Looking for some VLAN advice (sorry!!)

[jonbd]

Hi all,

 

I'm hoping someone can offer some advice on setting up VLANS for the Aerohive wireless network we are currently installing. We seem to be having trouble getting them to work properly

 

We currently have a flat network using 10.7.148.0/22. Our internet conection comes through our firewall on 10.7.151.254. We are looking to add the following VLANS

 

VLAN 10 10.10.100.0/23 Domain Devices

VLAN 20 10.20.100.0/24 Guest Access

VLAN 30 10.30.100.0/24 BYOD

 

We have created the VLAN trunks for the APs on all the switches back to our layer 3 switch (10.7.148.100 D-LINk DGS-3326GSR), and have created the following IP interfaces for each VLAN on it:

 

VLAN 10 10.10.100.254

VLAN 20 10.20.100.254

VLAN 30 10.30.100.254

 

We have added IP Helpers for each VLAN pointing to our DHCP server (10.7.148.211), and set up scopes for each of the VLANS on it (setting the gateway to the IP interface of the VLAN). I've set up a port for each VLAN on a switch as untagged to test with a computer but I can't seem to contact the DHCP server to get an address. If I give the computer a static address, I can ping any of the 4 VLAN interfaces on the layer 3 switch but nothing else.

 

Does anyone have any idea what we may be doing wrong or have missed out? The D-Link switch seems to have a language of it's own so any tutorials and documents i've looked at don't correspond to the terminology on the switch.

 

The Layer 3 switch is all fibre apart from 4 ports, and all the switches throughout the school end up back there. Any that are carrying VLAN traffic have been set with Egress enabled on that port for each VLAN. It seems to enable us to communicate across switches on the same VLAN when we set it like that. Should we be using different settings for this instead? Do we need to set up static routing as well to enable the DHCP stuff to get through?

 

As you may have guessed we haven't touched VLANs before so we are having a bit of bother trying to sort it out. Any advice would be gratfeully recieved!

 

EDIT: One thing I forgot to mention is that our servers all sit on 3 ESXI hosts. I don't know if that makes a difference and we need to set up VLANs in there somewhere or not?

Edited February 17, 2016 by jonbd

[twin--turbo]

where are the existing devices pointing at for their default route?

 

TT

[jonbd]

Default route would be the firewall on 10.7.151.254. I don't have direct access to that so any changes would need to go through our ISP.

[BigDF]

Hi, have you tried adding the IP helpers to each individual VLAN at the core? Rather than the edge switches?... Apologies if you've already tried, had a similar issue and that worked for me

[ass17]

IP helpers reside on the VLAN interface where the VLAN IP is set, which are all on our core switches, had no issues and no IP helpers at the edge were required.

[twin--turbo]

So your servers have a default route of the firewall, which has no idea about your new vlans?

 

You need the L3 switch to be the Default route.

 

TT

[Davit2005]

Is the DHCP servers default gateway set to the it's vlan ip address on the switch.

 

For instance our DHCP servers are on vLAN 1, their default gateway is set to the ip address allocated to vlan 1 on the layer 3 switch.

[twin--turbo]

Is the DHCP servers default gateway set to the it's vlan ip address on the switch.

 

For instance our DHCP servers are on vLAN 1, their default gateway is set to the ip address allocated to vlan 1 on the layer 3 switch.

 

No, he said the server DG is the firewall, if he has not instructed the ISP to update the static routing table on the FW to point at the switch for the other VLANS then it's not going to work unless he moves the DG on the servers to the switch.

 

The switch should then have it's DG as the firewall. However, this only allows the existing servers to contact the new clients. The new clients would not be able to use the internet directly so will need a proxy on the server LAN ( which is hopefully in place anyway.)

[jonbd]

Thanks for the help everyone! The default gateway for the 10.7.148.0/22 network is the firewall, the default gateway in each VLAN DHCP scope is set to the IP interface for that VLAN. We do not have a proxy, unless you mean the transparent proxy that is part of our firewall? So should I be getting our ISP to add static routes to the firewall then?

[twin--turbo]

Do you know if your external IP is on a public network or another private network on something like a xGFL?

 

It may be that they are not using NAT on the firewall, and in that instance the "10.10,10.20,10.30" may be in use somewhere else on their network.

 

Hopefully that is not the case and you should be able to get the ISP to add the new networks as static routes on the inside of the firewall.

 

The L3 Switch will need it's DG set to the firewall also.

 

 

 

 

TT

[jonbd]

Our external IPs are public so that's good. I've contacted our ISP about adding the details to the firewall, so I will see how that goes and report back. Thanks!

[Davit2005]

No, he said the server DG is the firewall, if he has not instructed the ISP to update the static routing table on the FW to point at the switch for the other VLANS then it's not going to work unless he moves the DG on the servers to the switch.

 

The switch should then have it's DG as the firewall. However, this only allows the existing servers to contact the new clients. The new clients would not be able to use the internet directly so will need a proxy on the server LAN ( which is hopefully in place anyway.)

 

TBH, I always make sure the DHCP servers gateway is the layer 3 switch, otherwise how does the layer 3 switch pass the info between the vLANs. And this always works, the clients recieve the DHCP address from the DHCP server.

 

There should be a default route 0.0.0.0 0.0.0.0 [firewall ip address] on the switch so the firewall is used as a next hop. And yes the firewall needs routes back to the vLANs via the Layer 3 switch otherwise the traffic from the Internet will not get back to the vLAN. This is how I always set it up unless I missed the OP's issue.

 

For instance a server (10.1.10.2/24) on vlan 10, the vlan IP address of the vlan on the layer 3 switch is 10.1.10.1.

 

vlan 20 on the switch has it's ip address set to 10.1.20.1 and an ip helper address pointing to 10.1.10.2 .

 

The layer 3 can then route traffic between the 2 vlans and everything should work locally.

 

The firewall would need a route back to the network 10.1.20.0 255.255.255.0 via the layer 3 switch for internet traffic to be routed back to the correct vlan.

Edited February 18, 2016 by Davit2005

[foofighterjim]

@jonbd

 

I was in a similar situation last summer and people here managed to help me through it. You can find the thread here: http://www.edugeek.net/forums/how-do-you-do/156740-subnet-change-vlans.html

 

One thing I would recommend with Aerohive is to have your APs in their own separate management VLAN (once you have VLANS working of course), it helps keep things tidy in DHCP and if you ever want to use RADIUS authentication will remove a lot of pain short and long term.

[jonbd]

Back again! Our ISP have put the VLANS on the firewall, and clients can now get IP Addresses through DHCP and I can ping back and forth between them. DNS doesn't seem to be working on the VLANS though. Do i need to do anything other than add the our DNS servers in the DHCP scope settings for each VLAN?

[jonbd]

Enabled DNS relay in our Layer 3 switch and all seems to be well now! Thanks to everyone for your help, it is very much appreciated!

[twin--turbo]

Tip Top

 

TT

[prestech]

aerohive-training the ACWA and ACWP course anyone been on them and is it worth going?

[foofighterjim]

aerohive-training the ACWA and ACWP course anyone been on them and is it worth going?

 

When we brought Aerohive we had some training from LAN3, I'm not sure if it was an official course let alone one of these you mentioned. But it gave us a good insight into how we were going to set things up and run it day to day.