VLAN's for dummies

[CHR1S]

I say dummies, but its just me who is in need!

 

I will hold my hands up, vlanning on Cisco switches isn't my strong point. L2ICT do it their end so when it comes to actually getting things done its a bit hit and miss.

 

Our overly complex network already has 3 VLANs -

 

1) Infants

2) Junior

3) VOIP

 

I have had 4) Guest added however this is where the issues have started.

 

I now need to have multiple VLANS on single ports so they have to be trunked (correct?)

I then have to figure out where on our servers to set what VLAN tags to that DHCP can happen to the guest subnet (IP Helper?)

The Unifi Controller can tag the SSID's and Hyper-V can dish out the right IP's to the virtual NIC's

 

Do the physical NIC's have to be tagged too? (everything bar the guest DHCP NIC on Junior tag?) Can you leave the physicals untagged and just tag the virtuals?

 

I hope this makes some sense, any pointers would be most appreciated.

 

Thanks

[Davit2005]

If you are using a DHCP server on your own network to provide the scope for BYOD/guest then you just need to supply ip helper addresses on each the vLANs, the DHCP server will allocate the correct address but you need a layer 3 switch setup for ip routing for this.

 

If the Junior/VOIP networks have been setup you will probably see the ip helper address on the layer 3 switch for that.

 

Alternatively you can use a DHCP function on a gateway device i.e. SonicWall/Smoothwall to provide DHCP addresses for the network.

Edited March 2, 2015 by Davit2005

[CHR1S]

@Davit2005 Thanks for the quick reply.

 

I have a helper set for 4)Guest VLAN and on a wired tagged port its working fine.

 

However its the virtual tagging of the SSID and Hyper-V NICs thats my grey area and the trunking of the ports.

[Davit2005]

No problem.

 

You shouldn't need anything on the hyper v side, the layer 3 switch should be able to route between the networks.

 

Have you setup a separate DHCP server for guests and intending this to be completely isolated from your production network?

[CHR1S]

No, just a separate scope on my Jr DHCP.

 

So, how does unifi work when tagging just the Guest SSID, does this not just get re-tagged once it hits the physical port?

[Davit2005]

Sorry, Not too sure about Unifi workings.

 

Going by previous experience of setting up Ruckus was just a matter of setting up the different SSID's that were mapped to different vLANs. The ports tagged at edge switch level and again on the trunks back to the core switch and the core switch does the routing between networks.

 

Hope this OK.

[CHR1S]

Sorry guys, still having issues with this.

 

When you are running a physical server that hosts VM's and you trunk the ports on the switch, do you tag the physical server network cards the same as the VM ones too?

[Davit2005]

You shouldn't need to do anything on the Virtual side.

 

Have you just got the one switch doing routing?

[CHR1S]

No, several, some that sit in one school, some that sit in both.

 

Its a single site thats shared and vlan'ed accordingly and that legacy setup is what's causing me a massive headache right now.

[Davit2005]

Have you tried setting up ip route on the core switch that the DHCP server is plugged that points to the ip address of the core switch that serves the client on that vlan??

[roadhouse1387]

Chris,

 

I am a Cisco design specialist with 20 odd years designing and building small and very very large cisco networks.

 

The feature you are thinking about is known (by cisco at least) as 'trunking'. Trunking, in its simplest form, is the process of forwarding multiple vlans across a single physical port. The protocol that is used for this is 802.1q. Without going into the deep technicals, when you connect a simple , single vlan port to a server or even another switch, that port is said to be in 'access' mode as it carries only one vlan. The datagram used to get traffic from its source to its destination at layer 2 is a 'frame' and it consists of an 'ethernet header' which is wrapped around the original ip packet, which you will find further inside the frame.

 

Now, a frame identifies the source and destination MAC address of the traffic but it does not identify the vlan that traffic originated from. So the point to remember here is that the vlan is defined on the ingress and egress of the switch itself and not the traffic flow. With an access link, traffic is carried across a link without caring which vlan it belongs to, that decision is made as it leaves or enters the physical switchport.

 

So thats cool when we have one vlan, now if we want to trunk multiple vlans, we need a method of identifying the individual vlans within the trunk so that traffic for vlan X leaves and arrives on vlan X at both ends of the link. This is where 802.1q comes in. 802.1q adds a few extra bytes to the ethernet header, a couple of which are used to 'tag' a particular frame with the vlan number is belongs to.

 

So there are two things that are needed for a trunk link to work, A, the switch or other devices at both ends of the link must be told the vlan numbers which will be carried on the link, and B, 802.1q must be used to 'tag' the traffic with the vlan it belongs to as it leaves the source , so that when it arrives at the destination, it can be placed into the correct vlan.

 

There you go, if you are using a single link from your hyper-v server, to carry multiple vlans, you need to use 802.1q to tag all the vlans you want on the link, not just one or two, you must tag all vlans on the link. At the switch end, you configure the switch to carry the same vlan load your hyper-v nic is carrying. So if you want to carry all your vlans over the trunk link between your hyper-v server and your cisco switch, you would need to configure hyper-v to 'tag' all vlans with the same vlan id number as you have defined on the switch, then decide what your native vlan should be. I dont use hyper-v that much but i know VM Ware very well, and on VM Ware you need to tag the native vlan as well.

 

The native vlan caters for traffic which is not tagged as it arrives or leaves a switch. but ive given you enough headaches for now, suffice to say that you can only have one native vlan and that its definition must match at both ends and is usually used as a management vlan. Any traffic arriving at the ingress of a trunk link 'untagged' is dropped onto the native vlan.

 

PM me if you want to know more.

 

Cheers

[CHR1S]

@roadhouse1387 that is a superb description and guide, many thanks for taking the time to post it