Problem with basic VLANs and tagging on ProCurve 2626

[Mikko Korsberg]

Hellos

I have a bit of a problem with my little network. I have two ProCurve 2626 switches connected TAGGED. There are two computers connected in a same vlan one in another switch and one in another (I have a 192.168.5.0/24 network).

The ports that have computers connected to them are UNTAGGED. If I'm right (I really should be because of my education, haha) I should be able to ping the computers from anywhere in the network. But this isn't the case, ping don't work. Computers are in a same subnet and vlan so are the switches.

Another problem is that I have the tagged ports between the switches and I've mirrored one of them. Now I'm monitoring the port but I can't see the 802.1Q tags with Wireshark. I ping the switch from another. Should I be able to see the VIDs or no? And what should I do to see them?

Ok, please help me someone.. I've worked just a little with HP so try to cope with me XD.

Thanks,
Mikko

[Mikko Korsberg]

Oh and sorry for this. ICMP messages are allowed in my firewall.

[Mohammed Faiz]

Hi,

Have you tried connecting the computers to the same switch and then pinging each other?
If you can post the configs to your switches we can take a look for any issues there.
The tagging is a strange one, mirroring the port should definitely show you the 802.1q tags. I've just tested it on my test 2610 and I can't see the tag information on my uplink port either so it may be that only the larger switches (5400 series and such) show 802.1q information on mirror ports.
I'll give that a test and let you know what I find.

[Jeff Carrell · Accepted solution]

Quick note on seeing 802.1Q tags in wireshark.

Intel and Broadcom NICs need to have registry modifications in order to see the tags...the switch is passing them thru the mirror port.

Here are a few links and info on the issue:

http://wiki.wireshark.org/CaptureSetup/VLAN

http://www.intel.com/support/network/sb/CS-005897.htm

-------------
If the ethernet NIC is using a broadcom chipset...if so, then review/execute the following:

BASP isn't supported on laptops (and other non-server machines?), but, at least for the BCM5751M NetXtreme Gigabit chips in IBM T43 & HP laptops, there is a registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet that can be set to cause the driver and chip not to strip the 802.1Q headers.

In order to set that key, you need to find the right instance of the driver in Registry Editor and set that key for it. You can do this by doing following:

1. Run the Registry Editor.

2. Search for "TxCoalescingTicks" and ensure this is the only instance that you have.

3. Right-click on the instance number (eg. 0008) and add a new string value.

4. Enter "PreserveVlanInfoInRxPacket" and give it the value "1".

This should set you up to be able to sniff the VLAN tag information.

***Note: This did not start working for me until I rebooted my laptop.
------------


-------
also a bit of info for vmware based systems:

On the vmware ESX server there is an option to set promiscuous mode on the physical nics...otherwise it won't pass the data.

The E1000 driver is an option for ESX server for certain OS's [IE windows server]

You should run the E1000 driver instead of the "VMware Accelerated AMD PCNet Adapter". The E1000 driver is not supported by all OS's so it's not offered to all VM's.
-----

I cannot say this is your exact problem, but this has generally been my problem when I couldn't see 802.1Q tags in Wireshark.

hth...Jeff

[Mikko Korsberg]

Hi,
Thanks for the replies!
Mohammed, I have tried to ping comps connected to a same switch, no work. Here are the configs of the switches:

This switch has a computer (192.168.5.122/24) connected to port 24 and another switch straight to port 26. I guess that DHCP Snooping and ip source-binding (and some snmp server stuff) has nothing to do with the ping (?). I guess that there's something missing or it's just the basic beginner's mistake:

mirror-port 24
no timesync
snmp-server community "public" Operator Unrestricted

vlan 1
name "DEFAULT_VLAN"
untagged 2-22,25
no ip address
no untagged 1,23-24,26
exit

vlan 101
name "VIERAILIJAT"
untagged 1,23-24
ip address 192.168.5.2 255.255.255.0
tagged 26
exit

interface 26
monitor
exit

dhcp-snooping authorized-server 192.168.5.5
no dhcp-snooping option 82
no dhcp-snooping verify mac
dhcp-snooping vlan 1 101
ip source-binding 101...

This switch has a computer connected to port 1 (192.168.5.112/24) and another switch connected to port 26:

mirror-port 1
no timesync
snmp-server community "public" Unrestricted

vlan 1
name "DEFAULT_VLAN"
untagged 2-22,25
no ip address
no untagged 1,23-24,26
exit

vlan 101
name "VIERAILIJAT"
untagged 1,23-24
ip address 192.168.5.3 255.255.255.0
tagged 26
exit

interface 26
monitor
exit

I can ping switches from comps.

Jeff, thanks for the NIC info, very helpful for anyone.
I have looked into it and one of my older laptops has a Realtec NIC that has a setting: 802.1Q/p Virtual LAN... (rest of the text is not showed and I can't find a way to read it). I enabled and disabled the setting but it didn't work. Gonna have to try something else with my Atheros and Realtek NICs.
If anyone has solutions for NICs from these two, feel free to post here.

Mikko.

[Jeff Carrell]

Mikko said "... Atheros and Realtek NICs..."

I have a Linksys ExpressCard32, it has "Marvel" chipset in it...I went to the Marvel website and was able to get a newer driver from them that supports the 802.1Q in captures....even though Linksys (Cisco) didn't....so you might look at those companies support areas to see if they have a newer/better driver.

hth...Jeff

[Jack Howes]

Since you have Vlan interfaces defined on both swithces in vlan 101 can you ping between them? This will be the simple way (negating system issues) to prove if the 101 Vlan is connected betwen the switches.

[Mohammed Faiz]

It sounds like it's an issue with the computers rather than a network one.
Assuming they are Micorsoft Windows PCs, can you browse to one PC from another? (e.g. can you go to "Start -> Run -> \\192.168.5.X" replacing X with the address for the other PC).
If that still doesn't work I'd try temporarily disabling the Windows firewall and trying again.

[Mikko Korsberg]

Hey,
My problems have almost been solved now! Thanks to all.
Windows firewall is disabled on my computers but there's another one that was blocking the ICMP messages. I thought that it wasn't but there was still something missing. Anyways, now I know that there's no prob with that.
About 802.1Q tagging:
I found a comp that has an Intel chipset and used the solution Jeff presented before. It really worked. Just went to the register and add the registry dword to the right place (just be careful where you add it). Best way to find the right one is to check the DriverDesc field if it has the device name.
So now I can see 802.1Q tags but the tagging doesn't seem to be working for some reason. The switches only tag some LLDP frames (the VLAN ID tag is 4095). I have the ports 26 tagged but Wireshark doesn't show any tags (they should be seen under the Ethernet II field). Can anyone tell why the switches don't tag the frames for me? I would guess that it isn't because switches don't tag ping frames?

Mikko.

[Mikko Korsberg]

If anyone is interested anymore.. tagging works for other VLANs but not for the 101 VLAN which is connected to the internet through port 23.. I tested this by making a new VLAN and tagging it to ports 26 and untagging it to port 24 on .3 switch. If I ping from this VLAN, I can see the tags (new VLAN is in .6.0/24 network).
This is very strange for me.. can anyone tell what could my problem be? :D
I have tried monitoring from both switches.

Mikko.