Ruckus & VLANs

Badaz52 · July 30, 2014

Hi,

I am trying to configure our Ruckus Wifi with the following configuration and seem to get lost at the point of creating vlans on the switches and getting everything to talk, this is the setup we have:

SSID 1 - VLAN1 - Main network, clients obtain IP addresses from the Windows DHCP server

SSID 2 - VLAN100 - Staff wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured

SSID 3 - VLAN 101 - Student wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured

SSID 4 - VLAN 102 - Guest wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured

SSID 5 - VLAN 103 - 6th Form wireless, clients obtain IP address from smoothwall DHCP with VLAN interface configured

I have set the WLAN VLANIDs to be the same as what smoothwall is tagging them at and have verified that both ruckus configuration and smoothwall configuration is correct. The problem is If I try and connect my phone to SSID 2 I should receive an IP address from smoothwall however I don't get one because I have not configured any vlans. If I connect to SSID 1 which is the main network I do get an IP from our Windows server which is exactly right.

My issue is with the VLAN configurations required on the switches to make this work, I'm not entirely sure on how to set these up. None of our switches are setup with VLANs at the moment they are all just on default vlan hence why I am getting nothing at the minute.

I'm just not sure of:

1) Where do I setup the VLANs (which switches)

2) How does this information get to each switch (if it needs to)

I have seen a few guides on this but they all seem to relate to BYOD and devices being physically plugged in in order to tag x amount of ports. We are using this separation for wireless clients only.

White_Fi · July 30, 2014

Hi,

You will need all the switches with APs connected to be aware of the VLANs and any uplink (trunks) between these switches.

There are typically two types of VLAN mode (terminology varies between vendor), Trunk mode and Access mode.

Access Mode - Native VLAN and carrying no other VLANs - The VLAN is Untagged on the port and any client that plugs in, lives in this VLAN.

Trunk Mode (What you need for the AP ports on the switches) - Native VLAN and carrying other VLANs. The Native VLAN would be the Untagged VLAN. You would then Tag any other VLANs you need the AP to be aware of.

For a basic example..

Our Wireless Mgmt VLAN is 80 and we have two WLANs, Net-Ctrl (VLAN 90) and Net-Ctrl Guest (VLAN 91)

Our trunk/uplink ports from edge switches to core are in Trunk mode with these VLANs tagged. (carrying the VLANs)

Our AP switch ports are also set as Trunk mode with Untagged 80 (the default native VLAN i want the AP to live) and Tagged on 90 and 91.

In the ZD you DO NOT need to tag VLAN 80 for AP management because you have the port setup with Untagged (native) VLAN80on the switch...no need to be putting a VLAN tag flag in the frame.... it is the native VLAN so leave that as 1.

Under the WLANs advanced options you tag VLAN 90 or 91.

**** If you want you can also tag 80 aswell 90 and 91 on the switch port instead of UT80, T90/91.... If this was the case you WOULD need to "Tag" VLAN 80 for the AP management port in the ZD.

Edited July 30, 2014 by White_Fi

Boredguy · July 30, 2014

On our Netgear Switches we have the following configured using your examples above. We've just installed a Ruckus network so we have gone though this although we don't have Smoothwall. Test each step at a time to make sure it's working correctly (especially for Smoothwall as I would assume you want it available on vLan 1 as well as the rest)

Switch Port with AP connected (say Port 1)

SSID 1 Port Untagged

SSID 3 Port Tagged

SSID 4 Port Tagged

Switch Port with uplink to core network (Port 25)

vLan 1 Untagged (You can tag it if your switch will let you)

vLan 101 Tagged

vLan 102 Tagged

Core Switch

Port connecting to Downstream Switch, configure as above.

Port connecting to your Smoothwall, make sure vLan 101 and 102 are Tagged

Davit2005 · July 30, 2014

Probably a good idea to do this with not many people around just in case something goes wrong.

If you let us know what make/model switches you have may be easier, may be able to help you with some example config

Basically

Create the different vlans

Create the different vlans on each edge switch where you need them. Setup each port where a Access point plugs into to be tagged for the SSIDs that you need on the access points.

The vLANS need to be able to go from edge switch to your core/central switch.

The vLANS also need to be on the switch that your Smoothwall plugs into, with SonicWall you can setup sub interfaces for each vlan and enable DHCP on each sub interface only.

ass17 · July 30, 2014

Then once you have done all that you will need to setup access to servers on your smoothwall for which wifi networks need access like VLE, mail etc...

Badaz52 · July 31, 2014

Thanks for your help, up to now we have only plugged in one AP for testing. The AP port is untagged on VLAN 1 and tagged on VLANS 100-103. I have not configured any other switches. I setup a trunk on the switch too and made the port that the AP is plugged into a member of that trunk (not sure if that is right) when I do this I am then unable to connect to the AP at all, if I remove the trunk I can connect to it.

The switch that this particular AP is on has to travel through 3 more switches before it reaches ZD and 4 before it reaches smoothwall, how should I configure those other switches?

ass17 · July 31, 2014

All switches that the AP has to travel through have to have their uplink ports TAGGED with the all VLANS associated with your wifi including the ZD VLAN.

Davit2005 · July 31, 2014

I can't remember trunking, I think I just tagged.

What Make/Model switches are you using??????

Badaz52 · July 31, 2014

We are using HP V1810 and V1910 switches.

Badaz52 · July 31, 2014

I have tagged all of the switch ports that our AP needs to take to find its way back to smoothwall and it is still not working

just sits there saying obtaining IP address.

Badaz52 · July 31, 2014

Do the switches need to be layer 3 or can this be done at layer 2? I just cannot connect back to smoothwall vlan port no matter what I try. If I configure a laptop on a range set on one of my vlans plug it into the switch port in place of the AP I still cannot ping. I don't have any firewalls on site either just smoothwall.

Davit2005 · July 31, 2014

The switches do not need to be layer 3 unless you need to do routing on the switch. I set up an old HP switch with no ip routing with Ruckus and a SonicWall giving out DHCP addresses for everything but the main production LAN which was being done by the Domain Controller.

What happens if you give a static IP address to a client and see if you can ping the gateway?

Badaz52 · July 31, 2014

It is getting very odd now and making me think it might be smoothwall. I have VLAN 100 setup, I untagged a port on the switch which smoothwall is directly plugged into for this VLAN. I connected a laptop to this port and it does not receive a lease. I configured a static IP address on the laptop and tried to ping the virtual interface on smoothwall and it could not find it. I have no idea what is going on!

Davit2005 · July 31, 2014

With the SonicWall I created Sub interfaces for the correct vlan, and just made sure the port was tagged on the switch for that vLAN

Badaz52 · July 31, 2014

To recap this is what I have got:

VLAN100 - BYOD STAFF

VLAN101 - BYOD STUDENTS

VLAN102 - BYOD GUEST

VLAN103 - BYOD 6TH FORM

These are all setup on the relevant Ruckus WLANs and they are setup as sub interfaces on smoothwall with the correct vlan numbers tagged, I have then configured the dhcp element of smoothwall to dish out ip addresses from a certain range dependant on which vlan they are intended for. All uplink/trunk ports between switches and ap's are set to be untagged on vlan1 (default) and tagged on the vlan's shown above. I have verified this config throughout and there is still no change, wireless devices do not receive an ip address from smoothwall and if I plug a laptop in to the switch smoothwall is plugged into and setup a port as untagged on vlan 100 I still don't get an ip nor can I ping the interface if I setup with a static ip.

I have:

VLAN1 1.0.0.0 255.255.0.0 (main network)

VLAN100 192.168.12.0 255.255.255.0

VLAN101 192.168.16.0 255.255.248.0

VLAN102 192.168.24.0 255.255.255.0

VLAN103 192.168.28.0 255.255.252.0

I'm starting to think something is blocking communication on those ip ranges other than the main network but we are on layer 2 switches so it shouldn't matter should it?

Badaz52 · August 1, 2014

The strange thing I can't get anything to communicate through the switches unless the device is setup with a ip address on the main range of 1.0.0.0. Anything else it won't have it regardless of what vlan is tagged. Could this be because the switches are only layer 2 and although I am trying to vlan for a different range (192) the switch is refusing to deal with it? the switches have no gateway address set. Do I need layer 3 switches to make these vlans work because I am using a different IP range/subnet?

Badaz52 · August 1, 2014

Scrap that, plugged in 2 laptops both with 192 addresses on a switch configured with an ip on the range of 1.0 and the two laptops could ping each other. Sooo problem isn't with the switches, problem is with smoothwall in that I cannot ping any of the vlan sub interfaces from a client even if I directly plug in. If I change one of the vlan sub interfaces to an 1.0 ip untagged I can ping.

ass17 · August 1, 2014

If you use smoothy as your dhcp do your laptops get an ip?

Badaz52 · August 1, 2014

Nope, this is what I have got now, very basic:

Smoothwall port 4-1 VLAN2 ip address 192.168.12.1 255.255.255.0 connected to port 12 on the switch, port 12 on the switch, untagged vlan 1 tagged vlan 2

Laptop plugged into Port 3 on the same switch, untagged on vlan 2 to test.

No IP address received even though smoothwall is setup and enabled to give out ip addresses for the sub interface associated with vlan 2.

If I configure the laptop with a static address and try to ping this sub interface for vlan 2 on smoothwall I get nothing

I have tried another switch too to rule out any problems there and I get the same issue, I just can't understand it its driving me insane!!

Davit2005 · August 1, 2014

Can you make a spare port on the Smoothwall a member if that vLAN so you can rule out switches altogether and plug laptop directly into SmoothWall??

I.E not make it a sub interface but make the port only for that vlan.

Badaz52 · August 1, 2014

Still no joy, does smoothwall have any funny restrictions such as if a range is in use on one interface does it block its use on another? for example:

Port 1 - Main Network - 1.0.100.156 255.255.0.0

Port 2 - External (Uplink to router) - 192.168.100.161 255.255.255.0

Port 3 - not in use

Port 4-1 - VLAN 2 - 192.168.12.1 255.255.255.0

Could the external configuration cause a problem with it being a 192.168? or is there anything else in smoothwall that needs configuring? I followed the guide that timbo wrote.

timbo343 · August 1, 2014

If you are still having problems with the smoothwall and VLAN setup, here is a little how to on how to get this working.

See post 43 on this thread http://www.edugeek.net/forums/how-do-you-do/109684-byod-smoothwall-ruckus-3.html

Edit: Oh.. i see you have already seen this document

Edited August 1, 2014 by timbo343

ass17 · August 1, 2014

The way we do it is via a core layer 3 switch which allows inter-vlan routing.

Each edge switch has a default gateway which is the IP set on the core switch port to which the edge switch is connected to.

Then off top of my head I'm sure on our core switch we set static routes and rules for vlans.

Without being at work I can't go through it with you in detail, plus we installed it over a year ago and haven't touch the networking since, because it works. I will try to familiarise myself again with how everything comes together and get back to you...

Badaz52 · August 1, 2014

The way we do it is via a core layer 3 switch which allows inter-vlan routing.

Each edge switch has a default gateway which is the IP set on the core switch port to which the edge switch is connected to.

Then off top of my head I'm sure on our core switch we set static routes and rules for vlans.

Without being at work I can't go through it with you in detail, plus we installed it over a year ago and haven't touch the networking since, because it works. I will try to familiarise myself again with how everything comes together and get back to you...

I reckon because i am trying to use vlans with a different subnet altogether from the main network the lack of layer 3 equipment is making it impossible however if i setup my vlans with different ranges within the 1.0.0.0 network and then just use ruckus to deny access to certain ranges within this network then i might be ok. I think the vlans will be happy as long as i dont deviate from the 1.0.0.0 network because they are only layer 2 does that make sense?

ass17 · August 1, 2014

Yeah makes sense, we use 10.0 for all wifi devices and 172 for domain static devices, but I'm sure L3 only makes this possible.

You should be ok to vlan using same range on 1.0

Ruckus & VLANs

Recommended Posts

Badaz52

White_Fi

Boredguy

Davit2005

ass17

Badaz52

ass17

Davit2005

Badaz52

Badaz52

Badaz52

Davit2005

Badaz52

Davit2005

Badaz52

Badaz52

Badaz52

ass17

Badaz52

Davit2005

Badaz52

timbo343

ass17

Badaz52

ass17

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Edge Auto Sign in Broken / Cloud Filter

Home

Forums

What's New