Quantcast
Channel: Web and Unmanaged topics
Viewing all articles
Browse latest Browse all 1308

HP 1920 Switch VLAN acl/qos

$
0
0

Like many others HP 1920-24G Switch (JG924A) owners I have problems trying to isolate traffic between VLANs.
Firmware is JG924A-CMW520-R1119 and release notes stated:

Starting JG924A-CMW520-R1105
Modified features include: An ACL can be applied to multiple ports or VLANs

In cli command "interface Vlan-interface90" dont allow "packet-filter" command but only "qos".
Anyway applying command "qos apply policy VLAN90p inbound" returns:
Error: Setting qos policy failed.
Reason: Not supported by hardware.

I have two VLAN:
VLAN1 10.0.2.0/24 production where is the firewall for Internet 10.0.2.254
VLAN90 172.16.90.0/24 wifi guest DHCP relay to DHCP server 10.0.2.12 with scope 172.16.90.0/24 and releasing option gateway/router 10.0.2.254 DNS server 10.0.2.254
Obviously I want client wifi guest only access to Internet through 10.0.2.254, deny access to any other networks.
All Vlans are already created, each vlan with an IP so I can route between VLAN's each other and to Internet.
Here's the part of my config:
#
 version 5.20.99, Release 1119
#
 sysname HP-1920G-Switch2
#
 dhcp relay server-group 1 ip 10.0.2.12
#
interface Vlan-interface1
 ip address 10.0.2.52 255.255.255.0
#
interface Vlan-interface90
 ip address 172.16.90.1 255.255.255.0
 dhcp select relay
 dhcp relay server-select 1
#
 ip route-static 0.0.0.0 0.0.0.0 10.0.2.254
#
interface GigabitEthernet1/0/22
 port link-type trunk
 port trunk permit vlan 1 90
 port auto-power-down
 stp edged-port enable

In port 22 I connected one access point TP-Link EAP225 (VLAN aware) with two SSID:
SSID        VLAN
VLAN80        0 (means default VLAN 1)
VLAN90        90
thus link-type trunk needed to carry diffferent VLAN ID. VLAN80 is only SSID name but is on VLAN id 1.

All works like a charm and when a wifi client connect to network SSID VLAN90 got IP from DHCP ip 172.16.90.x this means to me VLAN config and related DHCP relay work fine. The client reach both VLAN1 devices and Internet. Now I want to isolate the VLAN 90 and I made these configuration on switch:

#
acl number 3500
 description guest wifi VLAN90
 rule 3 permit udp destination-port range bootps bootpc
#
traffic classifier VLAN90 operator and
 if-match acl 3500
#
traffic behavior VLAN90b
 filter permit
#
qos policy VLAN90p
 classifier VLAN90 behavior VLAN90b

the acl configuration now is not correct but it is not important because any kind of deny/permit in ACL I set anyway I got:

[HP-1920G-Switch2-Vlan-interface90]qos apply policy VLAN90p inbound
Error: Setting qos policy failed.
Reason: Not supported by hardware.

The correct ACL I suppose will be :
acl number 3500
 description guest wifi VLAN90
 rule 3 permit udp destination-port range bootps bootpc
 rule 5 permit ip source 172.16.90.0 0.0.0.255 destination 10.0.2.254 0.0.0.0
 rule 50 deny ip

Why the error "Not supported by hardware"

Thanks


Viewing all articles
Browse latest Browse all 1308

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>