1

I'm currently configuring a network switch (an HP procurve-8212) from scratch. To start off, I'm trying to configure a simple LAN and WAN connection. I have an Internet provider that provides me with a Gateway I can use for WAN access.

So I'm a bit confused about some basic concepts here concerning the IP address of the switch itself. So, obviously, the switch itself requires an IP address if it is to be accessed by other devices on the network (apart from direct serial connection). Now, it's easy to set an IP address for the switch, but it's not clear to me whether the IP address of the switch is supposed to be an internal LAN address, like 10.0.0.1 or something, or an external WAN IP address that is within the range of static IPs that was assigned to me by my Internet provider. Or thirdly, if I need to configure multiple VLANs, one for LAN and one for WAN - or perhaps all of the above are possible but there are different tradeoffs/security implications.

So to simply experiment with a basic configuration, I assigned the switch a LAN address of 10.0.0.1 and gave a subnet mask of 255.0.0.0 for a /8 network covering 10.0.0.0 to 10.255.255.255. (I'll change this all later, but I'm just trying to experiment with a basic configuration.) And I give the switch a Gateway address provided by my ISP. All of this is part of a single default VLAN.

This works on the LAN side. I configure all devices attached to the switch with a static IP, and now all devices can ping the switch, and also ping each other.

However, I'm unable to get WAN access working. My understanding is that the switch should be configured to use the Gateway provided by my ISP, and then any device attached to the switch should use the address of the switch itself as the Gateway. (Again, later I'll add an intermediate firewall, but for now I'm just experimenting with a basic configuration.)

So my understanding is that, given an arbitrary computer attached to the switch, if I statically assign a LAN IP to that computer, and then configure that computer to use the LAN IP address of the switch as its Gateway, then the computer should be able to access the Internet (since the switch is its Gateway, and the switch's Gateway is the Gateway provided by the ISP.)

However, I'm not able to ping any actual Internet addresses from a computer attached to the switch. (I don't have DNS working yet, but I obtain the IP address of google.com from my smartphone and then try to ping that, and it doesn't work.)

Again, I'm able to ping the IP address of the switch (which is a LAN IP), and I can also ping any IP address over the LAN, but I cannot access the Internet from any device connecting to the switch.

So, there are multiple points of confusion here, so it's difficult for me to distill this into a single coherent question, but my best attempt at doing so would be:

  1. Should the IP address of the switch be a LAN or WAN address (or what are the implications of doing either), and how should the switch be configured so that any device connected to the switch can access the Internet?

  2. Does my question itself indicate I am missing some key concept here? I suspect I am probably missing a key concept here, (perhaps I need to specify routing rules or a default route?) but since I don't know what that concept is, it's hard to formulate a specific question about it.

3 Answers 3

6

Does my question itself indicate I am missing some key concept here?

Yes. You are dealing with a switch: it's not a router. You can use a L2 which for

  • a private network
  • a public network
  • both, using VLANs.

A L3 switch like HP Procurve 8212 is additionally capable to

  • route between private networks
  • route between public networks.

But you can't use it as a gateway here, as it wouldn't do network address translation (NAT) between public and private networks. Your router is supposed to do that.

0
2

Networking is generally approached in terms of "layers". Each layer builds on the last.

Wires move electricity around; this is called layer 1, or the "physical" layer. This is stuff you can touch with your fingers.

Switches move Ethernet frames around; this is called layer 2, or the "data link" layer. This layer knows nothing of IP addresses or routers. (More recently, this is a "layer 2 switch".)

Routers move IP packets around, this is called layer 3, or the "network" layer. A gateway is another term for a router. (More recently, "layer 3 switch" became another term for a router. It gets confusing.)

Very loosely speaking, you can think of Ethernet cables as roads, Ethernet frames as vehicles on those roads, and switches as intersections with traffic signals. IP packets would be cargo inside the vehicles, and routers would be the shipping manifests. Switches and frames (vehicles and roads and traffic lights) go together, but the cargo and the manifests are outside of the scope of the people designing the roads. (This is not a perfect analogy.)

Nominally, switches (layer 2 switches) are completely unaware of the network/IP layer. One only needs to assign an IP address to a switch (layer 2 switch) to manage it. Cheaper switches are not managed, and will not have an IP address associated with them at all.

Conceptually, think of a managed switch (layer 2 switch) as a layer 2 device with an itty-bitty computer inside it. The switch part moves frames aroumd; the computer is used for management, and is plugged into an internal switch port using an itty-bitty Ethernet cable. (This is not a perfect analogy.)

It's not clear what the gateway/router your ISP gave you looks like, i.e., physical ports, and IP address configuration. They may be doing routing on the gateway, they may be doing NAT, too; or both, or neither. So I can't speak to that very well.

If you have public, routable IP addresses on an Ethernet port on the gateway (a delegated subnet), as provisioned by your ISP, then you have a tiny corner of the Internet you can put whatever you want on. That might well be something you put in one VLAN on the switch.

You then will likely want a firewall somewhere, likely with NAT, for your private network. That model switch does have some basic routing capabilities (layer 3 switch), but I believe it lacks even NAT capability, and certainly has nothing I would trust as a firewall.

So typically you would get another device to act as a firewall, and plug that into the switch. You would put both the gateway/router and the firewall both on the same public/WAN/whatever VLAN, and assign the firewall a public IP address on that VLAN.

Then you would make another connection between the firewall and switch, for the segregated private/local/whatever VLAN. This could be with a second cable and switch port, or, if the firewall supports it, you can put all the VLANs on one cable to the firewall (sometimes called "router on a stick").

If you need more specific answers, please ask more specific questions. :-)

1

What you're missing is a NAT-capable gateway/firewall. You want a server with multiple network ports running something like pfsense or Untangle, an appliance like a Watchguard or Sonicwall, or a real router like an HP MSR-50 or Cisco ISR.

Once you have that, you setup one interface on your new router/firewall with an external address from your ISP, connect it to your ISP modem, and setup NAT on the connection. Then you can assign internal addresses to your switch and another port on the firewall, and connect the two. When setting up the rest of your network, have your dhcp server hand out the firewall's internal address as the default gateway.

If multiple vlans are involved, you need to decide whether the firewall or the switch will handle inter-vlan traffic. That will determine whether you need additional (possibly virtual) interfaces on the firewall (that are also configured on that switch port), as well as what the dhcp server hands out for the router/default gateway address, and other configuration items in the switch.

2
  • 1
    Unfortunately, the switch doesn't do NAT.
    – Ron Maupin
    Nov 27, 2017 at 23:43
  • Ah. He'll definitely want the NAT-capable firewall, then. Working on a re-write.
    – Joel Coel
    Nov 27, 2017 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .