HP 5406 VLAN Routing issue

[Nico_1977]

Hi , Im trying to configure VLAN routing on our HP Switch. At the moment I have the configuration (below) but am unable to ping between the vlans. I've given the client an IP address within the subnet of the VLAN it's assigned to and the gateway is set to the VLAN IP address with a DHCP helper back to the Windows DHCP server.  I have enabled IP routing and also enabled a static route out to the Gateway however no joy.

The aim here is to create VLANS for each of the applications we run, then move clients and services into the VLANS over a period and finally adjust the default VLAN from a /16 subnet. At the moment we have a large variety of applications all running on the flat network on a class B IP with /16 mask and performance is pretty bad to say the least.

Running configuration:

; J8697A Configuration Editor; Created on release #K.14.41

hostname "ProCurve5406-1"
module 1 type J8702A
module 2 type J8702A
module 3 type J8702A
trunk A1-A3 Trk2 Trunk
trunk A9-A10 Trk3 Trunk
ip routing
vlan 1
name "DEFAULT_VLAN"
untagged A11-A24,B1-B7,B9-B24,C1-C2,C4-C24,Trk3
ip address 172.16.50.3 255.255.0.0
no untagged A4-A8,B8,C3,Trk2
exit
vlan 10
name "iSCSI"
forbid A11-A24,B1-B24,C1-C24
untagged A4-A8,Trk2
no ip address
exit
vlan 20
name "Voice"
untagged B8
qos priority 5
ip helper-address 172.16.1.3
ip address 192.168.1.1 255.255.255.0
voice
exit
vlan 60
name "corey"
untagged C3
ip helper-address 172.16.1.3
ip address 192.168.2.1 255.255.255.0
exit
mirror 1 port C17
ip route 0.0.0.0 0.0.0.0 172.16.3.5
interface B20
monitor all both mirror 1
exit
snmp-server community "public" unrestricted
snmp-server contact "support company" location "company"
spanning-tree Trk2 priority 4
spanning-tree Trk3 priority 4

The mirroring ports are for various voice recording equipment we have. I found a few other forum threads on this issue but cant see where I'm going wrong, its probably something stupid but any help would be appreciated!

Thanks

Nico

[Fredrik Lönnman]

That should work. Exactly how is the clients in Voice and Corey VLAN configured? Also you should need some routes in 172.16.3.5 pointing 192.168.1.0/24 and 192.168.2.0/24 towards 172.16.50.3

[Nico_1977]

Hi, Thanks for the reply.

The clients are set up as follows:

VLAN 20 (Voice)

IP: 192.168.1.10

Mask: 255.255.255.0

GW 192.168.1.1 (the IP for the VLAN)

VLAN 60 (corey)

IP: 192.168.2.10

Mask: 255.255.255.0

GW 192.168.2.1 (the IP for the VLAN)

Voice & Corey Clients can ping their GW but not anything out side of the VLAN, Clients in the default VLAN can ping their own VLAN clients and GW but not the new VLANS or the clients within them.

The 172.16.3.5 address is our internet router which is managed by a third party (the leased line provider) so I'll have to request that they make the changes to this device for the routes but thanks for the information there.

Its confusing, its almost like IP routing is not enabled even though the config shows it as being so, I've seen many of these switches work with more or less the same configuration as this, I've even done it myself on one of our customers but just cant seem to figure out this one...

I'll post once I've had the changes to the router done and see if that changes anything...

Thanks

Nico

[James_Levit]

I hesitate to ask....but did you try to reboot?  I have seen funkier things fixed by a reboot :-)

[Mark Wibaux]

I would guess that your machines in the VLAN 1 have a default gateway of 172.16.3.5. If the router at this IP address does not know how to get to the new subnets you created this will be why you can't ping between your new and old VLAN.

You can test routing on the switch by ping each of the switch IPs from a client in one of your new VLANs.

So from the client in vlan60 try pinging

192.168.2.1 (the gateway for the VLAN which should work even with routing off on the switch)

192.168.1.1 or 172.16.50.3 (if you can get to either of these IPs then you know the switch is routing correctly).

If the above ping tests work you could also try changing the default gateway on one of your machines in the 172.16.x.x subnet to point to the switch (172.16.50.3) instead of the router and then test pinging to and from this machine.

[disco_cubist]

Hi,

Any advance here?

I've got near exactly the same setup and can't achieve pinging between subnets on the switch, let alone to an outside IP Address or further down the route to the internet.

How can I verify that Routing is functioning as it appears to be from the switch?

I simply can't ping anything except the machines (and associated VLAN GW addr) on my subnet and a tracert times out.

its like routing isn't enabled but I can clearly see routes in my routing table (show ip route) which I have added, and which are being detected via RIP from my internet router GW addr.

Any helpers, I'm perplexed!!!