DHCP Scope for VLAN

[cenk sasmaztin]

all lan user default gateway address 10.14.40.254
and connecting internet
but user unreachable isa server

is their true ?

[cenk sasmaztin]

Your firewall may make the task of the dhcp server?

[Ezugo]

Yes ISA server unreachable more or less.
using firewall as the DHCP will solve the issue.

port 0/3 will now go straight to the internet with a seperate external IP mapped to VLAN2.
on VLAN 2 i setup ip-helper to point to port 0/3 configured as DHCP

the other problem I haven't given much thought to is how users using SSID 2 (internal) will access the LAN?

thanks Cenk for all your help.
I'm almost there.

[cenk sasmaztin]

4200 series switch unable access control list between vlan's or ports


when enable ip routing on switch all vlan's between routing so vlan 2 users reachable vlan 1 user

this will be cut with normal access acl
but your switch do not support acl

so we had to make such a configuration

but inside me is not comfortable because this config not very safe

if vlan 2 user change default gateway address manually then may connect vlan 1 user


I'd like to change this konfigrasyonu, but you should fire wall served as a dhcp server

[cenk sasmaztin]

can you create two dhcp scope on fire wall

[Ezugo]

for port 0/3?

[cenk sasmaztin]

on dhcp scobe (on firewall)port0/3 and one dhcp scobe (on firewall)port0/0

so

scobe 1 for 10.14.0.0 network
scobe 2 for 10.15.0.0 network

is this possible ?

[Ezugo]

stop using windows 2003 server as DHCP?

it is possible but I would rather not do that.

[cenk sasmaztin]

why ?

[cenk sasmaztin]

yes stop dhcp server for more security and easy config.

Why do not you prefer

[Ezugo]

I'll get back to you Cenk.

[cenk sasmaztin]

---------------------switch config---------------------
module 2 type J9033A
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E23
no untagged E24
exit
vlan 2
name "Guest"
untagged B18
tagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E23
exit
vlan 10
name "management"
ip address 10.0.10.1 255.255.255.0
untagged E24
exit
management vlan 10

1-ip routing must have disable with no ip routing command)
2-no needed ip default gateway command
3-no needed ip helper-address
4-all port untag vlan 1 and tag vlan 2 for flexible
access point connection
5-interface e24 only switch managemet with 10.0.10.0 network
6-add "management vlan 10" command for better securiy switch logon
telnet or wen only this port
7-no need vlan 1 and vlan 2 ip address
so we make strongly sperate two vlan
8-access point configuration will remain the same
and you can connect any port

--------------------firewall config--------------------
firewall configuration will remain the same
only added two dhcp scobe
for 10.14.0.0 network
for 10.15.0.0 network

scobe 1 default gateway address
for 10.14.0.0 must have 10.14.40.254

scobe 2 default gateway address
for 10.15.0.0 default gateway 10.15.10.253

and deny lan to lan routing between interface 0/0 and 0/3
in this way we use access list on firewall:)

your swich role only L2 on network

most secure and easy config

please test

[Ezugo]

hi,

Boss is not happy with using firewal for DHCP on LAN - we currently have two DHCP on LAN for failover.

Firewall would be a single point of failure.

[cenk sasmaztin]

your lan already running current dhcp
other guest vlan running on firewall dhcp with same config

[cenk sasmaztin]

in this way we use two dhcp on your system

your local dhcp on windows machine and your guest dhcp on firewall

[Ezugo]

Hi Cenk,

I've now completed my config: Diagram attached.

I created DHCP on firewall on port 0/3 and it is giving out addresses to SSID 1 correctly.

Users on SSID 2 are using DHCP on the LAN.

It is secure - even if you change IP address and gateway manually while on SSID 1 you are not able to access the LAN.

I still need to complete management vlan.

current switch config:
Startup configuration:

; J8773A Configuration Editor; Created on release #L.10.23

hostname "ProCurve Switch 4208vl"
module 1 type J8768A
module 3 type J8768A
module 4 type J8768A
module 5 type J8768A
module 2 type J9033A
ip default-gateway 10.14.40.254
ip routing
ip irdp
snmp-server community "public" Unrestricted
vlan 1
name "DEFAULT_VLAN"
untagged A1-A24,B1-B17,B21-B24,C1-C24,D1-D24,E1-E24
ip address 10.14.10.254 255.255.0.0
no untagged B18-B20
exit
vlan 2
name "YMGuest"
untagged B18
ip address 10.15.10.254 255.255.0.0
ip helper-address 10.15.10.253
tagged A1,A18,B17,B19-B20
exit

[Ezugo]

I have completed the configurations I was having problems with.

Thanks to Cenk.

Hopefully someone might find the thread/solution useful.