Comware

Hello,

I have an Aruba 2530 running YA.16.10.0013 . The switch is connected to a Watchguard Firewall that is performing the routing. Two interfaces are configured on the Router. Interface 1 is the default untagged VLAN (10.x.x.x/24) and Interface 2 is a VLAN (VLAN 2) interface configured with a DHCP enabled VLAN (10.10.x.x/24) and is delivering tagged traffic.)

The default VLAN is untagged on all ports on the 2530. VLAN 2 is tagged on all ports on the 2530.

Interface 1 is connected to the 2530 on port 1 and Interface 2 is connected to the 2530 on port 2.

The default VLAN is forbidden on port 2 of the 2530.

When I connect a computer whose nic is tagged with VLAN 2 to a VLAN tagged port on the 2530 (for example port 10) the system gets an ip address, DHCP settings, DNS etc... from the router but then has no network connections. I can not ping the default VLAN and I can not get internet. The router has a route allowing all traffic between the two VLANS in addition to allowing traffic to the web.

Any help is appreciated.

One more note: I did setup an HP 1820 switch and tested VLAN configuration. Everything works without issue. However, the VLAN setup is slightly different with PVID etc...

Hello,

Have you untagged the vlan 2 for port connecting to computer?

In Aruba Untageed is for Access port and Tagged for Trunk port.

e.g

vlan 2

untagged <port number connecting to PC>

Thanks!

Untagging the switch port connected to the computer allows access.
However, that is not my issue. My issue is if I connect the PC to any port that has VLAN 2 as tagged while the PC NIC is configured for VLAN ID 2, I will get an IP address bit have no network access.

Hello,

What is the port number connecting to PC and please share 'show vlan 2' output?

 

Thanks!

PC connected to port 13. Have tried 9,10,11,12 as well.

[cid:image001.jpg@01D73DDB.47D5B900]

Hello,

I am unable to see attached image.

 

Seeing only this:

[cid:image001.jpg@01D73DDB.47D5B900]

 

Thanks!

I am sorry, I can not seem to upload the image.

VLAN ID 2

Name: test

Status: Port based

Voice: no

Jumbo: no

Port 1-52 Tagged

Hello,

Thank You for sharing output.

Assuming port 13 is conencted to PC.

Could you please  run below command and check

#config t

# vlan 2

# untagged 13

# exit

Thanks!

Thanks for the reply. I do not want to untag 13 my NIC card is configured for VLAN 2 tagged

Hello,

I understood your PC NIC card is configured for VLAN 2 but as per command output connecting port 13 is a tagged (trunk) port.

You need to make port 13 untagged (access) port for vlan 2 to do communication with PC.

Thanks!

Thank you for the reply. If I untag that port, how will any other tagged VLAN that connects to that same port at a later time be able to get an IP and connect to network resources for their respective VLAN?

Hello,

If you will untag port 13 for vlan 2 then PC will work only for vlan 2 only not for any other vlan.

Thanks!

Thank you for the reply. Yes, I know. However, it does not allow me to configure multiple tagged VLANS on the router, configure tagged ports on the switch and connect to corresponding VLANS with various devices. It is almost as if the 2530 needs a route but it is not a layer 3 switch.

Oddly, this works without issue using an HP procurve 1820 switch. The 1820 allows for changing the PVID on a per port basis which seems to allow the tagged traffic to be directed to and from the router instead of staying in the switch. As such, I would believe the same could be made to work with the Aruba 2530. However, I do not see a setting for changing the PVID per port.

Additionally the 1950 series works as well if you change the port type to Hybrid keeping untagged on default VLAN and allowing tagged traffic on other VLANS.

Thank you for your contributions.

Hello,

 

PVID concepts comes when port is hybrid port.

Here Port 13 is not a hybrid.

Thanks!

Thank you for the reply.

Do you know how to make a port on the 2530 a hybrid port?

 

Why you need Hybrid port?

I don't see an issue in wanting a NIC port VLAN id tagged (example VLAN id = 2) to be connected on a port tagged member of the very same VLAN id...you can do it and it must work.

A port can be untagged member of one VLAN only but can be tagged member of more tagged VLAN (and can be "orphaned" by being without a untag membership...to do that it need to be tagged on another VLAN first).

Say port 13 is untagged member of VLAN id 1 (default) then:

vlan 2

tagged 13

exit

vlan 1

no untagged 13

make port 13 only tagged member of VLAN id 2.

An host need to be properly set to speak (sending tagged outgoing packets and accepting tagged incoming packets) with VLAN id 2 set as VLAN id of its NIC's port...in other terms that host needs to be VLAN aware.

Thank you for the reply. I understand. I suppose what has confused me the most is why, if the port is tagged on VLAN 2 and the computer nic is set to VLAN 2, does the computer get an ip address from the DHCP server (on VLAN2) but can not communicate with the network (VLAN2)? A route issue??

In order to get the computer to communicate, to the network with a tagged VLAN, I must connect a switch port to the router using an untagged VLAN. This means I am using two ports of my router and switch. (VLAN 1 and VLAN 2) both untagged on two seperate switch ports (with the opposite excluded). Further, in this config I can not use a ROUTER VLAN port to send multiple VLAN's on one interface because once it gets to the switch the device connected to a switch port will not be able to communicate (again will receive ip address but no further communcation).  The 2530 is a layer 2 switch but it is almost active like a layer 3 switch at the OSI level? (No route back out to the router once DHCP has sent the ack for address?)

 

Can you draw it?

The Aruba 2530 has no routing features so you really need to use an
external router to route between directly connected VLANs.

Suppose you have VLAN 10 and 20 defined and addressed on your Router, say
10.0.10.254 and 10.0.20.254 just as example (that way the router is
configured to act as the "gateway" for its connected peers located on those
subnets), and suppose both VLANs are configured on the very same physical
Ethernet interface (how you do that it depends by the router), the same is
valid if you use separate Ethernet interfaces on your Router, each one
carrying just one VLAN (in any case outgoing packets originating from VLAN
10 are tagged leaving the interface going to your switch and, conversly,
incoming VLAN 10 tagged packets are accepted on the very same interface
reaching the Router VLAN IP interface from the Switch...the same is valid
for VLAN 20)...well...in this case your switch needs that the uplink
interface (or interfaces) to the router is a tagged member of both VLAN 10
and 20. That is...now you can have, access side connected to your Aruba
switch, a VLAN unaware host connected to a port which is an untagged member
of VLAN 10 or 20 (not both) or you can have an aware VLAN host (you set a
VLAN id explicitly, say 10 or 20) connected to a port which is a tagged
member on the same VLAN id of the host (no VLAN ids match, no traffic)...in
both cases...that host, properly IP addressed, should be able to - at least
- ping its gateway and hosts in the very same VLAN (Subnet). That is the
basic to start with.

It's just one among some possible scenarios.

Nobody will force you proceeding by tagging or untagging a particular port
(access use, uplink use), I mean that it could also work by using - say -
different uplink ports each one untagged respectively on VLAN 10 or 20 but,
you know, why not to use a single link uplink carrying multiple VLANs at
once instead (Cisco guys will call it "a trunk port" while for HP ProCurve
guys the term "trunk" is used to represent a links aggregation which is not
necessarily related to VLAN tagging, even if a links aggregation interface
acts quite like a physical port in terms of VLAN tagging capabilities):
each port can carry (send outgoing/accept received) untagged packets (so no
tag, only one choice here) and eventually packets with various tags (many
tags)...so it's up to you to decide the way a packet flows along its
journey through your network (considering that internally to a switch
packets travel with tags).