Help needed with 6248, VLAN, new dhcp range

Basically, you will need to have a switchport access mode set for a VLAN on any port that is connecting to a VLAN unaware end device.  That will tag any traffic coming into the port for the specified VLAN.

console# configure

console(config)# interface ethernet xxx

console(config-if)# switchport mode access

console(config-if)# switchport access vlan xxx

Any ports that are connecting to the VMware server will be in a general mode (mix between trunk and access mode) that allows tagged and untagged VLANs.  Since that would be connecting to a Vswitch.  Any switch to switch connection would need to allow multiple VLANs to move across the connection.

console# configure

console(config)# interface ethernet 1/g1

console(config-if-1/g1)# switchport mode general

console(config-if-1/g1)#switchport general pvid 1

console(config-if-1/g1)# switchport general allowed vlan add 100 tagged

The PVID command designates the native VLAN for the interface.  This will need to be the same on the other end of the connection. In order to allow native VLAN traffic across the connection properly.

The IP Helper feature allows the switch to forward certain configured UDP broadcast packets to a particular IP address. This allows various applications, such as the DHCP relay agent, to reach servers on non-local subnets, even if the application was designed to assume a server is always on a local subnet and uses broadcast packets (with either the limited broadcast address 255.255.255.255, or a network directed broadcast address) to reach the server.

If you want to reply back with the running config off the switch we can take a look.

Just figured out in my config that the line ip route 0.0.0.0 0.0.0.0 192.168.250.254 wasn t correct. Replaced it with this one ip route 0.0.0.0 0.0.0.0 192.168.90.2 which is the default gateway (our Juniper Firewall)

Thanks Willy for your answer.

Based on what you told me and what I have reading here and there I came up with the below config but however still no luck. I am sure I am missing something but what ... :)

I managed to used one free port on one of my hosts that is connected to port 30 on the 6248 so I don t impact the prod network.

I have installed a new dhcp server (192.168.90.56) that has the range 192.168.30.0/24 ready for distribution. (90.20 is the prod dhcp that holds the other range)

I have a test Windows 7 machine

Both are connected to the same VMware  virtual switch connected to port 30 on the 6248. It has 2 portgroups. One with no vlan defined in it where the dhcp server is connected. One portgroup with vlan 30 specified where the test win 7 is connected however no ip is received for that machine

In the below switch config the vlan 10 is for our guest wireless that is routed to our Juniper Firewall.

Thanks a lot for any assistance you will provide ;)

!Current Configuration:

!System Description "PowerConnect 6248, 3.3.1.10, VxWorks 6.5"

!System Software Version 3.3.1.10

!Cut-through mode is configured as disabled

!

configure

vlan database

vlan 10,30

vlan routing 10 1

vlan routing 30 2

exit

stack

member 1 2

exit

ip address 192.168.90.226 255.255.255.0

ip default-gateway 192.168.90.2

ip name-server 192.168.90.20

ip name-server 192.168.90.30

ip route 0.0.0.0 0.0.0.0 192.168.250.254

ip helper-address 192.168.90.20 dhcp

ip helper-address 192.168.90.56 dhcp

interface vlan 10

name "Wireless_GUEST"

routing

ip address 10.10.0.1 255.255.254.0

exit

interface vlan 30

name "View"

routing

ip address 192.168.30.1 255.255.255.0

ip helper-address 192.168.90.56 dhcp

exit

username "......." password a......5 level 15 encrypted

!

interface ethernet 1/g12

switchport access vlan 10

exit

!

interface ethernet 1/g13

switchport mode general

switchport general allowed vlan add 10 tagged

exit

!

interface ethernet 1/g30

switchport mode general

switchport general allowed vlan add 30 tagged

exit

exit

That is good to hear.

Now that you have the routing pointed to the right gateway is everything responding as you like?

Hi Willy,

unfortunately still no luck. Been scratching my head on this a long part of the day and for some reason the test machine on the tagged portgroup cannot ping anything.

If you confirm me that the given config is the right one then it might be the uplink to our Juniper firewall that is blocking something.

I have changed the uplink to the Juniper firewall to General allowing 30 tagged, defined the basics, set a fixed ip address on my test machine just in case but I am not able to ping it.

If you confirm that the 6248 given config is fine then it comes from the Firewall. In that case I have a support contract for it. I can maybe get in touch with someone for it.

Cheers

Hi again Willy,

as expected the Juniper tech guy I had on the phone today told that of course I have to specify those vlan in the SRX otherwise traffic is dropped. It also recommends not to use the native vlan 1 with other vlan along even if it would work. So I am now left with a complete network redesign yipeeee that was not really in the original plan.

But as usual things in IT can become quickly so complicated.

Thanks a lot for your expertise

Cheers

on the Juniper SRX side it would look like this (not tested however as I don t want to impact prod but should work)

[edit interfaces fe-0/0/0 unit 0]

+      family ethernet-switching {

+          port-mode trunk;

+          vlan {

+              members [ 30 1 ];

+          }

+          native-vlan-id 1;

+      }

[edit interfaces]

+   vlan {

+       unit 1 {

+           family inet {

+               address 192.168.1.1/32;

+           }

+       }

+       unit 30 {

+           family inet {

+               address 192.168.30.1/32;

+           }

+       }

+   }

[edit security zones security-zone trust interfaces]

     fe-0/0/0.0 { ... }

+     vlan.1 {

+         host-inbound-traffic {

+             system-services {

+                 ping;

+                 ssh;

+             }

+         }

+     }

+     vlan.30;

[edit]

+  vlans {

+      default {

+          vlan-id 1;

+          l3-interface vlan.1;

+      }

+      vlan-30 {

+          vlan-id 30;

+          l3-interface vlan.30;

+      }

+  }