Hi @GRL 

Thanks for posting in our business forum.

Can you get me a tracert from your other VLAN so I could learn what your network hop is like?

So, I am under the impression that there is no 192.168.8.0/24 in your network environment at all. Not for the ISP as well. So it just happened to 192.168.8.0/24 out of blue?

  @Clive_A 

Bear with me, this is a bit complex!

 

I have all these vlans

 

192.168.0.0/23 (management, all omada lives here)

192.168.2.0/24 (internet transit vlan)

192.168.6.0/23

192.168.8.0/23

192.168.10.0/23

192.168.100.0/23

 

SG3428X is downlink from ER8411 on 10gbit link, and has 6-link LAGs to each of the switches below.  SVIs on all vlans on the lower half of each /23 at .253 (eg 192.168.6.253)

 

SG3452 - For LAN Devices.  SVI on all vlans is the lower half of the /23 on each vlan at .254.  (eg, 192.168.6.254)

 

SG2428LP - For POE / WiFi devices via access points, SVI on all vlans is in the upper half of all vlans on .254 (eg, 192.168.7.254)

 

Each Switch VLANs are the gateway for clients on that half of the network. No clients on the SG3428X, its juse a L3 routing bridge.

 

SG3452 and SG2428LP have static routes 0.0.0.0/0 to SG3428X transit vlan SVI for internet hop (192.168.2.253)

SG3428X has 0.0.0.0/0 route to ER8411 Transit vlan interface at 192.168.2.1

ER8411 has supernet 192.168.0.0/16 default route to SG3428X transit VLAN svi

 

All internet and inter vlan traffic is handled by L3 switching at each entry point, using the SVIs to directly route it to and from all clients.

 

Tracert to internet IP from a wifi client on 192.168.7.1 would be:

192.168.7.254 (SVI on SG2428LP) > 192.168.2.253 (transit SVI on core switch) > 192.168.2.1 (ER8411 transit interface)

 

(however, because the switches are IP routing aware as im using SVIs and the source packet IP remains intact, the actual tracert shows the middle hop as happening on the SVI for the actual vlan, which is expected of course)

 

External Tracert to a device i temporarily opened up through NAT follows the same path but in reverse.

 

This works perfectly for all vlans, all the time.  Never an issue.  EXCEPT, the 192.168.8.0/23 network just sometimes stops at the gateway, and when that happens, it wont go any further.  Only ever that vlan.  Never any others.  It does reach the gateway.  So i dont think my switch routing is the issue here.

 

All SVIs are defined with a 255.255.254.0 subnet mask so all are aware of the full .23 subnet of each vlan.  I have double and triple checked i have no IP overlaps on the switch interfaces.

 

Client on vlan 6 192.168.6.0/23

 

Client on vlan 8 192.168.8.0/23 (when its working).  This is the vlan that occasionally just....stops.

 

As i indicated, as soon as i change the WAN that this vlan is set to in policy routing, and then back to the one i want, traffic once again flows through the ER8411 and back normally, until it just stops again at some random future point.

This has reared its head again on ER8411 1.3.0 Beta

 

I thought i had resolved it by setting up IP groups as assigning those as the source in my Policy routes, rather than "Networks"

 

It has started again though - and again, ONLY on the 192.168.8.0/23 network.

 

This time, more info - It happens whether this is an interface vlan with router as gateway, or a switch vlan with static routing.  Is there something about the 192.168.8.0 range that is conflicting with some internal ER8411 process ?

 

Very, Very strange.

 

 

The ER8411 has been factory reset several times and readopted / reconfigured from scratch seveal times since my initial report as well as my OC200 being reset and everything being rebuilt.

 

 

Hi @GRL 

Thanks for posting in our business forum.

GRL wrote

This has reared its head again on ER8411 1.3.0 Beta

 

I thought i had resolved it by setting up IP groups as assigning those as the source in my Policy routes, rather than "Networks"

 

It has started again though - and again, ONLY on the 192.168.8.0/23 network.

 

This time, more info - It happens whether this is an interface vlan with router as gateway, or a switch vlan with static routing.  Is there something about the 192.168.8.0 range that is conflicting with some internal ER8411 process ?

 

Very, Very strange.

 

 

The ER8411 has been factory reset several times and readopted / reconfigured from scratch seveal times since my initial report as well as my OC200 being reset and everything being rebuilt.

 

 

I did not forget this but this looks like a problem in your local environment. I have sent a report to the dev in this week's report.

  @Clive_A 

 

thank you

 I managed to catch it when the 192.168.8.0 /23 network breaks

In this first  image, you can see that tracert to 1.1.1.1 traverses the inter-switch routing, and finally hits the gateway.   If goes off to the internet correctly.
You can then see this i can ping google.com.  However, in the browser, google.com will not load - even if i put in its resolved IP address directly.

 

 

In this second image, you can see that the same scenario, on a different VLAN policy routed to the same WAN as above, with identical (other than IP range) settings, traverses the switches and hits the gateway, pings, and can load the web page

 

 

And lastly, this image below.  Same vlan as the first image - the one that is problematic - 192.168.8.0 /23.  All i did was change the WAN port its policy routerd to, and back again, and now working....

 

 

Currently, ER8411 is on 1.3.0 beta.  I was seeing the same behaviour on 1.2.2 and 1.2.3

 

There is only one difference between the network the breaks .8.0/23 and the ones that dont - .8.0/23 has no clients on it at all 24/7.  Its a network for visiting technicians to use in the theatre, and only has light occasional use.  Is this some sort of timeout / keepalive problem perhaps ?

 

 

EDIT:
My policy routing.  I have modified this several times to try and mitigate the problem.  I have tried: Combining networks into one rule per WAN, seperate rules per VLAN, Used "Networks" and "IPGroups" as the source, no difference.  The Problematic VLAN is the one called "Event Tech"

Hi @GRL 

Thanks for posting in our business forum.

Can you permit the remote access?

Cloud access to your controller.Dev wants to check this over the cloud.

Not sure if my previous account was added.

  @Clive_A 

 

Can you resend me your details so i can add you

I have changed the IP range of the problematic VLAN since my last update on this.

 

I changed it from 192.168.8.0/23 to 192.168.20.0/23

 

Problem has not returned (so far), very strange indeed!

Hi @GRL 

Thanks for posting in our business forum.

GRL wrote

  @Clive_A 

 

Can you resend me your details so i can add you

I have changed the IP range of the problematic VLAN since my last update on this.

 

I changed it from 192.168.8.0/23 to 192.168.20.0/23

 

Problem has not returned (so far), very strange indeed!

I am curious why it is different from the tracert you have above?

 

Without anything touched, simplify it, what's the tracert like?

And this is different from the time when 192.168.8.0/23 worked. It was never sent to 9.254 and 9.253. What are they? These IPs?

 

 

After tons of reading on your writings, I am more inclined to believe this is not a router/switch problem.

If it exists in 1.2.2, 1.2.3 and 1.3.0, it means this is a problem that has existed long time. Not a firmware issue.

Same WAN exit, but the connection was reset, DNS and ping both work, could be the server stops you.

 

 

Except for the connection to Google. If you access any other servers that are not using Google CDN or servers, will you be able to get a proper connection?

Did you try to recreate the 192.168.8.0/23? Will the problem persist?

  @Clive_A 

 

I dont quite understand what you are asking apart for the last part

.9.254 and .9.253 are Switch SVIs routing the .8.0/23 network on its way to the gateway

My network has a LOT of inter vlan traffic so i switch route rather than gateway route.  Gateway only routes 0.0.0.0/0 and back .  Switches do the rest.

 

edit:

When the issue was happening, the entire internet - everything, was not able to be loaded in the browser.  No websites at all.  As soon as the policy route was changed (and then back again), problem resolved for the next random amount of time.

 

This issue has not hapenned again since changing the vlan to .20.0 /23 - and thats all i changed.  I didnt even delete and recreate it, just changed its IP range.