I'm in the middle of slowly trying to solve my inherited ip range issue.

Currently everything is on 100.100.100.x. I am slowly moving things over to a 10.12.x.x range. Currently my Watchguard firewall on is doing my for users, I want to change so the Procurve on does the routing instead.

The first stage has been to set up a second connection to the firewall on VLAN 99 so internet access works and I've got it working on VLAN 123.

Here is my vlan setup.

VLAN ID Name                 | Status     Voice Jumbo
------- -------------------- + ---------- ----- -----
1       DEFAULT_VLAN         | Port-based No    No
20      ISCSI                | Port-based No    No
99      DMZ                  | Port-based No    No
121     Client_PCs           | Port-based No    No
122     Production           | Port-based No    No
123     Servers              | Port-based No    No

I can ping between VLAN 1 and 123. I can't ping between VLAN 122 and 123.

Here is my running config ; J9145A Configuration Editor; Created on release #W.14.38

hostname "AKS-BROX-SW2"
module 1 type J9145A
interface 24
   name "LINK TO FP"
trunk 19-22 Trk1 LACP
trunk 6-9 Trk2 LACP
ip default-gateway
ip routing
vlan 1
   name "DEFAULT_VLAN"
   untagged 1-3,5,10,24,Trk1-Trk2
   ip address
   no untagged 4,11-18,23
vlan 20
   name "ISCSI"
   untagged 11-18
   ip address
   tagged Trk1
vlan 121
   name "Client_PCs"
   ip address
   tagged Trk2
vlan 122
   name "Production"
   ip address
   tagged 1-2,5,10-11,Trk2
vlan 123
   name "Servers"
   ip address
   tagged 1-2,4-5,10-11,Trk2
vlan 99
   name "DMZ"
   untagged 23
   ip address
fault-finder bad-driver sensitivity high
fault-finder bad-transceiver sensitivity high
fault-finder bad-cable sensitivity high
fault-finder too-long-cable sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder broadcast-storm sensitivity high
fault-finder loss-of-link sensitivity high
fault-finder duplex-mismatch-HDx sensitivity high
fault-finder duplex-mismatch-FDx sensitivity high
timesync sntp
sntp unicast
sntp server priority 1 3
ip route
ip route
ip route
ip route
ip route
snmp-server community "snmp-public" operator
snmp-server community "monitor" operator
spanning-tree 4 path-cost 41000
spanning-tree Trk1 priority 4
spanning-tree Trk2 priority 4
spanning-tree priority 7
no autorun
password manager

And last but not least the routing...

                               IP Route Entries

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----      99   static               1          1       Client_PCs      121  connected            1          0       Production      122  connected            1          0       Servers         123  connected            1          0      DMZ             99   connected            1          0   DEFAULT_VLAN    1    connected            1          0        reject               static               0          0       lo0                  connected            1          0    ISCSI           20   connected            1          0

I can't get VLAN 122 and VLAN 123 to talk to each other, so I assume the route is wrong, but if I try to add a route...

ip route

I get this error. can not be switch IP address and route gateway at the same time.

I must have something configured wrongly, but I can't work out what it is.


1 Answer 1


A 2910 with activated ip routing routes from and to any VLAN that it has an IP address assigned in.

So, if a node can't reach one VLAN subnet from another it's likely not in the correct VLAN.

ip route can't work since is already connected locally and is the switch itself - you can't tell it to route back to itself.


ip route
ip route
ip route
ip route
ip route

don't make sense. All these subnets are local and can't be routed elsewhere.

btw: firmware version 14.38 is ancient (before 2011 when we bought 2910s)...

PS: You're binding IP addresses to all VLANs, including iSCSI and DMZ - as stated above, the 2910 will route into and out of all these networks which is most surely not intended. You'll need to either remove these IP addresses and route/filter between these VLANs elsewhere or configure ACLs that allow the traffic you want while filtering everything else. Note that the 2910 doesn't allow VLAN ACLs, only port ACLs.

  • Ah, last time I checked I didn't find updated firmware, though I have just now, I'll give it an upgrade and see what happens. Nov 22, 2017 at 13:03
  • HPE downloads are a mess currently. You can find the 2910al-24G downloads in h10145.www1.hpe.com/Downloads/… right now.
    – Zac67
    Nov 27, 2017 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.