Badaz52 Posted July 30, 2014 Posted July 30, 2014 Hi, I am trying to configure our Ruckus Wifi with the following configuration and seem to get lost at the point of creating vlans on the switches and getting everything to talk, this is the setup we have: SSID 1 - VLAN1 - Main network, clients obtain IP addresses from the Windows DHCP server SSID 2 - VLAN100 - Staff wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured SSID 3 - VLAN 101 - Student wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured SSID 4 - VLAN 102 - Guest wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured SSID 5 - VLAN 103 - 6th Form wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured I have set the WLAN VLANIDs to be the same as what smoothwall is tagging them at and have verified that both ruckus configuration and smoothwall configuration is correct. The problem is If I try and connect my phone to SSID 2 I should receive an IP address from smoothwall however I don't get one because I have not configured any vlans. If I connect to SSID 1 which is the main network I do get an IP from our Windows server which is exactly right. My issue is with the VLAN configurations required on the switches to make this work, I'm not entirely sure on how to set these up. None of our switches are setup with VLANs at the moment they are all just on default vlan hence why I am getting nothing at the minute. I'm just not sure of: 1) Where do I setup the VLANs (which switches) 2) How does this information get to each switch (if it needs to) I have seen a few guides on this but they all seem to relate to BYOD and devices being physically plugged in in order to tag x amount of ports. We are using this separation for wireless clients only.
White_Fi Posted July 30, 2014 Posted July 30, 2014 (edited) Hi, You will need all the switches with APs connected to be aware of the VLANs and any uplink (trunks) between these switches. There are typically two types of VLAN mode (terminology varies between vendor), Trunk mode and Access mode. Access Mode - Native VLAN and carrying no other VLANs - The VLAN is Untagged on the port and any client that plugs in, lives in this VLAN. Trunk Mode (What you need for the AP ports on the switches) - Native VLAN and carrying other VLANs. The Native VLAN would be the Untagged VLAN. You would then Tag any other VLANs you need the AP to be aware of. For a basic example.. Our Wireless Mgmt VLAN is 80 and we have two WLANs, Net-Ctrl (VLAN 90) and Net-Ctrl Guest (VLAN 91) Our trunk/uplink ports from edge switches to core are in Trunk mode with these VLANs tagged. (carrying the VLANs) Our AP switch ports are also set as Trunk mode with Untagged 80 (the default native VLAN i want the AP to live) and Tagged on 90 and 91. In the ZD you DO NOT need to tag VLAN 80 for AP management because you have the port setup with Untagged (native) VLAN80on the switch...no need to be putting a VLAN tag flag in the frame.... it is the native VLAN so leave that as 1. Under the WLANs advanced options you tag VLAN 90 or 91. **** If you want you can also tag 80 aswell 90 and 91 on the switch port instead of UT80, T90/91.... If this was the case you WOULD need to "Tag" VLAN 80 for the AP management port in the ZD. Edited July 30, 2014 by White_Fi
Boredguy Posted July 30, 2014 Posted July 30, 2014 On our Netgear Switches we have the following configured using your examples above. We've just installed a Ruckus network so we have gone though this although we don't have Smoothwall. Test each step at a time to make sure it's working correctly (especially for Smoothwall as I would assume you want it available on vLan 1 as well as the rest) Switch Port with AP connected (say Port 1) SSID 1 Port Untagged SSID 3 Port Tagged SSID 4 Port Tagged Switch Port with uplink to core network (Port 25) vLan 1 Untagged (You can tag it if your switch will let you) vLan 101 Tagged vLan 102 Tagged Core Switch Port connecting to Downstream Switch, configure as above. Port connecting to your Smoothwall, make sure vLan 101 and 102 are Tagged
Davit2005 Posted July 30, 2014 Posted July 30, 2014 Probably a good idea to do this with not many people around just in case something goes wrong. If you let us know what make/model switches you have may be easier, may be able to help you with some example config Basically Create the different vlans Create the different vlans on each edge switch where you need them. Setup each port where a Access point plugs into to be tagged for the SSIDs that you need on the access points. The vLANS need to be able to go from edge switch to your core/central switch. The vLANS also need to be on the switch that your Smoothwall plugs into, with SonicWall you can setup sub interfaces for each vlan and enable DHCP on each sub interface only.
ass17 Posted July 30, 2014 Posted July 30, 2014 Then once you have done all that you will need to setup access to servers on your smoothwall for which wifi networks need access like VLE, mail etc...
Badaz52 Posted July 31, 2014 Author Posted July 31, 2014 Thanks for your help, up to now we have only plugged in one AP for testing. The AP port is untagged on VLAN 1 and tagged on VLANS 100-103. I have not configured any other switches. I setup a trunk on the switch too and made the port that the AP is plugged into a member of that trunk (not sure if that is right) when I do this I am then unable to connect to the AP at all, if I remove the trunk I can connect to it. The switch that this particular AP is on has to travel through 3 more switches before it reaches ZD and 4 before it reaches smoothwall, how should I configure those other switches?
ass17 Posted July 31, 2014 Posted July 31, 2014 All switches that the AP has to travel through have to have their uplink ports TAGGED with the all VLANS associated with your wifi including the ZD VLAN.
Davit2005 Posted July 31, 2014 Posted July 31, 2014 I can't remember trunking, I think I just tagged. What Make/Model switches are you using??????
Badaz52 Posted July 31, 2014 Author Posted July 31, 2014 I have tagged all of the switch ports that our AP needs to take to find its way back to smoothwall and it is still not working just sits there saying obtaining IP address.
Badaz52 Posted July 31, 2014 Author Posted July 31, 2014 Do the switches need to be layer 3 or can this be done at layer 2? I just cannot connect back to smoothwall vlan port no matter what I try. If I configure a laptop on a range set on one of my vlans plug it into the switch port in place of the AP I still cannot ping. I don't have any firewalls on site either just smoothwall.
Davit2005 Posted July 31, 2014 Posted July 31, 2014 The switches do not need to be layer 3 unless you need to do routing on the switch. I set up an old HP switch with no ip routing with Ruckus and a SonicWall giving out DHCP addresses for everything but the main production LAN which was being done by the Domain Controller. What happens if you give a static IP address to a client and see if you can ping the gateway?
Badaz52 Posted July 31, 2014 Author Posted July 31, 2014 It is getting very odd now and making me think it might be smoothwall. I have VLAN 100 setup, I untagged a port on the switch which smoothwall is directly plugged into for this VLAN. I connected a laptop to this port and it does not receive a lease. I configured a static IP address on the laptop and tried to ping the virtual interface on smoothwall and it could not find it. I have no idea what is going on!
Davit2005 Posted July 31, 2014 Posted July 31, 2014 With the SonicWall I created Sub interfaces for the correct vlan, and just made sure the port was tagged on the switch for that vLAN
Badaz52 Posted July 31, 2014 Author Posted July 31, 2014 To recap this is what I have got: VLAN100 - BYOD STAFF VLAN101 - BYOD STUDENTS VLAN102 - BYOD GUEST VLAN103 - BYOD 6TH FORM These are all setup on the relevant Ruckus WLANs and they are setup as sub interfaces on smoothwall with the correct vlan numbers tagged, I have then configured the dhcp element of smoothwall to dish out ip addresses from a certain range dependant on which vlan they are intended for. All uplink/trunk ports between switches and ap's are set to be untagged on vlan1 (default) and tagged on the vlan's shown above. I have verified this config throughout and there is still no change, wireless devices do not receive an ip address from smoothwall and if I plug a laptop in to the switch smoothwall is plugged into and setup a port as untagged on vlan 100 I still don't get an ip nor can I ping the interface if I setup with a static ip. I have: VLAN1 1.0.0.0 255.255.0.0 (main network) VLAN100 192.168.12.0 255.255.255.0 VLAN101 192.168.16.0 255.255.248.0 VLAN102 192.168.24.0 255.255.255.0 VLAN103 192.168.28.0 255.255.252.0 I'm starting to think something is blocking communication on those ip ranges other than the main network but we are on layer 2 switches so it shouldn't matter should it?
Badaz52 Posted August 1, 2014 Author Posted August 1, 2014 The strange thing I can't get anything to communicate through the switches unless the device is setup with a ip address on the main range of 1.0.0.0. Anything else it won't have it regardless of what vlan is tagged. Could this be because the switches are only layer 2 and although I am trying to vlan for a different range (192) the switch is refusing to deal with it? the switches have no gateway address set. Do I need layer 3 switches to make these vlans work because I am using a different IP range/subnet?
Badaz52 Posted August 1, 2014 Author Posted August 1, 2014 Scrap that, plugged in 2 laptops both with 192 addresses on a switch configured with an ip on the range of 1.0 and the two laptops could ping each other. Sooo problem isn't with the switches, problem is with smoothwall in that I cannot ping any of the vlan sub interfaces from a client even if I directly plug in. If I change one of the vlan sub interfaces to an 1.0 ip untagged I can ping.
ass17 Posted August 1, 2014 Posted August 1, 2014 If you use smoothy as your dhcp do your laptops get an ip?
Badaz52 Posted August 1, 2014 Author Posted August 1, 2014 Nope, this is what I have got now, very basic: Smoothwall port 4-1 VLAN2 ip address 192.168.12.1 255.255.255.0 connected to port 12 on the switch, port 12 on the switch, untagged vlan 1 tagged vlan 2 Laptop plugged into Port 3 on the same switch, untagged on vlan 2 to test. No IP address received even though smoothwall is setup and enabled to give out ip addresses for the sub interface associated with vlan 2. If I configure the laptop with a static address and try to ping this sub interface for vlan 2 on smoothwall I get nothing I have tried another switch too to rule out any problems there and I get the same issue, I just can't understand it its driving me insane!!
Davit2005 Posted August 1, 2014 Posted August 1, 2014 Can you make a spare port on the Smoothwall a member if that vLAN so you can rule out switches altogether and plug laptop directly into SmoothWall?? I.E not make it a sub interface but make the port only for that vlan.
Badaz52 Posted August 1, 2014 Author Posted August 1, 2014 Still no joy, does smoothwall have any funny restrictions such as if a range is in use on one interface does it block its use on another? for example: Port 1 - Main Network - 1.0.100.156 255.255.0.0 Port 2 - External (Uplink to router) - 192.168.100.161 255.255.255.0 Port 3 - not in use Port 4-1 - VLAN 2 - 192.168.12.1 255.255.255.0 Could the external configuration cause a problem with it being a 192.168? or is there anything else in smoothwall that needs configuring? I followed the guide that timbo wrote.
timbo343 Posted August 1, 2014 Posted August 1, 2014 (edited) If you are still having problems with the smoothwall and VLAN setup, here is a little how to on how to get this working. See post 43 on this thread http://www.edugeek.net/forums/how-do-you-do/109684-byod-smoothwall-ruckus-3.html Edit: Oh.. i see you have already seen this document Edited August 1, 2014 by timbo343
ass17 Posted August 1, 2014 Posted August 1, 2014 The way we do it is via a core layer 3 switch which allows inter-vlan routing. Each edge switch has a default gateway which is the IP set on the core switch port to which the edge switch is connected to. Then off top of my head I'm sure on our core switch we set static routes and rules for vlans. Without being at work I can't go through it with you in detail, plus we installed it over a year ago and haven't touch the networking since, because it works. I will try to familiarise myself again with how everything comes together and get back to you...
Badaz52 Posted August 1, 2014 Author Posted August 1, 2014 The way we do it is via a core layer 3 switch which allows inter-vlan routing. Each edge switch has a default gateway which is the IP set on the core switch port to which the edge switch is connected to. Then off top of my head I'm sure on our core switch we set static routes and rules for vlans. Without being at work I can't go through it with you in detail, plus we installed it over a year ago and haven't touch the networking since, because it works. I will try to familiarise myself again with how everything comes together and get back to you... I reckon because i am trying to use vlans with a different subnet altogether from the main network the lack of layer 3 equipment is making it impossible however if i setup my vlans with different ranges within the 1.0.0.0 network and then just use ruckus to deny access to certain ranges within this network then i might be ok. I think the vlans will be happy as long as i dont deviate from the 1.0.0.0 network because they are only layer 2 does that make sense?
ass17 Posted August 1, 2014 Posted August 1, 2014 Yeah makes sense, we use 10.0 for all wifi devices and 172 for domain static devices, but I'm sure L3 only makes this possible. You should be ok to vlan using same range on 1.0
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now