Can't reach DHCP, unsure about how to set up multiple default gateways on multiple VLANs

[nathan.warren]

Hello there.

I'm trying to create an environment with two VLANs, guest and corporate, both using different default gateways, but able to ping IPs between VLANs. I need to have DHCP leases issued by the server rather than the router, but I'm having some trouble reaching the best way to do this.

Here is what I've got so far:

I'm wondering whether the fact that 0/0 and 1/0 on the router operate on different subnets has something to do with not being able to connect to the DHCP service on the server, but regardless of which VLAN I connect one of the laptops to it still doesn't pick up an IP from it.

I've disabled DHCP on the router, this didn't help.

Should I be connecting the router to a Layer 3 switch? Is that the right approach? The two layer 2 switches need to be able to communicate with each other, they're both VTP clients to the layer 3 and I've checked that they've copied the VLAN database properly.

The 6 cross over cables form two etherchannels, something I've never set up before, so I also have concerns that I'm going wrong there as well.

I've attached the pkt file in case I'm not making anything clear (I'm sure that's the case), any tips or pointers in the right direction would be really appreciated.

[Jon Marshall]

Most of us can't read PT files as we don't use it.

Can you clarify where the L3 interfaces for your vlans are ie. on which device ?

If is the L3 switch then you need to use the "ip helper-address <DHCP server IP>" command under the "interface vlan <x>" configuration for each vlan.

If the L3 interfaces for the vlans are meant to be on the router are you using subinterfaces ?

Perhaps you can post the config of the L3 switch and router ?

Jon

[nathan.warren]

Ah my mistake.

The L3 interfaces are on the L3 switch (I believe? I have very little experience doing switch configuration I'm afraid ..). I think I tried doing ip helper-address on the VLANs but it didn't help, I've just tried again and still no DHCP.

The router's only purpose is as a default gateway and to connect the server to everything else, though if there's a better way of doing this I will more than happily try it.

Configs attached below ..

[nathan.warren]

Attached these for good measure.

[Jon Marshall]

Okay there are two main problems -

1) looking at your diagram the fa0/0 interface on the router is using 10.1.0.254/24.

But you also have vlan 100 on your L3 switch using the same IP subnet which you can't do because in between those two is the 10.2.0.0/24 network and you cannot route to the same IP subnet.

Once you fix that then you have the following issue -

2) routing ie. you need to tell the L3 switch about the routes to the DHCP server subnet and the router about the route(s) to the L3 switch subnets.

So firstly can you check something in PT for me. Can you try configuring a port on the L3 switch as a routed port ie. pick an unused port and try -

int <x>
no switchport
ip address x.x.x.x <subnet mask>

and see if it works.

If it does then we will use a routed port to connect the router to the L3 switch.

What you will also need to do is decide where 10.1.0.0/24 is going to be ie. on the L3 switch or more likely on the router and the DHCP server.

Finally which port on the L3 switch is connecting to the router.

If you can get back to me on those things I'll explain what changes you need to make and why.

Jon

[nathan.warren]

I've moved the fa0/0 on the router from 10.1.0.0/24 to 10.3.0.0/24, and fa0/1 from 10.2.0.0/24 to 10.4.0.0/24, the default gateways for the two subnets are supposed to be:

10.1.0.254 & 10.2.0.254

And the range on the DHCP scopes are supposed to be:

10.1.0.10 -253 /24 
10.2.0.10 -253 /24 

I guess that's not possible? Or am I setting the IP/subnet wrong in VLAN 100 & 200? I'm happy with working around it for now so I can get everything up and running, this is the first time I've tried anything like this before.

I've configured fa0/18 as a routed port to 10.3.0.254 255.255.255.0, it seemed to work just fine.

When you say where 10.1.0.0/24 is going to be, what do you mean? It's on the DHCP server as a scope already, it's supposed to be the subnet anyone connected to a VLAN 100 port gets assigned to.

fa0/7 on the router connects to the router.

Thank you so much for your help!

[Jon Marshall]

When I say where is it meant to be I don't mean as a scope I mean physically on your network. So your original setup looked like this -

10.1.0.0/24 vlan 100 -> L3 switch vlan 200 -  (10.2.0.0/24) - fa1/0 router fa0/0 (10.1.0.0/24)

you can't do that because you have separated the same IP subnet by another IP subnet and that doesn't work because with a vlan/IP subnet you L2 switch not L3 route.

If you want to route the vlans on the switch then your default gateways are wrong because they are for the router IPs so again that wouldn;t work. If you wanted to do the routing for the vlans on the router you would need a trunk link from the switch and you would use subinterfaces on the fa1/0 interface of the router.

You can use the DHCP scopes you have but it depends on where you want to do the routing between vlans as to how you configure the rest of your equipment.

So if you let me know I can provide the configuration.

In addition if there is anything that I am saying that isn't making sense then please ask as it is a useful learning exercise for you so I don't just want to say do this and leave you unsure as to why you are doing it.

Jon

[nathan.warren]

Okay I understand what you mean now, in that case the vlans need to be routed on the switch not the router, one of the reasons I'm doing this is to learn how to route traffic from different vlans through an L3 switch.

I thought that if I assigned the router interfaces with those IPs then that would make those IPs the default gateways, I didn't realize it assigned the whole subnet .. that is what's happening, right?

I appreciate you saying that, this is all the result of 12 hours of cramming research and at times I'm feeling a bit out of my depth with it, so your advice and help is invaluable to me. I'm confident that I understand what you're saying, but if you feel there are things that I'm misunderstanding please tell me, I'm eager to learn as much as possible, I'm new to this and I don't want to start off with the wrong impression or an incomplete understanding of what I'm doing.

[Jon Marshall]

I didn't realize it assigned the whole subnet .. that is what's happening, right?

Yes, that's exactly what is happening and why it doesn't work.

So the first thing is your DHCP. If your default gateways in the scopes are .254 for both scopes then you need to readdress your SVIs for vlan 100 and 200 on the L3 switch to use those IPs.

While you are doing that also add under each SVI the ip helper-address ie.

"ip helper-address <DHCP server IP>"

That has setup your SVIs correctly.

The next thing is the routed connection between the L3 switch and the router. You could in theory leave it in vlan 200 but you have already readdressed the router interface and using a separate L3 P2P link is a better design.

So you now need to configure fa0/7 on the L3 switch to have an IP from that subnet eg.

int fa0/7
no switchport
ip address 10.4.0.x 255.255.255.0

note for your reference for a P2P L3 link like this you generally use a /30 subnet which gives you two useable IPs one for each end but no issue with a /24, it will all work fine.

The only thing left now is routing. Your L3 switch needs to know how to reach 10.3.0.0/24 where the DHCP server is and your router needs to know how to get to 10.1.0.0/24 and 10.2.0.0/24.

You can either use statics or run a dynamic routing protocol. Lets use statics to get it working and then if you want you can try out a routing protocol later.

So lets say fa1/0 on the router is 10.4.0.1 and fa0/7 on the L3 switch is  10.4.0.2.

On the router -

ip route 10.1.0.0 255.255.255.0 10.4.0.2
ip route 10.2.0.0 255.255.255.0 10.4.0.2

on the L3 switch

ip route 10.3.0.0 255.255.255.0 10.4.0.1

then just make sure any clients have their ports allocated into the right vlan for that client.

You should then be able to receive IPs and route between the clients on the L3 switch.

Any issues, queries, clarifications etc. let me know.

Jon

[Jon Marshall]

One other point I just noticed.

When you tested fa0/18 with an IP from 10.3.0.0/24 make sure you remove that and shut the port down as this subnet is now on the router.

Jon