Wakeonlan works on Layer 2, not Layer 3.

So right now, it's working only where there are device connected on ACCESS PORT configurated, not in VLAN tagged one.

I try the same test without Firewall, only on the same switch 1920s, so in this configuration, please give me how enable this feature, bypassing Firewall.

So The only solution is to configure "UDP helper and IP broadcast forwarder" on my HP1920S, for forward UPD port (6 or 7 about WOL) from VLAN 5 to Vlan 10.

Please tell me how set up this configuration using only HPE Switch 1920S, thanks.

[Ivan_B]

Hello Valerio!

Sorry if I got you wrong, could you clarify again - does WoL work inside one Vlan? 

Also, sorry for misunderstanding - you initially stated it is 1920 switch, which is Comware-based. Now it is clear it is 1920s which is totally different switch with totally different feature set. Even if you set 1920s to perform inter-vlan routing and serve as a default gateway for your clients, it doesn't have UDP forwarder feature, so WoL will never work between VLANs if this switch will be the router. In case if WoL works correctly inside one VLAN, your only hope to get WoL between VLANs working is to tune the Firewall (that is the router right now) to forward directed broadcasts between VLANs.