HP 2920 Routing Issue

[projectithou]

Good Morning friends,

ive been trying to break my head here with this vlan config..im sure it something simple thats missing..if anyone can take a look at these putty sessions and tell me whats going on why the client device cant get to the internet and..why the switch cant ping out from the vlan source.

thank you

Please see the attached Putty session as well. DHCP is working fine, client is able to obtain valid leases. The way its setup Friday after the call with Sonicwall and HP, firewall is doing the routing. Route is put in place in firewall for VLAN100 to send traffic to 192.168.4.104

This is the Hierarchy of the switches.

192.168.4.104 ( directly connected to firewall)

192.168.4.78 ( connected to a port on SW104)

192.168.3.37 ( connected to a port on SW 78)

1. From the putty sessions, you can see on SW104, I can ping from native lan and vlan100, however that is not happening in the SW78.
2. Once the client received valid IP, however no internet connection.
3. Parameters for DHCP: Range- 192.168.100.5-25, Gateway: 192.168.100.100 DNS- 216.130.241.66 (ISP DNS)

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.09.06 08:05:31 =~=~=~=~=~=~=~=~=~=~=~=
login as: manager
We'd like to keep you up to date about:
* Software feature updates
* New product announcements
* Special events
Please register your products now at: www.hp.com/networking/register

HP J9727A 2920-24G-PoE+ Switch
Software revision WB.15.16.0004

Copyright (C) 1991-2014 Hewlett-Packard Development Company, L.P.

RESTRICTED RIGHTS LEGEND
Confidential computer software. Valid license from HP required for possession,
use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer
Software, Computer Software Documentation, and Technical Data for Commercial
Items are licensed to the U.S. Government under vendor's standard commercial
license.
HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
20555 State Highway 249, Houston, TX 77070

Press any key to continueYour previous successful login (as manager) was on 2016-09-06 06:26:24
from 192.168.4.145
HP-2920-24G-PoEP# heB show run
Running configuration:

; J9727A Configuration Editor; Created on release #WB.15.16.0004
; Ver #06:0c.fc.f3.ff.35.0d:c2

hostname "HP-2920-24G-PoEP"
module 1 type j9727a
timesync sntp
sntp unicast
sntp 30
sntp server priority 1 206.108.0.132
time timezone -360
snmp-server community "public" unrestricted
oobm
ip address dhcp-bootp
exit
vlan 1
name "DEFAULT_VLAN"
no untagged 24
untagged 1-23,A1-A2,B1-B2
ip address dhcp-bootp
exit
-- MORE --, next page: Space, next line: Enter, quit: Control-Cvlan 100
-- MORE --, next page: Space, next line: Enter, quit: Control-C name "suite405"
-- MORE --, next page: Space, next line: Enter, quit: Control-C untagged 24
-- MORE --, next page: Space, next line: Enter, quit: Control-C tagged 6
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip address 192.168.100.1 255.255.255.0
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip helper-address 192.168.4.1
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip helper-address 192.168.3.215
-- MORE --, next page: Space, next line: Enter, quit: Control-C exit
-- MORE --, next page: Space, next line: Enter, quit: Control-C
-- MORE --, next page: Space, next line: Enter, quit: Control-CHP-2920-24G-PoEP# HP-2920-24G-PoEP# HP-2920-24G-PoEP# show ip
Internet (IP) Service

IP Routing : Disabled

Default Gateway : 192.168.4.1
Default TTL : 64
Arp Age : 20
Domain Suffix :
DNS server :

| Proxy ARP
VLAN | IP Config IP Address Subnet Mask Std Local
-------------------- + ---------- --------------- --------------- ----------
DEFAULT_VLAN | DHCP/Bootp 192.168.4.37 255.255.255.0 No No
suite405 | Manual 192.168.100.1 255.255.255.0 No No

HP-2920-24G-PoEP# ping 8.8.8.88.8.8.8 is alive, time = 7 ms
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping 8.8.8.8 192.168.4.1192.168.4.1 is alive, time = 2 ms
HP-2920-24G-PoEP# ping sou 100 192.168.4.1Request timed out.
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping sou 100 192.168.4.1 100.100192.168.100.100 is alive, time = 5 ms
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping sou 100 192.168.100.100 8.8.8.8Request timed out.
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping sou 100 8.8.8.8 192.168.3.215Request timed out.
HP-2920-24G-PoEP#

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.09.06 08:03:54 =~=~=~=~=~=~=~=~=~=~=~=
login as: manager
We'd like to keep you up to date about:
* Software feature updates
* New product announcements
* Special events
Please register your products now at: www.hp.com/networking/register

manager@192.168.4.104's password:
HP J9727A 2920-24G-PoE+ Switch
Software revision WB.15.11.0007

Copyright (C) 1991-2013 Hewlett-Packard Development Company, L.P.

RESTRICTED RIGHTS LEGEND
Confidential computer software. Valid license from HP required for possession,
use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer
Software, Computer Software Documentation, and Technical Data for Commercial
Items are licensed to the U.S. Government under vendor's standard commercial
license.
HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
20555 State Highway 249, Houston, TX 77070

Press any key to continue9301 SOUTHWEST# show run
Running configuration:

; J9727A Configuration Editor; Created on release #WB.15.11.0007
; Ver #03:12.15.0d:09

hostname "9301 SOUTHWEST"
module 1 type j9727a
qos type-of-service diff-services
timesync sntp
sntp unicast
sntp 30
sntp server priority 1 206.108.0.132
time timezone -360
ip default-gateway 192.168.4.1
ip route 0.0.0.0 0.0.0.0 192.168.4.1
ip route 192.168.4.0 255.255.255.0 192.168.4.1
ip route 192.168.100.0 255.255.255.0 192.168.100.26
snmp-server community "public" unrestricted
snmp-server contact "JOSEPH MATHEW"
oobm
ip address dhcp-bootp
exit
-- MORE --, next page: Space, next line: Enter, quit: Control-Cvlan 1
-- MORE --, next page: Space, next line: Enter, quit: Control-C name "DEFAULT_VLAN"
-- MORE --, next page: Space, next line: Enter, quit: Control-C no untagged 17
-- MORE --, next page: Space, next line: Enter, quit: Control-C untagged 1-16,18-24,A1-A2,B1-B2
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip address 192.168.4.104 255.255.255.0
-- MORE --, next page: Space, next line: Enter, quit: Control-C qos dscp 101110
-- MORE --, next page: Space, next line: Enter, quit: Control-C voice
-- MORE --, next page: Space, next line: Enter, quit: Control-C exit
-- MORE --, next page: Space, next line: Enter, quit: Control-Cvlan 100
-- MORE --, next page: Space, next line: Enter, quit: Control-C name "VLAN100"
-- MORE --, next page: Space, next line: Enter, quit: Control-C untagged 17
-- MORE --, next page: Space, next line: Enter, quit: Control-C tagged 22-23
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip address 192.168.100.100 255.255.255.0
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip helper-address 192.168.3.215
-- MORE --, next page: Space, next line: Enter, quit: Control-C exit
-- MORE --, next page: Space, next line: Enter, quit: Control-Cpassword manager
-- MORE --, next page: Space, next line: Enter, quit: Control-C
-- MORE --, next page: Space, next line: Enter, quit: Control-C9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# 9301 SOUTHWEST# show ip
Internet (IP) Service

IP Routing : Disabled

Default Gateway : 192.168.4.1
Default TTL : 64
Arp Age : 20
Domain Suffix :
DNS server :

| Proxy ARP
VLAN | IP Config IP Address Subnet Mask Std Local
-------------------- + ---------- --------------- --------------- ----------
DEFAULT_VLAN | Manual 192.168.4.104 255.255.255.0 No No
VLAN100 | Manual 192.168.100.100 255.255.255.0 No No

9301 SOUTHWEST# ping sou 100 8.8.8.88.8.8.8 is alive, time = 8 ms
9301 SOUTHWEST# pun ing 192.168.100.100192.168.100.100 is alive, time = 1 ms
9301 SOUTHWEST# 192. ping 192.168.4.1192.168.4.1 is alive, time = 2 ms
9301 SOUTHWEST# ping sou 100 192.168.4.1192.168.4.1 is alive, time = 2 ms
9301 SOUTHWEST#

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.09.06 08:09:13 =~=~=~=~=~=~=~=~=~=~=~=
login as: manager
We'd like to keep you up to date about:
* Software feature updates
* New product announcements
* Special events
Please register your products now at: www.hp.com/networking/register

HP J9727A 2920-24G-PoE+ Switch
Software revision WB.15.12.0015

Copyright (C) 1991-2014 Hewlett-Packard Development Company, L.P.

RESTRICTED RIGHTS LEGEND
Confidential computer software. Valid license from HP required for possession,
use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer
Software, Computer Software Documentation, and Technical Data for Commercial
Items are licensed to the U.S. Government under vendor's standard commercial
license.
HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
20555 State Highway 249, Houston, TX 77070

Press any key to continueYour previous successful login (as manager) was on 1990-04-19 17:18:26
from 192.168.4.145
HP-2920-24G-PoEP# how show run
Running configuration:

; J9727A Configuration Editor; Created on release #WB.15.12.0015
; Ver #05:18.41.ff.35.0d:9b

hostname "HP-2920-24G-PoEP"
module 1 type j9727a
snmp-server community "public" unrestricted
oobm
ip address dhcp-bootp
exit
vlan 1
name "DEFAULT_VLAN"
untagged 1-24,A1-A2,B1-B2
ip address dhcp-bootp
exit
vlan 20
name "WAP"
no ip address
exit
vlan 100
name "VLAN100"
-- MORE --, next page: Space, next line: Enter, quit: Control-C tagged 15-16
-- MORE --, next page: Space, next line: Enter, quit: Control-C no ip address
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip helper-address 192.168.4.1
-- MORE --, next page: Space, next line: Enter, quit: Control-C ip helper-address 192.168.3.215
-- MORE --, next page: Space, next line: Enter, quit: Control-C exit
-- MORE --, next page: Space, next line: Enter, quit: Control-Cvlan 156
-- MORE --, next page: Space, next line: Enter, quit: Control-C name "CAMERA"
-- MORE --, next page: Space, next line: Enter, quit: Control-C no ip address
-- MORE --, next page: Space, next line: Enter, quit: Control-C exit
-- MORE --, next page: Space, next line: Enter, quit: Control-C
-- MORE --, next page: Space, next line: Enter, quit: Control-CHP-2920-24G-PoEP# show ip
Internet (IP) Service

IP Routing : Disabled

Default Gateway : 192.168.4.1
Default TTL : 64
Arp Age : 20
Domain Suffix :
DNS server :

| Proxy ARP
VLAN | IP Config IP Address Subnet Mask Std Local
-------------------- + ---------- --------------- --------------- ----------
DEFAULT_VLAN | DHCP/Bootp 192.168.4.78 255.255.255.0 No No
WAP | Disabled
VLAN100 | Disabled
CAMERA | Disabled

HP-2920-24G-PoEP# ping 192.168.4.1192.168.4.1 is alive, time = 2 ms
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping 192.168.4.1 100.100192.168.100.100 is alive, time = 2 ms
HP-2920-24G-PoEP# HP-2920-24G-PoEP# ping 192.168.100.100 8.8.8.88.8.8.8 is alive, time = 8 ms
HP-2920-24G-PoEP# ping sou 100 192.1 8.8. 8.8.8.8No IPv4 address is configured on vlan 100.
HP-2920-24G-PoEP#

[Ian Vaughan]

Hello,

I'm finding it hard to visualize your topology. Would you be able to knock together a quick block diagram - maybe change your switch names to something easy like sw104, sw38 and sw78, ports, vlans tagged and untagged. Maybe just sketch it on a whiteboard and take a picture of it

Just drawing it out and looking at those parameters - you'll probably answer your own question :-)

Shooting from the hip:

You don't seem to have an IP address on vlan 100 on the third switch so this probably isn't a fair test. Is that deliberate?

If clients get DHCP addresses that's always a good sign. If clients can ping their default gateways and the issue lies beyond its probably the firewall.

Firewalls and Microsoft clients are the bane of Network Engineers lives as they rarely behave exactly as you expec them to.

I would tidy up all of the no longer needed route statements and strip all of the dhcp helper stuff out if all the layer 3 is being handled by the firewall. It will make the config easier to follow.

Hope that gives you a start - will have a look at any pictures / diagrams that you post.

Thanks

Ian

[Vince-Whirlwind]

The ping test results are messed up and a little difficult to read, but I think they seem to indicate all your VLAN tagging looks OK.

From what I gather, you are using the firewall as a router for VLAN1, and SW104 as the router for VLAN100.
As you say you are using SW104's VLAN1 interface as a route target from your firewall, you're going to get some asymmetric routing happening there.

Of your other two switches, one has IP routing enabled, and one has no VLAN100 IP address.

The way I would set this up is as follows:
- can I trunk both VLANs to the firewall and use it as the router for both?
      - if so, get rid of all VLAN100 IP addressing off all 3 switches, disable IP routing off them, and trunk VLAN100 to the firewall, and put the .100.100 IP address on the firewall VLAN100 interface. Enable IP helper on the firewall if required - I'm not clear where your DHCP server actually is.

 - if I have to use SW104 as a router, then use it as the "core": get rid of VLAN1 off SW78 & SW37, replace it with a new "Management" VLAN and give all 3 switches an IP address in that VLAN.
 - disable IP routing off SW78 & SW37 and remove VLAN100 IP addressing off SW37, then add in the management VLAN SW104 IP address as the DGW on these two switches.
 - make sure the firewall has routes for both "internal" subnets, pointing at 4.104
 - make sure SW104 has a default route pointing at the FW at 4.1

Apart from the default route on SW104 and the 2 routes on the FW, you don't need any static routes on the switches.