IP office , ERS 3500

[merae]

Hello All,
I have and ERS 3500 I configured two VLANs Voice, Data
Voice VLAN has IP office and IP phones of course, the problem is this
on the switch the IP forwarding is enabled, I have a firewall which is the default gateway for all devices in all VLANs, my problem is that I cannot reach the IP office or the IP phones from the Data, I have setup the firewall as dg on the IP office and phones but it seems that they are not forwarding the traffic to it!
does anyone know what would be the problem?

Thanks

[havel3]

Yes, you either use either the switch as a router between the VLANs or the firewall.
Case switch as a router:
To access the Voice VLAN from the data VLAN use the switch ip address in the data VLAN as the gateway to the voice VLAN and vice versa.
Example:
Data VLAN = 192.168.42.x/24 Switch IP Address = 192.168.42.254 Firewall IP Address = 192.168.42.1
Voice VLAN = 192.168.43.x/24 Switch IP Address = 192.168.43.254 Firewall IP Address = 192.168.43.1
PC in data VLAN IP Routes:
0.0.0.0/24 default gateway = 192.168.42.1
192.168.43.0/24 gateway = 192.168.42.254 ( use the switch as a router between VLANs)
or create a IP Route in the firewall to route the traffic:
192.168.42.0/24 to LAN1 (=data VLAN)
192.168.43.0/24 to LAN2 (=voice VLAN)
and set the firewall as the default gateway without additional routes.
Don't program both to be a router between the VLANs, best is to use the firewall as a router as it is designed for it.

[merae]

Thank you, yes I want to use the fw as the dg, but let me get this clear:
on FW: Voice 192.168.1.254, Data: 192.168.2.254 (All PCs and phones have theses as dg accordingly).
on switch it has two VLANs IP addresses and IP forwarding enabled (this is because I run the IP office script), these addresses are not the DG on the devices.
My question is: do the phones take the gw from the switch because they are provisioned automatically ? I mean when I set the phones manually (to use the fw as dg) I can reach them, but when setting them to automatic I cannot!

[havel3]

The phones take the dg from the DHCP server, if that is IP Office then add the correct gw in the scope, if it is the firewall then add it in the firewall.
In IP Office you must have a IP route as well to the correct gw for each LAN/subnet
Turn off routing in the switch, it may interfere with your ip rules to use the firewall as the router.
It is easily done in the switch web pages.

[merae]

OK, thanks that's what I did, but I thought setting a dg on IP office will make it see other networks, it turns out that I need to set the routes manually

[merae]

quick question: I have changed the IPO ip address, the phones are getting IP address from the IPO dhcp, but it hangs on search for the old IPO IP address? any idea where is this saved ?