AAARRGGHHH - VLANs HELP!!!

[mikkydoos]

Hi all,

 

I want to set up 2 VLANs to accommodate CCTV and a Ruckus guest WLAN on my network.

 

Main buildings 1 and 2 have 12 pairs of fibre between them and a Netgear 7312 Layer 3 switch at each end.

 

All ports everywhere are currently tagged VLAN: 1

 

In my server room, all servers go into a Netgear GSM 7724 Layer 2 switch, uplinked to the L3 switch.

 

Any other switches (Cisco SG200) are uplinked into either L3 switch.

 

The bits I'm stuck on comprehending are....

 

a) the trunking between switches (do I even need to do this?)

 

b) where does the DHCP for the VLANs come from (and can I do it by setting up extra scopes on my DC DHCP?)

 

c) how and where to tag the ports to indicate the VLAN ID on the switches. (Do I need to do this on every port en route from my L3 switch to my device?)

 

 

Any comments/help much appreciated

 

; )

Edited October 9, 2014 by mikkydoos

[foofighterjim]

Before we talk VLANs is the L2 switch your servers are connected to only uplinked to the L3 switch (and the rest of your network) with a 1GB connection. If so I would address this first.

[mikkydoos]

Yeah but its never been a problem. Runs pretty fast. Suppose I could connect more than one uplink aggregated Edited October 9, 2014 by mikkydoos

[Gardinho]

It's all about having clear documentation and tagging ports that you want to access the VLANs (or IP ranges, if you like). It's a nightmare to troubleshoot if you don't know exactly where everything goes.

 

You configure this first on your Layer 3 switch. Add your routing tables, and tag ports.

 

Then, on your other switches, only tag the uplinks to the core switch.

 

DHCP ranges are still configured on your domain DHCP server.

[mikkydoos]

Ahh. Only the uplinks get tagged, not the specific ports devices are plugged in to.

 

Is that the same as a Trunk ?

 

How do I specify in DHCP that an IP range should only be picked up by particular VLAN id ??

Edited October 10, 2014 by mikkydoos

[Gardinho]

You would need to tag any port that needs access to the multiple vlans.

 

Once you have configured the routing tables on your layer 3 switch, you can add the new IP scope on your dhcp server.

[mikkydoos]

Cheers Gardinho,

 

Like this ....???

 

 

 

With the devices picking up the correct DHCP address, how do I configure them to obtain addresses from the other scope?

[mikkydoos]

Doh... I just noticed that when you create a routing table and VLAN on the switch it asks for an IP address and Subnet for that VLAN.

 

That's where the separation occurs!!!!!!!

 

 

I'm still confused about this though....

@Gardinho ... If I don't need to tag the port that a PC is plugged into, only the uplinks, and I'm using one DHCP server with two scopes. How does the PC know which scope to request an address from ? I can't see when you create a new scope that you can specify a VLAN ID for that scope.

[benjie]

You need to set a dhcp helper on your switches pointing to your dhcp server.

 

Dhcp will issue a IP from the correct scope based on the originating vlan subnet.

[Muz]

Trunks can carry multiple VLANS, VLANs are identified through tagging of ethernet frames.

 

VLANs are used to segment networks logically into different subnets 10.1.10.0 ... 10.1.20.0.. etc

 

Your layer 3 switch will create a 'VLAN interface' which is how the VLAN gets routed out of - this will also be the default gateway for devices in that VLAN. This interface can point to a DHCP Server and acts like a proxy - you can set the scope for DHCP on your Server and point the interface to it.

 

Diagram attached

Edited October 16, 2014 by Muz

[mikkydoos]

Still don't get where if you have 2 DHCP devices and their ports aren't tagged how one is routed to one IP range and the other is routed to another??

 

Confused..

[localzuk]

The endpoint ports, ie. the ones the devices connect to, are set (in HP nomenclature) to "untagged" in the VLAN which the machine is supposed to be connecting. The "trunks" are tagged with each and every VLAN which the link is supposed to carry.

 

So, when a client is connected up, it sends its DHCP request via your switch. Because the traffic is "untagged", the switch adds the applicable VLAN into the packet. That packet is then sent via the trunk and routed on the L3 switch to the correct destination, using the IP address for that VLAN interface, which the DHCP server uses to determine which scope to issue an address from.

[mikkydoos]

Cheers @localzuk

 

Ok. Understand that. When I have 2 or more VLANS uplinked to the end switch.... what then ??

 

Im looking at using 3 atm. Do I have to tag the end ports in that case ???

Edited October 16, 2014 by mikkydoos

[localzuk]

What do you mean? You can have as many VLANs as your switches can handle.

 

I'll give an example of my setup. We have about a dozen VLANs. The core switch has all 12 set up, each with its own IP address. The ports going to the edge switches (trunks) have every VLAN tagged on them. The edge switches have those VLANs defined (no IP on them, just the basic details), with the "trunk"/uplink port tagged on every VLAN.

 

Each endpoint port then is untagged in whichever VLAN it is supposed to be working with (they aren't really, as I have a more complex setup than that but for this example they are).

[mikkydoos]

Ok. Let me simplify my understanding so far. Unless I'm being really dumb

 

A Layer 3 switch has 2 ports tagged with 2 VLAN ID's. Those 2 ports are uplinked to (a smart switch) the same switch and ports are tagged to match at each end.

 

(Smart switch) -

 

(Both DHCP)

Port 1 has a PC plugged into it.

Port 2 has a CCTV camera plugged into it.

 

PC should pick up 10.1.1.1

Camera should pick up 192.168.1.1

 

Where does the differentiation occur between devices picking up a different IP.

That's where I'm confused

[localzuk]

The differentiation is where on your switch, you mark Port1 as untagged in VLAN1 and Port2 as untagged in VLAN2 (for example). "Untagged" is a specific term.

 

To clarify - in simple terms, the term "untagged" does not mean "not tagged"

[mikkydoos]

So does that mean I still have to tell Port 1 and Port 2 that each belongs to one of the VLANs

 

Sorry for being thick.

[localzuk]

Unless you are setting up something like MAC address based authentication, yes, you have to specify which VLAN each port is on.

 

It looks to me like Netgear use the same terminology.

[mikkydoos]

OK thats really clear. Cheers m8. Appreciated.

 

Tagged / 'Not tagged'. I was under the impression from another post that you leave the end ports 'Not Tagged'. Thats where I was stuck.

 

 

From the PC.....

 

(in simple terms) The switch port is configured to a specific VLAN which passes packets to whichever tagged trunk port, which then passes the tagged packets (down whichever trunk) to the L3 switch which routes it to the relevant DHCP scope (with an IP helper in place).

 

If I swap the cables around it'll pick up the other IP address cos the other port is configured for another VLAN.

 

So it's kind of cabled statically...

 

Y?

 

(Please say y )

Edited October 16, 2014 by mikkydoos

[localzuk]

Yup. That's right.

[mikkydoos]

OK last one.......

 

I need to Tag the trunks at both ends .. right ??

[localzuk]

Yup. That way traffic can go both directions. You'd soon notice if you didn't.

[mikkydoos]

@localzuk

 

You are a flippin' genius.

 

Can I ask one more... .....

 

My DHCP servers.. 2.

 

Main one is a VM, 2nd one is physical. VM host has a quad NIC (all 4 binded). Do I need to separate these out to different ID'd ports on my L2 switch to differentiate the VLANs? I have to check out VLAN'ing in VMWare...

 

Same goes for my dual NIC physical DHCP server though.

Edited October 16, 2014 by mikkydoos

[localzuk]

When you say 2 DHCP servers, do you mean they are redundant or setup to failover etc...? Or do you intend to have a different DHCP server for each VLAN?

 

The way I have it set up here is I have a single DHCP (with a plan to create a second using Server 2012 DHCP clustering in the future).

 

That DHCP server then has the different DHCP scopes set up, matching the VLANs they are served to. Then the core switch/router is set to use that DHCP as its IP helper for all VLANs. That DHCP server sits on a single VLAN, with a static IP, with the gateway set to the VLAN interface address for the VLAN it is sat on.

 

A second DHCP server, if needed would be set up identically.

 

The difficulty would come if you have your VMWare guests on different VLANs. If you do that, you'd then need to figure out different ports on different VLANs. We don't put our servers on different VLANs here - they're all on our server VLAN, so it has never been something I've needed to do.

[mikkydoos]

2nd DHCP is failover.

 

Virtual networking is laid out pretty simply in VMware and is fairly easy to configure.

 

I've got to work out how the L3 switch is going to route to a virtual switch. Not sure if I need to physically 'trunk' a port from my L2 switch to one of the NIC interfaces on my host or probably just set up the VLAN 'port' on my virtual switch same as the physical ones. Multiple NIC's is another area I need to get my head around, especially for VM'd DHCP.

 

Doh... but then again I dont need to because of the IP helper config'd with the DHCP's subnet

Edited October 16, 2014 by mikkydoos