3300 and VLANs

[buttonsandzips]

We recently had a system consisting of 3 controllers installed by a 3rd party supplier.  There is a data vlan and a voice vlan.  The voice vlan has a priority of 6.  However I don't think it has been setup correctly because from any PC on the network you can ping and connect to the phones and the controllers.  I thought they should be completely segreagated and only accessible via a PC which has the VLANS configured on the NIC?  We have been having problems with PC's picking up IP addresses from the controllers via DHCP which are on a different range to our data servers and so they have no access. (Voice network is 10.10.x.x, data is 10.1.0.x)  We are using HP Procurve 2650 and 2626 switches.

Any advice appreciated.

[ralph]

VLAN Priority has nothing to do with it. 

But if I can understand your issue ok, your PC's are picking up IP addresses from the Vocie VLAN.
In general, a couple of things can cause this:

(1) your VLANS are not configured properly on your data switches. ie. The data VLAN needs to be your native VLAN.  (2) You plugged a PC into a data switch port that is programmed to be an "access" port on the Vocie VLAN.

 **the way the phones work is this: it gets it's initial IP address from the Data VLAN, then reads some DHCP options that tell the phone what VLAN they should be in. Then it drops it's IP address, switches to the Voice VLAN and gets it's IP address from there. **

I'd also be sure you don't have your PC's plugged into a hubb or unmanaged switch.
Is the 3300 handing out DHCP for both the voice and data networks?
Are you plugging your PC's into the data switch of your phone?

Ralph

[buttonsandzips]

Hi Ralph,

PC's are pacthed into the phones (5212) and then the phones are patched into HP 2650-PWR switches which have a data vlan and a voice vlan.  The phones do as you described which is get an IP from the data network, reject it, then find the voice network and DHCP from there.

The default VLAN (1) has no tagged and no untagged ports
The Data VLAN (1001) has all ports untagged
The Voice VLAN (1010) has all ports tagged

The PC's and data servers have no vlan config on them.  The servers are just patched into Dell POwerconnect managed switches which are uplinked to the HP switches.

Occasionally the PC's are DHCPing from the MItel switches, they should always DHCP from the windows servers on the data network.

The supplier who installed it all seems to know f-all about it, I might be wrong but I thought the two VLANS would be completely segregated with no routing between them?

Thanks

[ralph]

The supplier who installed it all seems to know f-all about it, I might be wrong but I thought the two VLANS would be completely segregated with no routing between them?

Yes, there would have to be a router somewhere in the switch stack for one vlan to see the other.   Even then, a device on an untagged port should not be getting DCHP from another vlan so something doesn't seem right.

What are you using for your DHCP servers?   Can I assume that you are using an external server for the native vlan and an internal server for the Voice VLAN the 3300?

I don't have my notes in front of me since I decided to take the weekend off, but I think there may be an option in the 3300 that you can flag that roughly says 'If you ain't a Mitel phone you get no DHCP from me."    You may want to peek around the PBX DHCP settings and see.  I'll look on Monday.

I had a similar situation once when somebody loaded a DCHP server on their workstation.   Dupe IP addresses everywhere.   Finally traced it to the offending idiot by tracing the mac address of the workstation.

Ralph

[Chakara]

  Yeah, figure out what the layer 3 device is, for both the data and voice network.  It should be the default gateway and could even be one of your HP switches.  Look at your DHCP helpers on that device.

[DPGumby]

There may be some routing involved between the VLANs. If you have some type of server on your data VLAN that needs to see the 3300 ( call detail recording software for example ), then routing would be needed. I agree with the others PC's should not normally get an IP address from the 3300. Most PC's NIC don't understand VLAN so they should not change from the data to voice VLAN baseed on the DHCP it gets. More likely an incorrectly setup port on the HP. You could track the PC 's by checking the lease viewer and finding their MAC's. Mitel phones will stand out as the are 08:00:0f:xx:xx:xx.

[jgshier]

There are some apps that will require your vlans to route to each other as said above. What kinda of 3300 is this? Does it have an embedded switch?

First make sure that dhcp-relay and IP Helpers are not setup on the HP switches. The HPs support both.

Do the Dell switch have any vlans on them?

Also if you really don't want your vlans to route you just need to say "no ip routing" in the conf mode.

~Jon

[v2win]

Make sure the port that the data DHCP server is on only belongs to the data vlan and is not a member of the voice vlan even if its an untagged port. The same thing needs to be done with the 3300 they only belong to the voice vlan.