WAN access on Layer 3 Switch

Question

I have an HP ProCurve 8212zl Switch which I am currently configuring from scratch. This switch is a Layer 3 switch, meaning it also supports routing.

I also have an ISP that provides me with access to the Internet via a 1000SX gigabit SFP fibre channel, and has assigned me a range of static IP addresses, and also given me the IP address of their Gateway.

My goal right now is to setup a minimal configuration that supports both LAN and WAN access (i.e. access to my local network devices and also access to the Internet via the ISP's gateway.)

Setting up the LAN was very simple. I used the switch's CLI to assign an IP address to the switch. Then I manually assigned static IP addresses to all devices connected to the switch. (I realize I should be using DHCP, but again, at the moment I am only interested in the simplest possible configuration that supports LAN and WAN.) So now I have the LAN working: all devices connected to the switch can ping the switch, and all devices connected to the switch can ping each other. The LAN consists of a single default VLAN.

However, I am unable to figure out how to get access to the Internet working.

I have a fibre channel that connects directly to a switch module via an SFP (1000SX Mini-GBIC). The SFP is connected to port B21 in the switch. Using the switch CLI, I can check the status of the fibre channel port by typing show interfaces B21. This shows me that port B21 is indeed enabled, and its status is up, and it is receiving bytes. So the SFP and port seems to be working fine.

Conceptually, my understanding is that in order to access the Internet, the switch would need to:

1. Check if a packet has a destination IP that is not part of the local LAN
2. If so, forward it to my ISP's Gateway via Port B21 (the fibre channel port)

I've read through many of the HP ProCurve manuals, but I don't understand how this is accomplished. The closest I can understand is that you need to enable routing on the switch (which I've done), and then specify a "default route". A default route basically tells the switch "if you see a packet that's destined for some address that is not part of the local LAN, then forward it to <SOME IP ADDRESS>"

So, on the CLI I can do:

# ip route 0.0.0.0/0 <MY ISP'S GATEWAY IP ADDRESS>

This tells the switch that if a packet is destined for some address that is not part of the LAN, forward it to <ISP GATEWAY ADDRESS>.

I tried this, and it doesn't work - meaning, even with the default route set, I still can't ping my ISP's Gateway, and I can't ping any external Internet address (like the IP address of google.com, for example).

But even worse, I don't even understand why this should work. How can the switch possibly know that it must go through the fibre channel port (port B23) to even access the external world in order to even find <ISP GATEWAY ADDRESS>? I don't see how the ip route command gives the switch enough information about where to find <ISP GATEWAY ADDRESS>.

I suspect I must be missing some key concept here. In general, I want to tell the switch: "if you see a packet destined for a non-LAN address, forward it to port B23, where you will find a connection to the outside world and the next hop (my ISP's Gateway)".

So what am I missing here?

Answer 1

Basically what Roman and ewwhite are saying is that you need a much better understanding of networking to get this to work.
If you really intend to do it this way you will need to setup two VLANs on the switch. One for your LAN and one for the internet. You will need to use one of the assigned IP addresses from the internet on your switch for port B23. You will then need to setup routing between the VLANs to accomplish your stated goals.
A quick Google search found this thread with someone looking to do a similar thing to you, please follow it to gain a better understanding.
https://community.spiceworks.com/topic/403586-hp-swtich-setup-routing-between-vlans

Answer 2

You don't know what you're doing. This is evident from your previous question. And that's okay... but this is all still very, very wrong.

So, the basic concept is that this switch, while a big fancy L2-L4 core device, is not a firewall, nor is it meant to be an internet-facing gateway.

You need a separate firewall device.

Answer 3

From your description, you haven't established L3 connectivity between your ISP and your switch.

Remember that routers are only needed to route between IP subnets. Your default route is worthless without the device having an IP address within that particular subnet.

There are more issues with what you are trying to achieve:

1. Unless your LAN devices have public IP's assigned¹, your ISP will rightfully throw away all traffic from those devices
2. You are exposing an L3 Switch to the internet.
3. ...too many to count.

The proposed setup will create a lot of headaches down the road. At least use a dedicated Router/Firewall for accessing the internet.

Edit: as ewwhite said; parts of this have already pointed out in your other question. Properly learn IP routing before going further, or you'll have a bad day of reckoning in the near future.

_{¹) not really a LAN anymore}