More VLAN work

[HodgeHi]

Hello All,

 

I've been in this VLAN hell before not long ago and thought I'd understood it once I got it working...obviously not!

 

I am trying to configure the cisco sg300-28p switch (set to L3 mode) to provide a wireless network with multiple SSIDs that provide a DHCP assigned address from different scopes depending on what SSID is chosen. I have a Staff, a Guest and a Register and a Conference SSID. I have chosen to use the IP range of 10.0.0.x with a subnet of 255.255.240.0. The set up would be as follows:

 

Default VLAN = ID1

Staff VLAN = ID5

Reg VLAN = ID6

Guest VLAN = ID7

Conf VLAN = ID8

 

The Default VLAN address is set to 192.168 0.254 and the WAN address is set to 192.168.0.1 The Interface used for the link to the Router (Virgin Media router) is on port 24.

 

The Staff VLAN uses the address 10.0.64.x with the VLAN ID5 interface using 10.0.64.1 and the DHCP pool is 10.0.64.10 - 10.0.79.250 using ports 1-4

The Reg VLAN uses the address 10.0.80.x with the VLAN ID6 interface using 10.0.80.1 and the DHCP pool is 10.0.80.10 - 10.0.95.250 using ports 5-9

The Guest VLAN uses the address 10.0.96.x with the VLAN ID7 interface using 10.0.96.1 and the DHCP pool is 10.0.96.10 - 10.111.250 using ports 10-14

The Conf VLAN uses the address 10.0.112.x with the VLAN ID8 interface using 10.0.112.1 and the DHCP pool is 10.0.112.10 - 10.0.127.250 using ports 15-20

 

I have configured the default route 0.0.0.0/0.0.0.0 next hop 192.168.0.1

The switch has already created the directly connected routes.

 

I have been able to connect a WAP and connect to the SSID which in turn provides the correct IP for that network, and I am able to ping the gateway of the VLAn the device is in, and I can ping the mgmt VLAN gateway too, but I cannot ping the router address 192.168.0.1

 

I have set the ports for the WAPs as tagged with ingress disabled as the SSIDs are told what VLAN ID they belong to.

 

I feel I'm missing something but Im not sure what it is.

 

Would anyone be kind enough to help point out where I'm going wrong?

 

Thanks in advance.

[HodgeHi]

OK so I've managed to get this working to some extent but now I can't get the routing to work through a BT home hub. Has anyone else been able to get VLANs routing successfully through a VDSL infinity home hub? I can't seem to get the traffic any further than the internal LAN router address.

 

If any more info is needed then please let me know. This has been going on for a while now and would like to put it to bed once and for all!

 

Thanks in advance for any help that anyone may be able to provide

[rich_tech]

I don't know if the BT Home Hub is capable of the operations that your wanting there, though I don't have one to check I will admit, you may need a more business related product, I use Draytek stuff at work and its decent gear for these kind of operations.

[HodgeHi]

Thanks rich_tech for your reply. I have now replaced the BT business hub 5 with a zyxel router and am still experiencing the same issue where the router is not routing internal traffic from the additional VLANs out to the Internet. I believe it to be a routing issue as the main default VLAN works without issue.

 

The DNS server address that is in use is 8.8.8.8 as no DNS server exists on the internal network as yet. Browsing the web results in the address bar just waiting to resolve the address. The static routes for the internal VLANs have been entered on the zyxel router to provide the routes back to the VLANs via the d fault router gateway address (the set up is simplified now with the zyxel router having a LAN side address of 10.0.0.254 which connects directly to the L3 switch which has a gateway address of 10.0.0.250) but the traffic just doesn't seem to get out.

 

I've no idea what's preventing the traffic from being routed out and back in to the correct VLANs.

[AlClark]

have you created the VLANs on the ZyXEL ?

[HodgeHi]

Hi AlClark,

 

No, I haven't created the VLANs on the Zyxel router. The port on the switch that is used for uplink to the router is set to being an access untagged port since the BT business hub was not VLAN-aware as far as I knew. I have configured the other ports on the switch that have the Wireless Access Points connected to them to be tagged with each VLAN ID as they will be carrying the tagged traffic for each of the SSIDs. I have been told that this is the correct behaviour. They are still set to trunk ports though as I wasn't sure which is the preferred type of port for this. You couldn't seem to change them to access mode based ports as they have to have multiple tagged VLANs.

[lostsoul]

You will probably need to add some static routes on you Zyxel so it knows it can talk to the other networks through the DG of the VLAN it's plugged in to. Set the gateway of last resort on your L3 switch to IP of the the Zyxel router.

[HodgeHi]

Thanks for your input Lostsoul.

 

The static routes have already been created on the Zyxel router to provide the gateway back to the switch VLANs. They just cannot get out to the Internet.

 

The config now is as follows: -

 

 

The Switch has an IP address of 10.0.0.250 - the default mgmt VLAN - ID1

There are 4 other VLANs on the switch...

 

VLAN 5 - Staff VLAN - 10.0.64.10

VLAN 6 - Guest VLAN - 10.0.80.10

VLAN 7 Reg VLAN - 10.0.96.10

VLAN 8 - Conference VLAN - 10.0.112.10

 

There are 5 WAPs (with 5 SSIDs) connected to ports 1-5 which have all been set as trunked and have been tagged with VLANs 5-8 and 1 which is untagged

Port 24 has been left as untagged and has been set to access mode to allow the routed traffic to be understood but the router (was a BT business hub 5 at this point but has since been replaced with a Zyxel)

 

The routing table in the switch has enabled these routes, which as you would expect, are directly connected routes.

There is a default gateway which has been set to 0.0.0.0/0 - 10.0.0.254 which has been set as static route

 

The Zyxel router has an IP address of 10.0.0.254

The Zyxel router has had the static routes for the VLANs added also, which are as follows: -

 

S 10.0.64.0 / 255.255.240.0 -> 10.0.0.250

S 10.0.80.0 / 255.255.240.0 -> 10.0.0.250

S 10.0.96.0 / 255.255.240.0 -> 10.0.0.250

S 10.0.112.0 / 255.255.240.0 -> 10.0.0.250

 

The Mgmt VLAN is seen as a directly connected route:

D 10.0.0.0 / 255.255.240.0 -> 10.0.0.250

 

If I connect a client via a cable to the staff VLAN and provide it with an IP address in the staff DHCP range, I can ping the client from the Zyxel router interface, but the same client cannot access the Internet. I don't know if this is due to DNS traffic not getting out and back or if it is indeed a routing problem.

[lostsoul]

Do you have DG set correctly in your DHCP scopes? A client on a specific VLAN needs to have the DG set to IP of the routing device on that VLAN. So if your core switch has an IP of 10.0.64.10 on your staff VLAN, then any clients on that VLAN should use that as their default gateway. Can you ping between VLANs? or can you ping the router from a client on a different VLAN? Edited June 28, 2016 by lostsoul

[HodgeHi]

The default gateways are set for each DHCP scope for each VLAN. The DHCP lease provides the gateway for the plan that the scope is addressing, i.e. VLAN 5 has a default gateway of 10.0.64.10 and this is the gateway address provided to the clients on that VLAN.

[HodgeHi]

I think I have noticed what the issue is, but correct me if I am wrong...

 

The port that provides to uplink to the router is set to Access mode. This only carries on VLAN. Does this mean that it should be set to a trunk VLAN to allow it to carry all of the VLAN traffic to the router and back? This is where my VLAN knowledge starts to let me down. I don't know exactly how the Trunk and Access modes work alongside hardware that doesn't support VLANs. The Zyxel router that is now installed does so I could possibly switch back to a Trunk mode and set the VLAN information on the router if required.

[Blue_Cookeh]

I think I have noticed what the issue is, but correct me if I am wrong...

 

The port that provides to uplink to the router is set to Access mode. This only carries on VLAN. Does this mean that it should be set to a trunk VLAN to allow it to carry all of the VLAN traffic to the router and back? This is where my VLAN knowledge starts to let me down. I don't know exactly how the Trunk and Access modes work alongside hardware that doesn't support VLANs. The Zyxel router that is now installed does so I could possibly switch back to a Trunk mode and set the VLAN information on the router if required.

 

If you need to pass all VLANs back to the router then yes, you want to put the port into Trunk mode and explicitly define which VLANs you want on there with the allow command.

[Davit2005]

I think I have noticed what the issue is, but correct me if I am wrong...

 

The port that provides to uplink to the router is set to Access mode. This only carries on VLAN. Does this mean that it should be set to a trunk VLAN to allow it to carry all of the VLAN traffic to the router and back? This is where my VLAN knowledge starts to let me down. I don't know exactly how the Trunk and Access modes work alongside hardware that doesn't support VLANs. The Zyxel router that is now installed does so I could possibly switch back to a Trunk mode and set the VLAN information on the router if required.

 

You should only need to make it an access port unless you are doing intervlan routing on the router which you are not. Just treat the zytel as the default route for the layer 3 switch and the Zytel would prob need routes to the individual vlans via the layer 3 switch so it knows where to return the traffic.

 

I had an SG300-10MPP at home and had that set up as L3.

Edited July 12, 2016 by Davit2005

[HodgeHi]

Hi all,

 

Thanks for the replies. I did put the uplink to the router in to a trunk port but it still didn't work as I would have expected. I don't know why but anyway. The static routes on the Zyxel were already in place but traffic was not routing as I expected. I created the VLANs on the router and gave them an interface IP. Then the connection just started working on all VLANs. I figure I have basically bypassed the routing on the switch as the Zyxel router is now routing between all of the VLANs, basically making the L3 part of the switch redundant but at least its working. Not sure why it wouldn't work on its own routing table between the Zyxel and the L3 switch. All of the static routes should have worked as expected. I configured all of the switch and static routes in a test environment without issue.

 

But at least its working . I may go back to it when time allows to try and identify why it didn't work initially.

 

Thanks all for you help anyway.