Configuring multiple VLAN's across multiple switches

[majikman]

VLAN's are a little new to me, so please cut me some slack.

I have 3 networks at the same facility. One network is for business data, one is for VOIP, and one is a wireless mesh network that distributes WWW access. At this facility there are four buildings (A, B, C and D)each connected via fiber. I've attached a drawing to help show this.

Currently the business and VOIP networks are distributed amongst all four buildings. The wireless network currently only has 1 gateway that is connected to a WatchGuard FireBox. This FireBox provides WWW access to both the business and wireless networks, and provides segregation between the two networks.

Also, besides the Default_VLAN there is a VLAN established between building B and C for the VOIP network.

Where I want to eventually end up is to have the business, voice, and wireless networks in all three locations. Preferably without having to buy extra hardware, although we may want to purchase more switches for building B and C to keep the VOIP network on its own fiber pair so it has the max bandwidth available.

Not sure how to span multiple VLANs across multiple switches. Help please.

[Jeff Carrell · Accepted solution]

To have multiple vlans on a single connection, you "tag" the switch-to-switch link ports in each vlan as required.

So, as an example, 2 switches connected together, each on their port 1, 3 vlans across the link:

switch1#(config) vlan 10 tag 1
switch1#(config) vlan 20 tag 1
switch1#(config) vlan 30 tag 1

switch2#(config) vlan 10 tag 1
switch2#(config) vlan 20 tag 1
switch2#(config) vlan 30 tag 1

hth...Jeff

ps, device ports are "untagged" in a vlan.

[Jaap Laaij]

Hi,

Have you considered a LACP or HP trunk to connect the switches to each other?
Have you considered a voice vlan with QoS priority?

[majikman]

Jeff, thanks for the help.

Jaal,

I have read a bit about HP trunks. Not sure how to configure it and exactly what the benefits are. Could you elaborate a little?

[Jaap Laaij]

Jeffs explanation is about using a single physical interface, port 1, of both switches as an uplink. By tagging you are able to run multiple vlans over one physical port/uplink.

You can also use more interfaces, max 8,as one uplink. To prevent spanning tree coming into action you have to create a trunk. I just use static trunks, e.g.

ProCurve(config)# trunk 1-4 trk1 trunk

1-4 are the interfaces, trk 1 is just a name, trunk means static trunk.

You have to do this on both switches.
Ports on both ends of a trunk group must have the same media type and mode
(speed and duplex).
The trunk, eg Trk1, by default, will also be a untagged member of vlan 1.
This is necessary for things like dhcp ip requests and other functions. Only one vlan can be untagged on a port!.

The advantage is more throughput and if one of the interfaces or cables dies the remaining ports will continue rx/tx data.

[majikman]

OK, so in Jeff's example he listed two switches. I have four. So I am assuming that I would just replicate his config across all four switches. From my understanding, that gets the vlans across all four switches, but I would still need to assign specific ports to specific vlans. For example ports 2-6 on vlan 10, ports 7-12 on vlan 20, and ports 13-18 on vlan 30.

Now I have six fiber pairs that run from bldg A to bldg D. According to Jaal, I could plug all six pairs in and create a trunk. Jeff's example config shows how to get the vlans across 1 port, how would this be done across a trunk?

[Jeff Carrell]

Follow Jaap's example:
"ProCurve(config)# trunk 1-4 trk1 trunk

1-4 are the interfaces, trk 1 is just a name, trunk means static trunk.

You have to do this on both switches.
Ports on both ends of a trunk group must have the same media type and mode
(speed and duplex)."

switch1(config) trunk 1-4 trk1 trunk
switch1(config) vlan x tag trk1

and on...

When you create a trunk, those ports no longer are usable as individual ports, they are now known as "trk1".

You do not have to use the same "trkx" number on each end, they do not communicate that info. But speeds/types must be same on each end as Jaap noted.

hth...Jeff

ps, Get this CLI ref guide, it shows how to configure HP ProVision, HP Comware5 and Cisco switches for lots of different functions, in a side-by-side comparison, so if you know one CLI, you see how to do it in a different CLI:

http://h17007.www1.hp.com/docs/interoperability/Cisco/HP-Networking-and-Cisco-CLI-Reference-Guide_June_10_WW_Eng_ltr.pdf

you may not need all of it (since you only have the ProCurve's), but the examples of how to do specific configuration options are worth it :-)

[Jaap Laaij]

Took a closer look at your config.

You have a single connection from the 2810 from building A and a single connection from the 2520 to the 2810 at building B.
The same applies to the connections from the 2810 and 2520 form building D to the 4202yl at building C.
Therefore, at this point, you can just use one physical port as an uplink and creating a trunk does not make any sense.
You can still run multiple vlans over this one interface.

switch1(config) vlan 10 tag 1 (interface 1)
switch1(config) vlan 20 tag 1 (interface 1)
etc.

Between buildings B and C you can use trunking.

The whole setup of the network is quite vulnarable since the network is daisy-chained.If one of the switches in building B or C dies ... .
This can only be overcome by creating a ring/loop.
That should be possible by patching the fiber from one of the switches in building A straight through to a switch in building D.
Connect the 2520s and 2810s in building A and D with each other by a single interface uplink or a trunk, as discussed earlier.
It will create a loop but I presume you have STP running. Let me know.
This wil create just a 1Gb link overall. The question is if this will be a problem. Do you have any numbers on the day to day load, especially on the uplinks?

If you are worried about voice traffic, you should implement QoS.
The 2810 however does not support voice Vlan (2520 and 4204 do), but does support QoS priority based on Vlan ID. (Jeff?)

[Jeff Carrell]

Jaap said "If you are worried about voice traffic, you should implement QoS.
The 2810 however does not support voice Vlan (2520 and 4204 do), but does support QoS priority based on Vlan ID. (Jeff?)"

Yes, QoS can be set on port, or vlan (and other options as well). Also, ProVision code supports inbound 802.1p (layer 2 QoS) setting, so if VoIP phone sends a QoS priority at layer2 (802.1p) (and many do by default send priority 6), then the switch acts on it and passes it through. If VoIP phone does not, then you can set QoS on vlan.

switch(config)#vlan 10 qos pri 6

hth...Jeff

[majikman]

So, after all the advice and me practicing on some test equipment I began to get things setup to start this on the live switches. I was short one mini-GBIC, so I thought "no problem, I have some others (not HP brand)". Hmmmm. Ya, that's not going to work.

"Not a ProCurve transceiver..."

[Jeff Carrell]

majikman said: "I was short one mini-GBIC, so I thought "no problem, I have some others (not HP brand)". Hmmmm. Ya, that's not going to work."

True.

AND, make sure you have the appropriate HP ProCurve "version" of an HP ProCurve mini-gbic.

There are rev A, B, and C. Many of the 4yr old'ish switches require Rev B, and newer than that switches require Rev C. and HP tech support will not swap them out if its the "wrong rev" cause it's not "faulty".

Search the HP networking support site for the pdf that lists mini-gbic revs-to-switch requirements.

hth...Jeff

[majikman]

And just to follow up to Jaap's last comment.

Currently there are 6 fiber pairs between each building. So I will be building a trunk between each building.

Also, there is one more building that will be added to this network and from there another fiber will be run back to building A - creating a loop.

[majikman]

This is the config I'll be trying out once a new HP GBIC arrives;

Building A
switchA(config)# trunk 47-48 trk1 trunk
switchA(config)# vlan business tag trk1
switchA(config)# vlan camp tag trk1
switchA(config)# vlan voip tag trk1

Building B
switchB(config)# trunk 21-22 trk1 trunk
switchB(config)# trunk 23-24 trk2 trunk
switchB(config)# vlan business tag trk1
switchB(config)# vlan camp tag trk1
switchB(config)# vlan voip tag trk1
switchB(config)# vlan business tag trk2
switchB(config)# vlan camp tag trk2
switchB(config)# vlan voip tag trk2

Building C
switchC(config)# trunk B21-B22 trk2 trunk
switchC(config)# trunk B23-B24 trk3 trunk
switchC(config)# vlan business tag trk2
switchC(config)# vlan camp tag trk2
switchC(config)# vlan voip tag trk2
switchC(config)# vlan business tag trk3
switchC(config)# vlan camp tag trk3
switchC(config)# vlan voip tag trk3

Building D
switchD(config)# trunk 21-22 trk3 trunk
switchD(config)# vlan business tag trk3
switchD(config)# vlan camp tag trk3
switchD(config)# vlan voip tag trk3

Basically what I'm trying to do is trunk 2 1GB fiber links between each switch. Then I'm creating the three vlans on each switch and tagging them. So the two fiber pairs on switchA ports 47 and 48 terminate in switch B port 21 and 22. And the fiber from switchB port 23 and 24 terminates in switch C 21 and 22, etc...

If this looks OK then what I think the next step will be is to assign specific ports on each switch to the vlans and set their mode. Is that correct?

[Jeff Carrell]

majikman said:"If this looks OK then what I think the next step will be is to assign specific ports on each switch to the vlans and set their mode. Is that correct?"

Basically looks good.

Untag your device ports into the appropriate vlans and you should be ready to go.

hth...Jeff

[majikman]

I tried implementing this config. Between switch A and B I have link lights on the trunk ports. But I can't ping from one switch to the other. Any ideas?

[Jeff Carrell]

majikman said: "But I can't ping from one switch to the other. Any ideas?"

We will need to see your configs to assist.

[majikman]

I ended up getting it working. It was my fault. I had made a typo and didn't notice it until I looked at it for the fourth time. I guess that's what happens when you do late night maintenance like this! Thanks for all the help!

[majikman]

Actually before I close this thread, lpease help a little with QoS. One of the vlans I created is for VOIP, which I am thinking should have a higher QoS than the other two vlans. Do I need to enable DSCP policies (not too sure how they function) or can I just set priorities?

[Jeff Carrell]

majikman asked: "a little with QoS. One of the vlans I created is for VOIP, which I am thinking should have a higher QoS than the other two vlans. Do I need to enable DSCP policies (not too sure how they function) or can I just set priorities?"

For ProCurve managed switches, QoS at layer 2 (802.1p) is automatically processed according to the 802.1p setting the switch may receive from a VoIP phone (many already send both 802.1p and DCSP, with a priority of 6).

If your phone doesn't send either, then you can simply set 'qos pri 6' on the voip vlan on the edge switch. That will work for that edge switch, then as long as all the links for the voip vlan are tagged between all switches, that same priority setting will pass to all switches, and they will process it accordingly. If you traverse a non-tag (802.1Q) link such as a router, then you need to map the layer2 to layer3 so that DSCP will traverse that non-tag link. 'qos type-of-service diff-services' is this function.

hth...Jeff

[kevinslab2007]

How do you untag the VLAN to the port?

[HPNewbie2014]

Hi - I am a very very new to HP procurves. I need some guidance on how to configure the switch to send the Vlan over the fiber links. I have created the new vlan, but I am unsure on how to program the switch to send the Vlan to the next switch that is connected by fiber on fiber port 4. Does it require an HP gigabit?

Any help would be greatly appreciated - thank you

[rrgacia17]

hello guys 

Could you please help me regarding our inter routing vlan. this is the situation i have CORE switch which is e5400zl

module 1 type J9537A

module 2 type J9537A

module 3 type J9538A

module 4 type J9534A

connected to 4 switches which is 2560 

pc 1 connected to switch 1 which is vlan 10  ip address 10.5.10.100 gateway 10.5.10.1 

pc2 connected to switch 2 which is vlan 20  ip address 10.5.20.100 gateway 10.5.20.1

pc3 connected to switch 3 which is vlan 30   ip address 10.5.30.100 gateway 10.5.30.1

pc 3 connected to switch 4 which is vlan 40  ip address 10.5.40.100 gateway 10.5.40.1

pc1 could ping pc2,pc3,pc4

pc 2 could ping  pc1,pc3,pc4

pc 3 could ping  pc1,pc2,pc4

pc 4 could ping  pc1,pc2,pc3

coresw1# trunk a1,a13 trk1 trunk

coresw1#vlan 10

ip address 10.5.10.1/24

tagged a2-a12,trk 1

ip igmp

exit

coresw1# vlan 20

ip address 10.5.20.1/24

tagged a14-a24, trk 1

ip igmp

exit

coresw1# vlan 30

ip address 10.5.30.1/24

tagged b2-b12,trk 1

ip igmp

exit

coresw1# vlan 40

ip address 10.5.10.1/24

tagged b14-b24, trk1

ip igmp

exit

SW1# vlan 10

ip address 10.5.10.2/24

ip default-gateway 10.5.10.1

tagged 1-24,trk 1

trunk 25-28 trk1 trunk

ip igmp

exit

SW2# vlan 20

ip address 10.5.20.2/24

ip default-gateway 10.5.20.1

tagged 1-24,trk 1

trunk 25-28 trk1 trunk

ip igmp

exit

SW1# vlan 30

ip address 10.5.30.2/24

ip default-gateway 10.5.30.1

tagged 1-24,trk 1

trunk 25-28 trk1 trunk

ip igmp

exit

SW1# vlan 40

ip address 10.5.40.2/24

ip default-gateway 10.5.40.1

tagged 1-24,trk 1

trunk 25-28 trk1 trunk

ip igmp

exit

could you please help me if my configuraition is correct or incomplete.

thanks

richard

[FrankK3]

Newbie, Well that depends! Does you switch have "dual personality" ports? For example, your switch has 24 ports and room for 2 GBics. If a connection is made to one GBic, port 23 is lost, if to the second GBic, then port 24 is lost.

How many fiber pairs are you using? If using 2 or more GBics, then you need to trunk them for additional bandwidth and redundency. If only 1 GBic, then trunking (HP trunking that is) is not necessary.

How's this for a simple VLAN...

# config

# VLAN 1

# untagged 1-23

# tagged 24

# exit

Input devices are on ports 1-23 and the uplink is on 24.

[FrankK3]

rrgacia17,

I have to make some assumptions... Your 2560s are 48-port with 2-dual personality. Your PCs are "normal" off the shelf. You are trunking with copper, not fiber; in fact, you are not using fiber anywhere (5400, mods C-D).

Your PCs need to be connected to UNtagged ports. The only tagged ports you need are the uplink ports.

There's quite a bit more, but munch on this for a little.

[raymes]

Hope you can help me I have 3 switches with 5 VLANs when i add the 3rd switch I cant communicate on the primary VLAN 100? 

Can I send you my configs?