separating wifi traffic with a vlan

[sted]

Ive been asked to look into partitioning off all the wifi traffic to a vlan but it still needs to be able to talk to the server(s). so lets assume 1 have a 24 port switch (the one im testing wit is a hp1820-24g if it makes any odds) a server (for testing its a workgrouped 2012 server with dhcp on it) and an access point (for testing ive got a ruckus zoneflex 7372). What im trying to achieve is for port 1 to basically talk to everything but a computer on port 2 say can talk to the server and anything else on not on the wifi port 11 and a wireless pc connected to the ap on port 11 can talk to the server and any other wifi device (well if they can only talk to the server and not other wifi devices that is also fine). Ive managed to get vlans set up so that ports 2/11 cant talk to each other but then they also cant talk to port 1. Any ideas im not sure its something thats doable but boss says hes seen it done but has no other useful info

[Steve21]

If you want to keep them split, tag 1 on both vlans and it should then talk to both, but what's doing your VLAN routing if you need access from 1 VLAN to another? You got a layer 3 switch etc? or didn't you want them to talk to eachother at all? (Wasn't sure the way you said it)

 

Steve

[sted]

crappy diagram time lol

 

 

svr------wifi yes

svr------pc yes

pc------wifi no

 

in have no idea ive just been asked to try and keep the wifi traffic away from the rest they will all be getting the same ips and talking to the same server(s) just that wired pcs cant talk to wifi devices and wifi devices cant talk to wired devices bar servers

[Steve21]

What I mean though is say you got 3 VLANs

 

Server x.x.10.x

PC x.x.20.x

Wireless x.x.30.x

 

Those three can't talk to eachother unless you got some VLAN routing to tell it where/how to get to eachother, otherwise it knows nothing about that VLAN or how to get to it.

 

You "could" add multiple IPs on the servers like how switches work, but that's a bit faff especially as it would need it for everyone, but the normal way would be VLAN routing on a Layer 3 switch, that basically has the table/routing setup on it, so Servers talks to Layer 3 who says go here etc.

 

Steve

[sted]

wasnt planning on having separate ips unless i need to im happy for them all to be eg 192.168.1.x

[Steve21]

wasnt planning on having separate ips unless i need to im happy for them all to be eg 192.168.1.x

 

But each VLAN needs it's own IPs. Otherwise could have multiple IPs the same and routing wouldn't work.

 

e.g. 192.168.1.x for pc/server, 192.168.2.x for wifi

 

Steve

[sted]

But each VLAN needs it's own IPs. Otherwise could have multiple IPs the same and routing wouldn't work.

 

e.g. 192.168.1.x for pc/server, 192.168.2.x for wifi

 

Steve

 

presumably if i only had dhcp on the server their shouldn't be any ip conflicts as there is only one source for ip addresses

[Blue_Cookeh]

presumably if i only had dhcp on the server their shouldn't be any ip conflicts as there is only one source for ip addresses

 

If you're going down the VLAN route you need to use different subnets on each one since you'll have to route between them somewhere to keep the WiFi traffic separate. Not splitting the subnets up is going to cause you a major headache later on when it comes to firewalling/routing the VLANs.

 

Your DHCP server can cater for all VLANs using IP Helpers on the switches.

 

Otherwise, stick all your WiFi traffic on one switch, PCs on another switch, then connect each server to both switches. You'll still need different subnets so the servers know what to do.

Edited July 27, 2015 by Blue_Cookeh