VLAN - Routing/ACL Query

[Jeff Carrell]

Paul said:
"You'll see that by having the two 2910's connected to the existing LAN I'll have an L2 network loop that I'm assuming stp/rstp on the Procurve's will sort out?

We already run RSTP on our core Procurve's on our main LAN though I'm by no means an expert on it."

RSTP is the default level of STP that the 2910's should come up to...depends on version of code, they may have upgraded to MSTP, but if you don't configure MSTP, then it operates as simple RSTP.

HOWEVER, spanning tree is NOT generally enabled by default, you must do a 'span' to enable it on each switch.

The other primary thing to do is define which switch is the root and which is the backup root. (Jeff's best practice)

Decide which switch you want to be the Layer2 root (generally the router or close to it) and do a 'span pri 0', and then decide which switch should be the backup root and do 'span pri 1'.

The default priority setting in ProVision is 8 (actually 8*4k, so its 32768, which is the standard).

Refer to the CLI guide ch 18.

Can't remember if I mentioned the CLI Ref Guide, get it, makes things a bit easier if you just want to config things.

Get this CLI ref guide, it shows how to configure HP ProVision, HP Comware5 and Cisco switches for lots of different functions, in a side-by-side comparison, so if you know one CLI, you see how to do it in a different CLI:
http://h10144.www1.hp.com/docs/training/HP-Networking-and-Cisco-CLI-Reference-Guide_June_10_WW_Eng_ltr.pdf

hth...Jeff

[Paul Hutchings]

Thanks Jeff, that CLI guide is useful but not so much for the side by side as I'm not a Cisco person either - more a GUI person with CLI when I have to :-)

I know we're running RSTP/STP on the two core 5406zl's that we have as well as on some other old Baystack's and assorted switches - right now our root bridge appears to be an old Baystack that I think is only root by virtue of having the lowest MAC, it certainly isn't by design and my intention is that when I have a window I want to make the gateway 5406 the root bridge, and the second 5406 the backup.

The LAN isn't supposed to be my responsibility but I seem to keep noticing these things and it gets a little awkward trying to cajole those who should be doing it, into doing it so I seem to end up learning little by little and doing it myself.

[Jeff Carrell]

Happy to help...

I kinda figured the CLI Guide may not be the big help, it is sometimes a bit easier to do stuff without having to slog through the big manuals :-)

A note, the 5400 by default comes up to MSTP when spanning tree is enabled. Of course it can be "rev'd" back to RSTP, and it's ok to do (I suspect that's probably what was done to be fully compatible with those Baystacks.)

Cheers...Jeff

[Paul Hutchings]

Ha I was just reading about MSTP as I was finding myself thinking "What if there's a route between switches that is more efficient BUT the VLAN in question isn't tagged on those ports?" - but I think you've headed me off at the pass with pointing out RSTP defaults to MSTP.

I think "Plan A" is to walk before I run and just get the VLAN's setup and test they work within the switches, then link them and tag the link, and then make sure the VLAN's work over the link, and then uplink each switch to the main LAN and check I still have a network :-)

I'm hoping that as with most things it's all in the planning, and if I've got that right the implementation should be much more pleasant.

[Jeff Carrell]

Paul said:
"I'm hoping that as with most things it's all in the planning, and if I've got that right the implementation should be much more pleasant."

Aw come on now, plan ahead, isn't that like reading the manuals before turning it on - hahahahahaha!

I have been accused for years of ready-fire-aim...

Regardless, don't tell folks how easy this all is or everyone will want to do it, and then the "guru status" gets lost.

I hope it goes well for you, sounds like you are VERY close to it!!!!

Bangers and Mash on me mate!

[Paul Hutchings]

Jeff, up and running albeit early days/testing/staging phase.

The switch management is on VLAN1 (not ideal but as I said we don't use VLAN's on the main LAN right now).

One thing I noticed is that VLAN1 "DEFAULT_VLAN" seems to be the default untagged VLAN on all ports.

On the ports that I *only* want to use in tagged mode, is there any disadvantage to simply using the "forbid" option to stop them being members of VLAN1 for untagged?

It seems daft putting them in a bogus VLAN for untagged traffic?

[Jeff Carrell]

Paul said:
"It seems daft putting them in a bogus VLAN for untagged traffic?"

My best practice is to NEVER use VLAN1 for ANYTHING.

Next to that, then I create a "no-use" VLAN and put all ports untagged into there, then move them to using VLANs when I need them.

Either way, I believe it is the better way to control the use of ports.

Cheers...Jeff

[Paul Hutchings]

Makes sense, as I eluded to earlier, at some point I want to get our main LAN onto VLAN's, for now there's an element of fire fighting I guess.

A "no-use" VLAN sounds sensible tbh - the main thing is I don't want the default VLAN spanning those two switches via the 10gbps trunk.

Thanks,
Paul

[Jeff Carrell]

btw, you can also reassign which VLAN is the "default-vlan"...you may want to create the "no-use-vlan" and assign it to be the "default-vlan" ????

btw2, as long as you don't assign the 10G ports tagged or untagged into VLAN1 on both sides, VLAN1 is isolated across that link.

btw3, a port has to have a home, whether it is untagged into a VLAN or tagged into a VLAN, it just has to have a home.

hth...Jeff