Quick VLAN question

[mikkydoos]

Hi all,

 

I'm doing (more) reading up on VLANs and am getting my head around the concepts fine. In the real world I'm stuck on a couple of things...

 

 

Hypothetical example.

 

 

I have a L2 switch configured with 3 trunk ports cabled to 3 other switches. - i.e. multiple VLAN's down a single cable to each of the 3 switches.

 

 

Because I'm using one DHCP server with 3 scopes....

 

 

For each device to pick an IP from the correct scope, is the VLAN tagging created at the switch ports ? i.e. on the 3 switches, do I have to configure each switch port with a VLAN ID - in effect hard wiring each port to a particular ID.

 

 

If so, how do devices communicate with devices on another VLAN ? e.g. VLAN 1 - printers, WiFi etc

 

 

Cheers all

Edited May 5, 2015 by mikkydoos

[FragglePete]

You'll have to make each Port on the edge switches be a member of a specific VLAN (Untagged). Trunk (or Uplinks) are 'tagged' with the specific VLANs you want to be connected at the of the link (and back again!).

 

You'll need IP-Helper address(es) configured at your core switch that points to your DHCP Server(s) - this will identify to the DHCP server which subnet the request is coming from and your DHCP server will give out the correct address for that subnet.

 

You'll need to allow routing between VLANs if you want devices from each VLAN to see each other, or control with ACL.

 

Hope that helps you a little?

 

Pete

[mikkydoos]

You'll need to allow routing between VLANs if you want devices from each VLAN to see each other, or control with ACL.

 

 

Aaahhh!

 

Got the IP helper bit... where do I set up the routing tho'. On the L3 router or is it done on each switch ?

 

For example - CCTV on VLAN 20 - I want to be able to view cameras on the PC's - VLAN 1

[FragglePete]

Routing on ours is set at the Core, ours being HP ProCurve has 'ip igmp' set on each VLAN that is routable (I believe).

 

Pete

[Geoff]

If the switches can do layer 3 routing you can do it there, although I don't like doing that unless I'm pushing layer 3 to my edge switches (which means I'm using OSPF which is probably going off topic). Otherwise you need something else to be the router. This is normally whatever your default gateway is.

[ITGURU]

Same Here - Core Switch is a Layer3 so all VLANS have an interface on this switch as their default gateway.

I sometimes create an IP interface on my edge switches just to check the VLAN is getting through correctly prior to connecting devices.

Only my PC (as network manager) has a static IP with the core switch set as the default gateway which means only I can access ANY device on ANY VLAN.

All other users assigned by DHCP have the county router as default gateway so VLANs are inaccessible.

[themightymrp]

If none of your switches are layer 3 you will either have to setup a 'router on a stick' scenario, whereby you add a router into your environment and let that sort the traffic for you. Or you could setup a PC to run Routing and Remote Access services and put a few NICs in it. Assign each NIC to a different VLAN IP address and let windows routing do the work.

 

A Layer 3 switch is better though....

[mjs_mjs]

Or you could setup a PC to run Routing and Remote Access services and put a few NICs in it. Assign each NIC to a different VLAN IP address and let windows routing do the work.

 

A Layer 3 switch is better though....

 

Rather than adding extra NIC's you could use a Hyper V machine and add multiple virtual nics with differing vlans, and use the host's NIC as a trunk. That way you can have all the benefits of virtualising the 'server' and saves on ports too.

[mikkydoos]

Only my PC (as network manager) has a static IP with the core switch set as the default gateway which means only I can access ANY device on ANY VLAN

 

Got that !

 

- - - Updated - - -

 

If none of your switches are layer 3 you will either have to setup a 'router on a stick' scenario, whereby you add a router into your environment and let that sort the traffic for you. Or you could setup a PC to run Routing and Remote Access services and put a few NICs in it. Assign each NIC to a different VLAN IP address and let windows routing do the work.

 

A Layer 3 switch is better though....

 

I have L3 switches at the core.

 

 

OK, on the 3 switches at the edge (Cisco SG200-50P), do I need to tag each port to as a specific VLAN or do I set it to 'Trunk' and all VLANs will be accessible on that port?

Or can more than one VLAN be assigned to a port?

Or is this a switch limitation?

 

How to do it if pupils and staff PC's are on a different VLAN but share the same printers and file server ? - Routing again ?

 

Anyone got a simpler example to share to describe the routing side of it plz?

 

I thought it was a little more dynamic that it is, maybe thats whats confusing me. Its pretty hard wired at the cabinet isn't it? Specific ports for specific PC's with specific Tags

Edited May 6, 2015 by mikkydoos

[FragglePete]

OK, on the 3 switches at the edge (Cisco SG200-50P), do I need to tag each port to as a specific VLAN or do I set it to 'Trunk' and all VLANs will be accessible on that port?

Or can more than one VLAN be assigned to a port?

Or is this a switch limitation?

 

 

My understanding is that you have to 'untag' a port with the VLAN to make anything that connects to this port part of that specific VLAN. You can assign a port to be part of more than one VLAN by 'tagging' a VLAN to it. The issue then becomes the device itself needs to be told what VLAN it should be part of so it only listens to those packets that are tagged.

 

An example for us is that we have VOIP phones that have the ability to have PCs connect into them via an internal switch. The port on the edge switch is 'Untagged' to the Phone VLAN, but is also 'tagged' to allow Data traffic through it. The phone is configured so it knows what VLAN it belongs too, and what VLAN devices connected to it belong to.

 

Hope it helps.

 

Pete

[Geoff]

An example for us is that we have VOIP phones that have the ability to have PCs connect into them via an internal switch. The port on the edge switch is 'Untagged' to the Phone VLAN, but is also 'tagged' to allow Data traffic through it. The phone is configured so it knows what VLAN it belongs too, and what VLAN devices connected to it belong to.

 

You can simplify your phone configuration to some degree by using a 'voice' vlan. The VoIP phones will query the switch via LLDP/CDP and get on the correct VLANs if you configure this feature.

[mikkydoos]

Thanks all. I think i'm getting it now

[Geoff]

I've just setup a E2610-24-PoE ProCurve switch similar to what you describe today. Here's relevant part of the config:

 

vlan 1
  name "DEFAULT_VLAN"
  no untagged 1-24
  tagged 27-28,Trk1
  no ip address
  exit
vlan 2
  name "Workstations"
  untagged 1-24
  tagged 27-28,Trk1
  no ip address
  exit
vlan 3
  name "Voice"
  tagged 1-24,27-28,Trk1
  no ip address
  qos dscp 101110
  voice
  exit
vlan 21
  name "Management"
  tagged 27-28,Trk1
  no ip address
  exit

 

This results in 1-24 having untagged Vlan 2 and tagged Vlan 3 (for phones, via LLDP). All vlans are tagged on 27-28 (SPF), 25-26 are Trunked and all Vlans are tagged down this trunk (Trk1).

Edited May 8, 2015 by Geoff

[mikkydoos]

I've just setup a E2610-24-PoE ProCurve switch similar to what you describe today. Here's relevant part of the config:

 

vlan 1
  name "DEFAULT_VLAN"
  no untagged 1-24
  tagged 27-28,Trk1
  no ip address
  exit
vlan 2
  name "Workstations"
  untagged 1-24
  tagged 27-28,Trk1
  no ip address
  exit
vlan 3
  name "Voice"
  tagged 1-24,27-28,Trk1
  no ip address
  qos dscp 101110
  voice
  exit
vlan 21
  name "Management"
  tagged 27-28,Trk1
  no ip address
  exit

 

This results in 1-24 having untagged Vlan 2 and tagged Vlan 3 (for phones, via LLDP). All vlans are tagged on 27-28 (SPF), 25-26 are Trunked and all Vlans are tagged down this trunk (Trk1).

 

 

Awesome. Nice one @Geoff

 

Whats 27-28,Trk1 ?

 

I take it that ports 1-24 are any VLAN and 27-28 are management

Edited May 8, 2015 by mikkydoos

[Geoff]

Perhaps a picture would help?

 

 

1-24 are the 100Mbit ports for edge devices, so PCs (with possibly VoIP Phones). The are untaggged on VLAN 2, with VLAN 3 tagged for voice (negotiated between the switch and a VoIP phone over LLDP).

Trk1 is a static port trunk of 25-26 (the 1GigE ports). This is my uplink to my core. (Tagged all VLANS).

27-28 are unused SPF ports. (Tagged all VLANS, but actually disabled in the config).

[tmcd35]

Hi,

 

We're having managed wifi put in over the summer and as part of the project I want to setup VLANs. Am I right in thinking if the print server has 2 NICs, one on the Default_VLAN and one on the Printers VLAN, clients will send jobs to the print server via layer 3 routing to the Default_VLAN and the print server will forward the job on to the printer via its second NIC?

 

Also, I'm planning on having servers and switches on the Default_VLAN and client VLANs route on to here for services and web access via the default gateway (proxy server). Is this right or would it be best to put servers and switches in their own VLANs and enable routing between them?

 

Client -> Vlan3 -> Vlan1 -> Vlan4 -> Server -> Vlan4 -> Vlan1 -> Vlan3 -> Client

 

or

 

Client -> Vlan3 -> Vlan1 -> Server -> Vlan1 -> Vlan3 -> Client

 

Just wondering what is best practice for network security and if it's ok domain controllers being on different subnets to clients, etc?

[mikkydoos]

Trk1 = Trunk - Gotcha

 

So all ports are Trunk AND access ports in your setup configured for VLANs 1,2,3?

 

 

For anyone reading this I've found an excellent tutorial that really simplifies VLAN'ing...

 

The VLAN Concept - Introduction to VLANs

 

Thats my summer job sorted then.

 

 

Thing is I have 2 L3 switches, one in each building. Think I'll be pulling one of them.

[Geoff]

No two ports are in the trunk, 25 and 26. And no, VLAN 1 is only tagged on the trunk port because you don't use the default vlan for anything other than switch access. VLAN 2 is untagged on the access ports and tagged on the trunk. VLAN 3 is my voice so it's tagged everywhere. Access ports with VoIP phones negotiate with the switch to get on the Voice VLAN.

[mikkydoos]

No two ports are in the trunk, 25 and 26. And no, VLAN 1 is only tagged on the trunk port because you don't use the default vlan for anything other than switch access. VLAN 2 is untagged on the access ports and tagged on the trunk. VLAN 3 is my voice so it's tagged everywhere. Access ports with VoIP phones negotiate with the switch to get on the Voice VLAN.

 

 

My head hurts !

[themightymrp]

Ports 25 and 26 are working together as though they were a single port - they are configured as the Trunk i.e. a way of bundling all of the vlan traffic from the core switch to this switch.

 

VLAN 1 (or the default) has only been tagged on the trunk because the only traffic that will be on it is the Admin user doing switch management. It won't be going out to client PC's/phones so is not needed on those ports.

 

VLANs 2 and 3 are assigned to every port 1 - 24 because they will be carrying traffic to client devices. VLAN 2 is untagged on these ports, therefore, the default behaviour for any device being plugged into it will be to get an IP from VLAN 2. So PC's, printers etc.

 

VLAN 3 is tagged on those ports meaning that the traffic will go to those ports but it isn't the default behaviour given to client devices. If however you plug a VoIP enabled phone into it, the phone has onboard software which can distinguish that there are 2 VLANs present and one of those is tagged for Voice traffic. The phone knows to then use VLAN 3 for itself and 'pass-through' the vlan 2 traffic to a PC that would connect in-line.

[mikkydoos]

Ports 25 and 26 are working together as though they were a single port - they are configured as the Trunk i.e. a way of bundling all of the vlan traffic from the core switch to this switch.

 

VLAN 1 (or the default) has only been tagged on the trunk because the only traffic that will be on it is the Admin user doing switch management. It won't be going out to client PC's/phones so is not needed on those ports.

 

VLANs 2 and 3 are assigned to every port 1 - 24 because they will be carrying traffic to client devices. VLAN 2 is untagged on these ports, therefore, the default behaviour for any device being plugged into it will be to get an IP from VLAN 2. So PC's, printers etc.

 

VLAN 3 is tagged on those ports meaning that the traffic will go to those ports but it isn't the default behaviour given to client devices. If however you plug a VoIP enabled phone into it, the phone has onboard software which can distinguish that there are 2 VLANs present and one of those is tagged for Voice traffic. The phone knows to then use VLAN 3 for itself and 'pass-through' the vlan 2 traffic to a PC that would connect in-line.

 

 

Now thats a good answer.

 

cheer m8