This post is more than 5 years old
19 Posts
0
15353
March 20th, 2013 16:00
Help with VLAN Routing
I'm pretty green when I comes to switch and router configurations so please bear with me. I'll layout what I'm trying to achieve and what I've been able to do so far (although it may be completely wrong).
I have an office where we are running low on IP addresses for our LAN, the obvious answer is to get the VOIP phones onto their own subnet. So I have a PC6224 switch that I'd like to use to create the second subnet.
Existing workstation LAN = 172.22.144.0 (255.255.255.0)
Default GW for the LAN = 172.22.144.1 for all devices on that subnet
I'd like to create an IPPhone subnet = 172.22.145.0 (255.255.255.0)
Here is what I've "Achieved" so far:
Currently I can ping from a client on 172.22.145.x to the 172.22.144.12 (VLAN 3 ip interface) but cannot ping any other 172.22.144.x devices that are not directly connected to the 6224 switch. Trying to ping the device on 172.22.145.x network from a device plugged into the 172.22.144.x VLAN on the switch results in packets been sent to the default gateway for the network (172.22.144.1) which does not know what to do with them.
Here is my Running config of the 6224 switch:
console#show running
!Current Configuration:
!System Description "PowerConnect 6224, 3.3.6.4, VxWorks 6.5"
!System Software Version 3.3.6.4
!Cut-through mode is configured as disabled
!
configure
vlan database
vlan 2-3
vlan routing 2 1
vlan routing 3 2
vlan association subnet 172.22.144.0 255.255.255.0 3
vlan association subnet 172.22.145.0 255.255.255.0 2
exit
stack
member 1 1
exit
ip address none
ip routing
ip route 0.0.0.0 0.0.0.0 172.22.144.1
interface vlan 2
name "IPPhone"
routing
ip address 172.22.145.1 255.255.255.0
exit
interface vlan 3
name "TWLAN"
routing
ip address 172.22.144.12 255.255.255.0
exit
username "admin" password 746f7a78621059d80fdc538acc40cbf2 level 15 encrypted
!
interface ethernet 1/g3
switchport access vlan 3
exit
!
interface ethernet 1/g4
switchport access vlan 3
exit
!
interface ethernet 1/g5
switchport access vlan 2
exit
!
interface ethernet 1/g6
switchport access vlan 2
exit
!
interface ethernet 1/g7
switchport access vlan 2
exit
!
interface ethernet 1/g8
switchport access vlan 2
exit
!
interface ethernet 1/g9
switchport access vlan 2
exit
!
interface ethernet 1/g10
switchport access vlan 2
exit
!
interface ethernet 1/g11
switchport access vlan 2
exit
!
interface ethernet 1/g12
switchport access vlan 2
exit
!
interface ethernet 1/g13
switchport access vlan 2
exit
!
interface ethernet 1/g14
switchport access vlan 2
exit
!
interface ethernet 1/g15
switchport access vlan 2
exit
!
interface ethernet 1/g16
switchport access vlan 2
exit
!
interface ethernet 1/g17
switchport access vlan 2
exit
!
interface ethernet 1/g18
switchport access vlan 2
exit
!
interface ethernet 1/g19
switchport access vlan 2
exit
!
interface ethernet 1/g20
switchport access vlan 2
exit
!
interface ethernet 1/g21
switchport access vlan 2
exit
!
interface ethernet 1/g22
switchport access vlan 2
exit
!
interface ethernet 1/g23
switchport access vlan 2
exit
!
interface ethernet 1/g24
switchport access vlan 2
exit
exit
console#
Any help would be greatly appreciated.
Thanks, Grant
0 events found
DELL-Willy M
802 Posts
0
March 20th, 2013 17:00
What port is connecting to 172.22.144.1 the next hop towards the internet?
What needs to happen is we need a separate "isolated" VLAN just for the connection between the 6224 and your 172.22.144.1 next hop internet device.
If 172.22.144.1 stays the same then you need to create another VLAN for "TWLAN" . Possibly, VLAN 4 with an ip range of 172.22.146.1-254 255.255.255.0. Where the interface for VLAN 4 has an IP address set as 172.22.146.1. Once that is completed all the devices connecting to the new VLAN 4 that were in VLAN 3 need to change there IPs and gateway to 172.22.146.1
Then the only port that has configuration for VLAN 3 is the port connecting to 172.22.144.1 the next hop towards the internet. The IP address set on the VLAN 3 interface would need to be in the same subnet range as 172.22.144.1.
Here is a diagram that may help you see the set up. VLAN 100 in the diagram would represent VLAN 3 in your case. Switch 2 would represent your next hop internet device.
DELL-Willy M
802 Posts
1
March 20th, 2013 16:00
Can you provide the output of the command?
console# show ip route
It will provide us a look at your routing table.
1) I see that that you have a default route to an interface on VLAN 3.
ip route 0.0.0.0 0.0.0.0 172.22.144.1
This should point to an interface on your upstream ISP / Firewall (the next hop port towards the internet).
2) You will need to remove these:
vlan association subnet 172.22.144.0 255.255.255.0 3
vlan association subnet 172.22.145.0 255.255.255.0 2
That is not needed when using port based VLANs. When you set up physical ports as switchport access. That is tagging the traffic coming into the port for the VLAN that is specified.
3) If you are connected to port 1/g3 can you ping 172.22.144.12? This should be the gateway address for the device connected to this port and every other device connected to a port configured for access VLAN 3.
4) If you are connected to port 1/g5 can you ping 172.22.145.1? This should be the gateway address for the device connected to this port and every other device connected to a port configured for access VLAN 2.
5) Once both 3 & 4 are successful then try pinging 172.22.145.1 from port 1/g3. Also 172.22.144.12 from 1/g5.
I hope this helps,
Let us know if you have any further questions.
GrantEldridge
19 Posts
0
March 20th, 2013 17:00
Hi Willy, thanks for the help here is the info you requested:
IP ROUTE:
console#show ip route
Route Codes: R - RIP Derived, O - OSPF Derived, C - Connected, S - Static
B - BGP Derived, IA - OSPF Inter Area
E1 - OSPF External Type 1, E2 - OSPF External Type 2
N1 - OSPF NSSA External Type 1, N2 - OSPF NSSA External Type 2
S 0.0.0.0/0 [1/0] via 172.22.144.1, vlan 3
C 172.22.144.0/24 [0/1] directly connected, vlan 3
console#
1) 172.22.144.1 is indeed the next hop towards the internet
2) I've removed the vlan association entries
3) 1/g3 is plugged into switches on the workstation LAN and the 172.22.144.1 gateway. So from 1/g4 in the same VLAN 3 (TWLAN) I can ping 172.22.144.12
4) From 1/g5 I can ping 172.22.145.1
5) I cannot ping 172.22.145.1 from port 1/g4 but I can ping 172.22.144.12 from 1/g5
GrantEldridge
19 Posts
0
March 21st, 2013 08:00
Thanks Willy that confirms my suspicions. The 172.22.144.1 is a WAN router managed by our ISP, when I started this venture I asked them if we should be hanging this 172.22.145.0 subnet off of that router so the WAN and therefore our other sites are aware of the routing. I will talk with them again today and go through the routing and design with them again. They seemed to think we could add a subnet onto our existing LAN at the one office and everything would be able to route, which doesn't make much sense as the WAN routers would have no routing information for the 172.22.145.0 network.
LeeN7
9 Posts
0
March 27th, 2013 22:00
"Currently I can ping from a client on 172.22.145.x to the 172.22.144.12 (VLAN 3 ip interface) but cannot ping any other 172.22.144.x devices that are not directly connected to the 6224 switch. "
All the switchports are access. Assuming 1/g3 or 1/g4 go to the router or another switch, the VLAN 3 tag will be stripped from the outgoing packet. You need to make these either general or trunk ports so the VLAN tag is forwarded to the next switch/router.
You can currently ping a layer 3 device that is directly connected to the 6224 because the vlan tag is not dropped within the switch.
GrantEldridge
19 Posts
0
March 28th, 2013 08:00
After speaking with our LAN provider we will be setting up a "transit" subnet from the WAN router to the 6224 which will have our two subnets defined. They will then add static routes for the new subnets to the WAN routers. Thanks for your help Willy.