1

I have been looking around and trying to find ideas on how to isolate a test lab from our main network whilst still allowing the test lab access out to the internet.

At the moment, our main network is on a 10.11.23.x subnet. To this we have added a Cisco Catalyst WS2960 on 10.11.23.245. I have created vlan23 on this switch, 10.11.23.245 and vlan192, 192.168.0.252.

Physically plugged into vlan23 of this switch is eth0 of a a HP desktop server running CentOS. Plugged into vlan192 of the switch is eth1 of the same HP machine.

So the switch config shows:

interface Vlan23
 ip address 10.11.23.245 255.255.255.0
!
interface Vlan192
 ip address 192.168.0.252 255.255.255.0

And the CentOS box shows:

eth0      Link encap:Ethernet  HWaddr A0:48:1C:D6:8D:78  
          inet addr:10.11.23.212  Bcast:10.11.23.255  Mask:255.255.255.0
          inet6 addr: fe80::a248:1cff:fed6:8d78/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4463062082 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4058451942 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1677558138503 (1.5 TiB)  TX bytes:1109258225607 (1.0 TiB)
          Interrupt:17 

eth1      Link encap:Ethernet  HWaddr A0:48:1C:D6:8D:79  
          inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::a248:1cff:fed6:8d79/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2983685 errors:1 dropped:0 overruns:0 frame:2
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:231387664 (220.6 MiB)  TX bytes:522 (522.0 b)
          Interrupt:18

From the CentOS box I can ping anything on vlan23 but nothing on the private test LAN, vlan192. Same goes for the switch, it can't even ping eth1 on the CentOS box which is physically plugged into one of its own ports.

We want vlan192 to remain invisible from vlan23 as we are setting up a test domain controller and want to be sure that its not interfering in any way however, the gateway out to the internet is 10.11.23.254. Can this be done?

Thanks in advance for any suggestions.

Improve this question
7
  • I don't understand the question. Are you trying to ping across VLAN's? If so, you need a router to route traffic across the VLAN's.
    – joeqwerty
    Feb 22, 2016 at 16:53
  • Initially I would like my two devices, both on vlan192 to be able to ping each other. The switch on 192.168.0.252 and the CentOS box on 192.168.0.100 cannot ping each other despite being plugged into the same switch on the same vlan. I don't want vlan192 and vlan23 to see each other.
    – Becky
    Feb 22, 2016 at 16:57
  • I still don't understand. The switch on 192.168.0.252 and the CentOS box on 192.168.0.100 cannot ping each other despite being plugged into the same switch on the same vlan - So the switch is plugged into a switch? What does that statement mean? Are you pinging from the correct VLAN interface? You do this using the extended ping command.
    – joeqwerty
    Feb 22, 2016 at 17:00
  • Sorry no, my bad. The CentOS box is plugged into the switch that it cannot ping. There is only one switch involved and I am using fe01of that switch which has been assigned to vlan192 using IP 192.168.0.252. I hope that clarifies things.
    – Becky
    Feb 22, 2016 at 17:11
  • 1
    eth1 on the CentOS box is showing errors, etc. Have you looked at the interface counters on the switch for the port that the CentOS box is plugged into? What are the speed/duplex settings on the switch port configured as?
    – joeqwerty
    Feb 22, 2016 at 17:15

1 Answer 1

Reset to default
0

If you've got a firewall between the test VLAN and the main gateway, try making a rule that allows access to "not 192.168.0.0/16, 172.16.0.0/16, 10.0.0.0/8". This should amount to " allow access to everything not on a private network", which is the internet. I'm no expert but I've got a VLAN of isolated servers at home set up with a rule like this and it can access the internet and its own VLAN, but nothing else.

Improve this answer
1
  • Thanks for the idea. I'm not sure I understand what you mean on this one though. There is no firewall between vlan23 and vlan192. Our firewall is on a completely different subnet all together (10.11.1.x) but we can't even get things to communicate on vlan192 yet, so maybe we need to take littler steps before we address the internet access issue?
    – Becky
    Feb 22, 2016 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .