I have an HP ProCurve 8212zl Switch which I am currently configuring from scratch. This switch is a Layer 3 switch, meaning it also supports routing.

I also have an ISP that provides me with access to the Internet via a 1000SX gigabit SFP fibre channel, and has assigned me a range of static IP addresses, and also given me the IP address of their Gateway.

My goal right now is to setup a minimal configuration that supports both LAN and WAN access (i.e. access to my local network devices and also access to the Internet via the ISP's gateway.)

Setting up the LAN was very simple. I used the switch's CLI to assign an IP address to the switch. Then I manually assigned static IP addresses to all devices connected to the switch. (I realize I should be using DHCP, but again, at the moment I am only interested in the simplest possible configuration that supports LAN and WAN.) So now I have the LAN working: all devices connected to the switch can ping the switch, and all devices connected to the switch can ping each other. The LAN consists of a single default VLAN.

However, I am unable to figure out how to get access to the Internet working.

I have a fibre channel that connects directly to a switch module via an SFP (1000SX Mini-GBIC). The SFP is connected to port B21 in the switch. Using the switch CLI, I can check the status of the fibre channel port by typing show interfaces B21. This shows me that port B21 is indeed enabled, and its status is up, and it is receiving bytes. So the SFP and port seems to be working fine.

Conceptually, my understanding is that in order to access the Internet, the switch would need to:

  1. Check if a packet has a destination IP that is not part of the local LAN
  2. If so, forward it to my ISP's Gateway via Port B21 (the fibre channel port)

I've read through many of the HP ProCurve manuals, but I don't understand how this is accomplished. The closest I can understand is that you need to enable routing on the switch (which I've done), and then specify a "default route". A default route basically tells the switch "if you see a packet that's destined for some address that is not part of the local LAN, then forward it to <SOME IP ADDRESS>"

So, on the CLI I can do:


This tells the switch that if a packet is destined for some address that is not part of the LAN, forward it to <ISP GATEWAY ADDRESS>.

I tried this, and it doesn't work - meaning, even with the default route set, I still can't ping my ISP's Gateway, and I can't ping any external Internet address (like the IP address of google.com, for example).

But even worse, I don't even understand why this should work. How can the switch possibly know that it must go through the fibre channel port (port B23) to even access the external world in order to even find <ISP GATEWAY ADDRESS>? I don't see how the ip route command gives the switch enough information about where to find <ISP GATEWAY ADDRESS>.

I suspect I must be missing some key concept here. In general, I want to tell the switch: "if you see a packet destined for a non-LAN address, forward it to port B23, where you will find a connection to the outside world and the next hop (my ISP's Gateway)".

So what am I missing here?

3 Answers 3


Basically what Roman and ewwhite are saying is that you need a much better understanding of networking to get this to work.
If you really intend to do it this way you will need to setup two VLANs on the switch. One for your LAN and one for the internet. You will need to use one of the assigned IP addresses from the internet on your switch for port B23. You will then need to setup routing between the VLANs to accomplish your stated goals.
A quick Google search found this thread with someone looking to do a similar thing to you, please follow it to gain a better understanding.

  • I'm confused about what you mean by "use one of your assigned IP addresses from the Internet on your switch for port B23". I don't see anyway to assign an IP Address to a specific port. You can assign an IP address to a VLAN, but I don't see how you can assign an IP address to an individual port. The closest thing I can see in terms of associating a port with an IP is to create a VLAN, and then untag the port on that VLAN. Is that what you mean?
    – Siler
    Dec 1, 2017 at 1:08
  • Yes, assign the ip address to the vlan.
    – Kevin K
    Dec 1, 2017 at 12:20

You don't know what you're doing. This is evident from your previous question. And that's okay... but this is all still very, very wrong.

So, the basic concept is that this switch, while a big fancy L2-L4 core device, is not a firewall, nor is it meant to be an internet-facing gateway.

You need a separate firewall device.

  • Well, you are correct about me not knowing what I'm doing. :-) I think the major point of confusion here is you're saying the switch is not an Internet facing gateway, but the fibre channel itself connects directly to the switch. It doesn't connect to a separate firewall or router. So I was assuming that I would need to have the switch route traffic to the ISP. Since it's a layer 3 switch, I assume this is possible
    – Siler
    Nov 29, 2017 at 15:25
  • "Fiber Channel" is something completely different, it's a storage protocol. You can terminate the ISP's fiber on the switch in a separate VLAN and connect that to your WAN router in case it doesn't support fiber - saves you a media converter. For a WAN router with IPv4 you'll need NAT. For either IPv4 or IPv6 you'll need a firewall.
    – Zac67
    Nov 29, 2017 at 21:26

From your description, you haven't established L3 connectivity between your ISP and your switch.

Remember that routers are only needed to route between IP subnets. Your default route is worthless without the device having an IP address within that particular subnet.

There are more issues with what you are trying to achieve:

  1. Unless your LAN devices have public IP's assigned¹, your ISP will rightfully throw away all traffic from those devices
  2. You are exposing an L3 Switch to the internet.
  3. ...too many to count.

The proposed setup will create a lot of headaches down the road. At least use a dedicated Router/Firewall for accessing the internet.

Edit: as ewwhite said; parts of this have already pointed out in your other question. Properly learn IP routing before going further, or you'll have a bad day of reckoning in the near future.

¹) not really a LAN anymore

  • I'm a bit confused about what you mean by "your default route is worthless without the device having an IP address within that particular subnet" - what do you mean hear by "device"? Are you talking about the switch itself, or the fibre channel port? The switch has been assigned one of the publically assigned IPs. Of course, the ISP Gateway itself is an IP address in a different subnet.
    – Siler
    Nov 29, 2017 at 16:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .