XGS1930 - Routing trouble

mauro83

Good moring,
I 'm a little stuck ,cause i not understand something into XGS1930 routing.
So , i have this scenario:
2 VLAN connected into layer 3 Switch XGS1930 and one Gateway (firewall) connected with one patch from switch.
I have VLAN 22 with switch IP 192.168.22.1/24 , into a port 14 i have connect a patch with V.M. Server with IP 192.168.22.100/24 tag 22 - gateway 192.168.22.1 dns 8.8.8.8.The port 14 have a Tag VLAN22 into a switch.
I have VLAN 33 with switch IP 192.168.33.1/24, into a port 23 i have connect a patch with V.M. Server with IP 192.168.33.100/24 tag 33 - gateway 192.168.33.1 dns 8.8.8.8. The port 23 have a Tag VLAN33 into a switch.
From the switch i have one patch to a Firewall , this is in VLAN1 IP switch 192.168.11.2/24 default gateway 192.168.11.1 default DNS 192.168.11.1,8.8.8.8
and the firewall have IP 192.168.11.1/24
So from the V.M.s i can ping each other, but i still not go out (in internet), what i need to do into a switch layer 3 for active the routing to out to internet the V.M? or where i wrong the configuration?
Thanks

Zyxel_Melen

Hi @mauro83 & @PeterUK,

You don't need to set static route rules on the Zyxel switch that supports VLAN routing. Our layer 3 switch, includes XGS1930, will automatically create a routing rule after you configure an IP address to your VLAN.

You may check the IPv4 routing table. Path is Menu > Management > Routing table > IPv4 Routing table. The below screenshot is my example.

So, you only need to set the static route on the firewall:

IP 192.168.33.0/24 gateway 192.168.11.2

IP 192.168.22.00/24 gateway 192.168.11.2

PeterUK

I think having switch IP 192.168.22.1/24 and - gateway 192.168.22.1 is a problem

I am right in thinking you want the Switch to route server 192.168.22.100 and 192.168.33.100 by the switch and not by the Gateway (firewall)?

from what I can tell the XGS1930 is not layer 3

mauro83

I need the servers 192.168.22.100 and 192.168.33.100 can ping all the VLAN22 and VLAN33 (and i want that do a switch layer 3 not a firewall). I thinked the switch layer 3 take from it gateway default can route the traffic into

PeterUK

If you Filter L3 and L2+ your switch does not show up as L3

https://www.zyxel.com/uk/en-gb/products/switch

mauro83

yes you are right,now i see… but maybe was a mistake because i read this in a layer 3 specification:

https://www.zyxel.com/uk/en-gb/products/switch/24-48-port-gbe-lite-l3-smart-managed-switch-with-4-10g-uplink-xgs1930-series/features

so, only XGS2210 or XGS2220 are true layer 3 ?

PeterUK

and I think  L2+ can do what you want but not 100% sure on that

Zyxel_Melen

Hi @mauro83,

XGS1930 is a lite-L3 Smart Managed Switch, it supports VLAN routing.

It is important to know that your firewall does not know VLANs 22 and 33 since these VLANs/subnets are created on the switch. Have you created the static route rule on your firewall? Without the static route rule, the firewall won't know where to send the packet back.

mauro83

Ok for the layer3 switch, so good i think XGS1930 can do what i need.
For the VLAN into the firewall, ok i'll can try and check if after all works, but if the gateway of the all V.M.s is the switch , is not the switch to route the traffic into the firewall?

Zyxel_Melen

Hi @mauro83,

The switch will route the traffic from the VM to the firewall. But when the traffic goes back to the VM, your firewall cannot route the traffic since it does not know the subnet 192.168.22.0/24 or 192.168.33.0/24. It only knows that 192.168.11.2 is your switch.

PeterUK

What I think you want is

switch IP 192.168.33.1/24

switch IP 192.168.22.1/24

Gateway (firewall)

192.168.11.1/24

server 192.168.22.100 gateway 192.168.22.1

server 192.168.33.100 gateway 192.168.33.1

so that routeing between 192.168.33.0/24 and IP 192.168.22.0/24 is done by the switch but you want internet traffic to get to IP 192.168.11.1 which you would need a routeing rule on switch

0.0.0.0/0

192.168.11.1

and then static route on firewall

IP 192.168.33.0/24 gateway 192.168.11.2

IP 192.168.22.00/24 gateway 192.168.11.2

mauro83

https://community.zyxel.com/en/discussion/comment/65976#Comment_65976

Yes …It's been a while …so i tried but the static rule into a switch…but is not accepted..

..

Only for information, into the gateway (11.1 ) i added the VLAN 22 and 33 and from gateway i can ping all the VLAN and IP servers…