1

My company has just setup some Brocade ICX-6610 switches as our new core. We have them setup in full layer 3 mode, and have started breaking what was once a flat network into multiple VLANs. We have a VOIP vlan, Wifi vlan, and for now we are using the default vlan for clients. We have inter-VLAN working fine, such as pinging across VLANs and accessing devices. The problem is that while VLAN 1 has internet access, no other VLANs can reach the internet. All of our gateways are setup properly to allow traffic between VLANs, but there is no internet access(except from VLAN 1, where the external gateway is located).

Any tips on how to get internet onto the toehr VLANs?

Improve this question
0

1 Answer 1

Reset to default
2

my first guess, assuming the subnet for VLAN1 was around prior and the next hop above the L3 switches is the firewall, is that your firewall doesn't have routes back to the new VLAN subnets. Check your internal routing, see if you get ping responses all the way up and down the routing chain, etc.

Verify routing between the switches and their gateway, verify routing between a client and the firewall, etc.

Now if you have a more complex setup with proxies, or additional routing layers then you'll need to post a pic of your network for more assistance.

Improve this answer
4
  • You are correct, VLAN 1 is the original unchanged(for now) subnet. External requests bubble all the way to the firewall, and routes have been added to the firewall as well to allow them to escape. From the firewall we can see requests leaving,
    – Lee Harrison
    Dec 20, 2012 at 19:58
  • What's upstream from the firewall?
    – joeqwerty
    Dec 20, 2012 at 20:00
  • 1
    @LeeHarrison - The firewall will send it out sure...a simple default route on it will do that, but does it know where to go on the return trip? There should be a route on the firewall such as "VLAN2subnet's next hop is Brocade2ip" or whatever it is. The firewall needs to know how to reach all internal subnets, or at least the "next layer 3 device" downstream from the firewall that can then route it further in the LAN. You need to think bi-directionally
    – TheCleaner
    Dec 20, 2012 at 20:03
  • 1
    You were close, we hadn't setup any NATing inside of the firewall, so none of our requests were being translated properly. They were hitting the firewall and just vanishing. We added NAT rules for each subnet and we are now happily surfing. I'm going to make you as correct anyway since your answer would be correct in most other situations.
    – Lee Harrison
    Dec 20, 2012 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .