Routing and VLANs on Force10

Hi,

Which model Force10 switch is it? When you set the static route you should be able to set the VLAN it goes to ftp://ftp.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_force10/force10-s55_Reference%20Guide_en-us.pdf page 530.

Well, I guess it isn't as simple as adding static routes.  When I had this:

*S 0.0.0.0/0

via 10.1.0.253, Vl 1 250/0
via 10.3.0.254, Vl 3

Traffic going to the F10 (.250) on vlan 1 (10.1.0.250) got routed to 10.3.0.254 instead of 10.1.0.253....

Not sure of the exact hardware model, but the software is Version 8.3.5.2.

I've tried what you suggested, but that doesn't seem to do what I need.  If I create a default gateway with a different vlan, then all traffic will try to use the gateway on that vlan, and not just traffic coming from that vlan.

It's a little confusing, but basically I want different default routes for vlans 1, 2, and 3.  Each vlan would have a different default gateway, with the gateway residing on the same vlan.  Hosts from one vlan should not attempt to route traffic to the gateway on the other.  Inter-vlan communication/routing would occur in the firewall which has different interfaces acting as a gateway on each vlan.

When you did what I said to do what did the route table look like? I think the problem is that when you are assigning the IP address to the VLANs it is seeing itself as directly connected and giving itself a route to the firewall which doesn’t match what you want to set as a static route. Are the ports between the F10 and the firewall set as a trunk port that passes multiple VLANs?

The way you had it originally configured is a typical setup where clients point to a layer 3 device for their default gateway and not to a layer 2 device that then points to a layer 3.

I'll try and explain a bit further:

We have a VMWare host that trunks to the Force10, and the firewall trunks to the Force10 as well.

The Force10 has layer 3 IP interfaces on every vlan, as does the firewall (following the pattern .250 = F10, .254 = Firewall)

The goal is to have every server set their default gateway to the F10 (.250) for the respective vlan, and then have a default route on the Force10, for that vlan, going to a next-hop that is specified per vlan (10.1.0.5 wants to get to the internet, goes to default gateway 10.1.0.250, gets forwarded to firewall at 10.1.0.254).  I don't want the Force10 to be doing inter-vlan routing.

//I think the problem is that when you are assigning the IP address to the VLANs it is seeing itself as directly connected and giving itself a route to the firewall which doesn’t match what you want to set as a static route. //

Yeah, that seems like the problem.  The default GW has different interfaces for each vlan, so I want routes for each vlan that point at the gateway that is available for each vlan.

Try creating a static route directly from the vlan IP to the correct firewall IP instead of for the subnet and see if it will take precedence over the direct connections. There is not a command that makes it use the static routes.

Can you elaborate a little bit on exactly what you mean there?

In essence, all I'm trying to do is have things on different vlans point to the L3 address of the F10 for each respective vlan, and when they request something outside of that vlan, go to the default gw which can route/acl between them.

When you create the static route after the interface specification for the VLAN also include the ip address you assigned to that VLAN

ip route destination mask { ip-address | interface [ip-address]}

The switch isn’t designed for having a different default gateway for each VLAN which is why we are running into issues making it do that. The way you have it set up currently is the way it is usually set up, where communication within the VLAN is handled at layer 2 and any interVLAN communication is sent directly to a layer 3 device handling the routing. You are wanting the F10 to handle all traffic and then if it needs to be routed it gets sent to a default gateway for each VLAN, this might not be possible, as soon as you put an IP address on a VLAN the direct connection between that and the layer 3 device overrides the static route, what I said at the beginning of the post might work as a way around this, but if it doesn’t there may not be a way to do it.