emboha Posted June 18, 2015 Posted June 18, 2015 (edited) Guys I've searched the interweb for help on setting up a VLAN to separate our AP's from the network, so they only can use the internet but can not connect to our internal network. But it's still all a bit unclear for me. This is my situation: - Only 1 single link (port connected) between all the switches. - Only 1 subnet on the network: 192.168.1.x - 192.168.1.253: DHCP-server - 192.168.1.254: router - 192.168.1.248: main switch: DLINK DGS 1500-28 - Fixed IPadresses for all the other switches (DLINK easysmart family line) and AP's (cheap sitecom AP's) The ports indicated are used to connect the devices with eachother. With my setup: is it even possible what I am trying to do? does my AP have to support VLAN or can i just isolate the port going from the smart switch to the AP? If yes: Is it enough to create 1 additional VLAN on each of the switches (02 Wifi), there is allready a default one (1) with alle the ports untagged on each switch. What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the main switch? => I think its P4 tagged, the rest untagged? What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the second switch DGS 1100-8? => I think its P1 and P8 tagged, the rest untagged or also P2 tagged? What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the third switch DGS 1100-8? =>I think its P1 and P8 tagged, the rest untagged? Do I have to also tag the port of the DHCP server or router in the 02 Wifi VLAN on the main switch? thx in advance Edited June 18, 2015 by emboha
Marshall_IT Posted June 18, 2015 Posted June 18, 2015 The simplest way you can do it, and there are many many different ways, is to: *Set VLAN 02 Untagged on the ports that connect to the APs. Set VLAN 01 Untagged and VLAN 02 tagged on the ports linking the switches to reach other and the mansion switch to the router. Your server should be connected to a pet the is Untagged on VLAN 01. This isn't the best method, as it looks like you're using the default VLAN for client traffic as well as management traffic but i think that should work for what you want to achieve.
Jamo Posted June 18, 2015 Posted June 18, 2015 Guys I've searched the interweb for help on setting up a VLAN to separate our AP's from the network, so they only can use the internet but can not connect to our internal network. But it's still all a bit unclear for me. This is my situation: - Only 1 single link (port connected) between all the switches. - Only 1 subnet on the network: 192.168.1.x - 192.168.1.253: DHCP-server - 192.168.1.254: router - 192.168.1.248: main switch: DLINK DGS 1500-28 - Fixed IPadresses for all the other switches (DLINK easysmart family line) and AP's (cheap sitecom AP's) [ATTACH=CONFIG]31147[/ATTACH] The ports indicated are used to connect the devices with eachother. With my setup: is it even possible what I am trying to do? does my AP have to support VLAN or can i just isolate the port going from the smart switch to the AP? If yes: Is it enough to create 1 additional VLAN on each of the switches (02 Wifi), there is allready a default one (1) with alle the ports untagged on each switch. What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the main switch? => I think its P4 tagged, the rest untagged? What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the second switch DGS 1100-8? => I think its P1 and P8 tagged, the rest untagged or also P2 tagged? What is the status of the ports (tagged/untagged/not member) on the 02 Wifi VLAN on the third switch DGS 1100-8? =>I think its P1 and P8 tagged, the rest untagged? Do I have to also tag the port of the DHCP server or router in the 02 Wifi VLAN on the main switch? thx in advance Just by creating vlans doesn't necesarily prohibit the networks from talking to eachother if you have a router which bridges the VLANs which is what it looks like to me. You would have to create ACLs on the router to stop the VLAN with the APs attached talking to the other VLAN else the router will see it as a directly connected LAN and just route packets between the VLANS.
Marshall_IT Posted June 18, 2015 Posted June 18, 2015 Just by creating vlans doesn't necesarily prohibit the networks from talking to eachother if you have a router which bridges the VLANs which is what it looks like to me. You would have to create ACLs on the router to stop the VLAN with the APs attached talking to the other VLAN else the router will see it as a directly connected LAN and just route packets between the VLANS. This is true, you need to make sure there are mo routes between the seperate subsets on the router.
emboha Posted June 18, 2015 Author Posted June 18, 2015 The router is managed by my ISP. I only have a "user" password where i can only change the wifi password etc. None of the important stuff. Its a technicolor TG670. Which by the way is another problem: We are reaching our 255 internal IPadress limit of my current 255.255.255.0 subnet mask. I can't even resubnet to 255.255.252.0 for example, because the router won't let me change it's subnetmask. But maybe that's for another topic ;-)
Marshall_IT Posted June 18, 2015 Posted June 18, 2015 The router is managed by my ISP. I only have a "user" password where i can only change the wifi password etc. None of the important stuff. Its a technicolor TG670. Which by the way is another problem: We are reaching our 255 internal IPadress limit of my current 255.255.255.0 subnet mask. I can't even resubnet to 255.255.252.0 for example, because the router won't let me change it's subnetmask. But maybe that's for another topic ;-) I think you have bigger problems than you think then? If you are trying to separate wifi and wired traffic they need to be on different subjects as well as vlans otherwise the router is going to get very confused. I'd suggest you sit down, map your current network, projected growth over 5 years and goals for your school as far as it is concern to see how you can achieve them. You might need some external advise on how best to set up and configure your network moving forward and include your ISP in your plans. Is your ISP your LEA? It should be a huge issue for them to assign you a second subnet haut for your wifi network.
emboha Posted June 19, 2015 Author Posted June 19, 2015 I guess I can tackle the 2nd problem (too few ip adresses) easily by 1. Shortening the dhcp lease time 2. Enabling mac filtering so students cant receive a dynamic ip when they somehow got the wifi password. There is currently no budget for an audit by an external firm, I allready made a complete network topology and its a horrific train network. Something i ll need to deal with later too. The whole network needs to be reshaped and next year they are destroying 2 old center buildings, so i guess that will be the appropriate time to get those things done. My ISP is also pointing me to an external network audit firm because they know of the network complexity on our site.
emboha Posted June 19, 2015 Author Posted June 19, 2015 I've added the topology for anyone who is curious :-)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now