I'm having problems with hosts being able to ping other hosts they shouldn't be able to communicate with.
Fairly simple network - relevant hardware:
- HP Procurve 2810-24G switch
- Juniper Netscreen 208 firewall
- Netgear GS-108PE switch
I simply want to accomplish 2 objectives: use the HP switch for serving both the Trust and DMZ subnets (using VLANs), and run an 802.1Q VLAN trunk to the Netgear switch so its ports can have access to more than one VLAN in the rest of the network.
I used to do this with an identical HP switch (which failed and has been replaced) and before that an HP Procurve 2400M switch.
I have 3 VLANs configured:
- ID: 1 (DEFAULT_VLAN - can't delete)
- ID: 2 (DMZ)
- ID: 3 (Trust)
I have assigned 2 separate groups of ports on the HP switch as untagged VLAN ports for VLANs 2 and 3. I have assigned 2 "trunk" ports as tagged VLAN ports for VLAN 2 and 3. The 2 trunk ports connect to a port on the Netgear switch, and a port on the old HP switch. (Mostly for testing) The Netgear and old HP are configured similiarly to the new HP in regards to VLANs, untagged and trunk ports.
The firewall has its DMZ and Trust interfaces connected to each of the appropriate groups of untagged VLAN ports on the new HP switch. The firewall is set to block almost all traffic by default to/from the DMZ and Trust networks to each other, except for very limited things. ICMP for sure is blocked.
I have connectivity to/from the internet on both the Trust and DMZ port groups on all the switches. The problem is, I can also ping DMZ ports from Trust ports/hosts, on any of the switches. But I cannot ping from DMZ hosts to Trust hosts.
Needless to say, this sort of shoots down the point of having the segments firewalled from each other.
I have tried changing the Default VLAN from 1 to 3, I have tried disconnecting the non-core switches, I have tried disconnecting any devices which have multiple interfaces eg where one connects to VLAN 2 and the other connects to VLAN 3. None of these things changes the fact that I can ping from hosts on the VLAN 3 port group to the VLAN 2 port group.
Am I doing something dumb here?