Configuring VLAN’s on two HP procurve switches

130 pts.
Tags:
HP
HP ProCurve
Switches
VLAN
VLAN configuration
Hi all, Trying to route a new ISP(Microwave link) from one of my out building to my computer room and hence my firewall. Old ISP came direct into firewall. In the outbuilding the Microwave modem connects with cat5 to HP Procurve 2524 switch. Because this ISP is coming through my internal network, I plan on using a new VLAN called "airspeed" only for this ISP traffic. Up until now I've just been using the "Default_vlan" on both HP switches (4108 + 2524). So far I've been unable to ping from my laptop to the ISP modem both of which are on the new VLAN 2 ("Airspeed"). No traffic needs to cross from VLAN 2 to VLAN 1 so I've left the ports as untagged. I've used the subnet to provide from my ISP as the new VLAN 2 subnet. Can anybody see what I'm doing wrong here? I've added the configuration of both switch below. Thanks in advance, Rough diagram:

Microwave modem (Gateway IP 77.75.00.49) | HP 2524 switch (port 24) | HP 2524 switch fibre link | HP 4108GL switch fibre link | HP 4108GL switch (port D1) | Laptop configured with IP 77.75.00.50 (for testing but will be connected to firewall) ; J4865A Configuration Editor; Created on release #G.07.21 hostname "HP ProCurve Switch 4108GL" cdp run module 1 type J4864A module 2 type J4862B module 3 type J4862B module 4 type J4862B ip default-gateway 128.1.146.50 snmp-server community "public" Unrestricted snmp-server host 128.1.146.51 "public" Not-INFO snmp-server host 128.1.146.38 "public" vlan 1 name "DEFAULT_VLAN" untagged A1-A3,B1-B24,C1-C24,D2-D24 ip address 128.1.146.203 255.255.0.0 no untagged D1 exit vlan 2 name "Airspeed" untagged D1 ip address 77.75.00.51 255.255.255.248 exit ; J4813A Configuration Editor; Created on release #F.04.08 hostname "HP ProCurve Switch 2524" cdp run ip default-gateway 0.0.0.0 snmp-server community "public" Unrestricted snmp-server host 128.1.146.51 "public" Not-INFO snmp-server host 128.1.146.51 "public" snmp-server host 128.1.146.38 "public" vlan 1 name "DEFAULT_VLAN" untagged 1-23,25-26 no untagged 24 ip address 128.1.146.204 255.255.0.0 exit vlan 2 name "Airspeed" untagged 24 ip address 77.75.00.51 255.255.255.248 exit no aaa port-access authenticator active

Answer Wiki

Thanks. We'll let you know when a new response is added.

You do not need to put any IP addresses on the VLAN 2 interfaces on either switch, that actually does what you don’t want and allows traffic to pass from vlan1 to vlan2, if you don’t put an IP address on vlan2 this can not happen.

What you also need to do is add the fiber ports to VLAN 2 as tagged, on both switches.

This then carries VLAN 1 as the untagged VLAN, and VLAN 2 as tagged, that effectively joins the VLAN 2 ports on the 2524 to the VLAN 2 ports on the 4108GL.

So you need to do the following

on the 2524

<b>vlan 2
no ip address
tagged 25-26</b>

On the 4108GL

<b>vlan 2
no ip address
tagged A1-A3</b>

I assume A1-A3 are the fiber ports, if you only want the Internet to go to the 2524, only tag on the fiber port that goes to that switch.

You should also really put the firewall directly on the modem, and carry the internal Internet subnet on this VLAN. that will give you the maximum security.

Let us know if this works :-)

Discuss This Question: 3  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • Pandub
    Thanks Blankreg, That worked a treat :) If I move the firewall beside the modem, then their would be no need to for vlan 2, I could continue to use the default vlan for my internal network, right? This is how my config looks now; on the 2524 vlan 2 name "Airspeed" untagged 24 tagged 25-26 no ip address exit On the 4108GL vlan 2 name "Airspeed" untagged D1 no ip address tagged A1-A3 exit
    130 pointsBadges:
    report
  • BlankReg
    Glad to be of help :-) Keeping everything on vlan 1 will be fine, and it will allow any of the hosts to have Internet access. The general rule is to firewall as close to the untrusted network as possible, as this reduces the possible vulnerability. Regards, Reg
    12,325 pointsBadges:
    report
  • teamcuvat
    Hello,

    To easily configure HP switches Vlans, you can try free open source LGPL software HP Vlan Simple Administration at https://sourceforge.net/projects/procurve-admin/files/

    It's aimed to manage vlans of all your switches at the same time.

    10 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following