HP 1910 JE006A w/ Multi Gateway

[TheDudeJkt]

Hi,

i'm new to HP Products, so far we have 6 1810G JE9803A and 2 1910 JE006A.

I recently trying to setup one 1910 connected to two 1810G switches,

on all of them i have vlan 1 for management, and 3 tagged vlan ( 10,30,40 ).

1910

vlan1 =192.168.10.254

vlan10 = 192.168.110.254

vlan 40 = 192.168.140.254

1810 : 192.168.10.224

PC1  192.168.10.112 gateway set to 1910 ( 192.168.10.254 )   connected directly to 1910  can ping intervlan and internet.

PC2 192.168.110.10 gateway set to 1910 ( 192.168.110.254 ) connected to 1810G on vlan 10 can ping intervlan as well, but not to the internet.

I use 2 ethernet cables configured as BAGG between 1910 and 1810 with untag 1, and tagged 10,30,40.

On many sites, i see the instruction to add default 0.0.0.0 0.0.0.0 to router ( in my case, a pfsense on 192.168.10.2, and 192.168.110.1 for vlan 1 and 10 )

I've tried to add another gateway on 1910 :

ip route-static 0.0.0.0 0.0.0.0 192.168.10.2 preference 10
ip route-static 0.0.0.0 0.0.0.0 Vlan-interface10 192.168.110.1

But PC2 still can not get out to the internet..

Can someone tell me where i missed it ?

Thanks.

[Vince_Whirlwind]

You need to decide which device is routing for your VLANs - the 1910 or the router.

Assuming you use the 1910, you need to remove the LAN interfaces from it, create a point-to-point link between router and switch, and put static routes on the router, for each internal subnet, pointing at the 1910.

Currently, your router has a local subnet that conflicts with your VLAN10 subnet on your switch. If you had tagged VLAN 10 between router and switch, it would probably be working, but that wouldn't be a very good design.

[TheDudeJkt]

Thank you so much for the reply,

but i'm affraid i dont follow you correctly,

If i want to use 1910 as intervlan routing,

I have to remove vlan 10 interface from the 1910,

in PC2 what gateway IP address should I put there ?

And yes i tried with tagged 10 vlan on the cable between router + 1910 + 1810.

Pls bear with me  :D

[Vince_Whirlwind · Accepted solution]

Sorry, I just realised I was thinking one thing and typing something ambiguous - what I meant was, if you want the 910 to do the inter-VLAN routing, you need to remove all your VLAN interfaces from the router, so those interfaces are all on the 1910 instead.

Then, think of it from the 1910's point of view: it is aware of three networks, because they are "connected" - it then needs a default route pointing at the router so it can find everything it isn't "connected" to. Many people patch the router in to one of the existing VLANs and give it an IP address there - this is not the best way to do it (it's a bad way to do it, in fact). You need to create a segment that joins your two layer 3 devices, a segment that doesn't have a bunch of hosts on it, so create a new VLAN (call it "GATEWAY", "WAN", or something like that maybe) on the 1910, and give it an IP address. Patch it to your router where you will need an IP address in the same subnet.

Then, think about it from your router's point of view - how does it know where anything is?

 - Give it a default route pointing out to your firewall or ISP

 - Give it static routes for each of your internal subnets pointing at the 1910.

Nice and simple.

[TheDudeJkt]

Vince, Thanks so much for idiot-proofing the concept to me :D

I attached the new configs i created, sadly the PC on vlan 10 still can't go outside the L3-switch,

I added static route on pfsense :    192.168.110.0/24 via 192.168.10.253

or in other langauge 192.168.110.0 255.255.255.0 192.168.10.253

the weird thing is my pfsense box CAN ping the ip 192.168.110.10,

packet capture running on PC detected echo-request from 192.168.10.2,

So the request from pfsense is forwarded by 1910 to PC2,

but request from PC2 to outside, is not forwarded...

Help ... ?

[Vince_Whirlwind]

First, is the VLANing on the switches configured correctly - can each PC ping its default GW?

If one PC can get out to the internet, then the VLANing to the FW is correct.

Firewall rules on the FW?

[TheDudeJkt]

Vince, I've managed to get them worked !

Turns out there're lots of similar prob. in pfsense forum,

not actually a problem, but common mistake for newcomers..

I have traffic going bot in and out of them now,

Thanks so much for the explanation !

Soon will explore these switches capablity on L3