VLANS

[nathan]

Please bare with me as this is the first time i'm going to implement VLANS.

 

Overview

 

This is a brand new primary school with two data cabinets, Cab A and Cab B. These will be linked via fibre.

 

Just so i have my definitions correct....

 

-Untagged ports will be tagged with the default ID (You set the default ID)

-Tagged ports ignore the default ID and goes to specified VLAN ID

-If both tagged and the default ID is the same, packets will pass through to the specified VLAN

-Tagged ID packet enters port that has a different default ID, the packet will be dropped

 

As an example, say our gateway is: 192.168.40.1 and subnet mask is 255.255.252.0

 

CAB A

 

2 x 48 Netgear port gigabit switches stacked. One of these has a SFP fibre convertor to CAB B

1 x 24 Netgear port gigabit poe switch

 

CAB B

 

1 x Netgear 48 port gigabit switch, this also has a SFP fibre convertor to CAB A

1 x Netgear 24 port gigabit poe switch

 

I have a requirement for the following VLANS (inc description)

 

1 Default VLAN

10 VOIP - Handsets around the building powered by POE (various phones into either cabs)

20 WIFI - Our main curriculum wifi that will need to access curriculum resources

30 WIFI Guest - A guest wifi that has internet access only

40 CCTV/Access Control - Pretty self explanatory. Controls the door access and cctv.

 

All 5 VLANs will need access to the internet.

 

VOIP

There will be a hyper-v pbx system and voip phones will connect to this. I will tag the hyper-v network cart to VLAN ID 10 and all ports that have phones connecting will be VLAN ID 10 too.

Will these ports need to be untagged so VLAN ID 10 gets applied to all packets by default

How will this then get out to the internet?

 

WIFI & WII Guest

I'll be using Unifi wifi, i can tag different SSIDs to VLAN ID 20 or 30. The management software will be hosted in a virtual machine.

What do i tag the hyper-v network card too for the portal on the guest wifi?

How do allow both to connect to the internet, but restrain VLAN ID 30 from access VLAN 1

 

CCTV/Access Control

i would set the ports to untagged VLAN ID 40

Again how would this access the internet

 

Fibre Uplink

I would need to think about the uplink from Cab A to Cab B

How would i tag/untag this port as Cab B will need exactly the same VLANS as above

 

Another thing that confuses me is each VLAN wants an IP address and Netmask. I presume this is where certain cross talk between the VLANS occurs?

 

The school will be on Schools Broadband, they normally use a RouterBoard.

Edited July 8, 2016 by nathan

[ITGuyWestMidlands]

Voip

Your default route should allow packets to access the Internet. Vlan1 should be untagged and vlan 10 should be tagged. Vlan 10 should be setup as a voice vlan.

 

Wifi

You will need to apply an acl to the guest wifi vlan that denies access to the other networks but allows access to the portal

 

CCTV

Default route of 0.0.0.0 0.0.0.0 192.168.40.1

 

 

UPIINKS

You need to tag all VLANs on the uplink ports

[nathan]

Would i need to add a default route for each vlan that needs access to the internet?

[localzuk]

The default gateway is usually device wide, rather than per VLAN.

[Davit2005]

Would i need to add a default route for each vlan that needs access to the internet?

 

If you have got your core switch as doing the Inter-vLan routing Just add to it a default route of 0.0.0.0 0.0.0.0 [ip of next hop i.e. Router/Firewall]

[nathan]

On a Netgear i get the impression it wants it per VLAN as it allows me to state the VLAN?

 

[ITGuyWestMidlands]

You give each vlan an ip address. That becomes the default gateway you set for all clients on that vlan.

[LytchettNM]

I think there is a little confusion going on here.

You are dealing with VLAN and Routing they are not the same thing but most switches that deal with VLAN also do inter-network routing.

In a very simple network let's say 2 cabinets with 1 switch per cabinet and a connection in between the cabs, all ports of both switches would be considered untagged/ access ports.

If you needed another network you could add another pair of switches again 1 per cab and use another connection in between the cabs etc etc.

But this as I hope you agree is not very efficient and you would soon fill up you cabinets with switches, so this is where VLAN is the way forward, let say we have 1x 24 port switch in each cabinet and we want 2 network with say 10 port per switch.

You would create a VLAN with the same VLAN Id let say 10 & 20 on both switches on switch 1 you add the first 10 ports to VLAN 10 and the next 10 ports to VLAN 20 on both switches all untagged/access ports, so at this point only anything connected to port 1 would be able to connect to anything on ports 2 to 10 but there would be NO connection to port 11 to 20 as there are part of network 20. I hope your still with me?

And you would not be able to connect to anything on the switch in cabinet 2 at all.

So now we connect the 2 switches together using let's say port 24 and we are going to use this port for all networks, so now you go back into the configuration of both switch and add port 24 to VLAN 10 but this time it MUST be tagged / trunked then do the same for VLAN 20 on both switches now you will have 2 networks, network 10 with the first 10 ports of each switch on the same network and you guessed it another network 20 with ports 11 to 20 of each switch connected.

Now you have to be able to route between the networks to be able to use these in the real world, I'm sorry but I do not know the switches you are using so this will be a little General, each network will need an IP address to act as the gateway for that network let's say 10.0.10.254 for VLAN 10 and 10.0.20.254 for VLAN 20 the router within the switch will need a routing table entry to allow routing between the networks and a default route to your ISP's router to allow for Internet access.

At this point I'm hoping somebody else can help you out with the routing side of thing on this switch?

Once you have some routes sorted you can have one DHCP server with a scope per VLAN subnet do all of you IP address allocation, you will need to setup an IP helper or DHCP relay option to get the DHCP thing to work.

Sorry if this is a little long winded but it looked like there was confusion going on.

If these switches are not in service and you should play as its definitely worth trying to get a handle on VLAN's as they are very simple when you have grasped the basics concept.

Edited July 11, 2016 by Techforyou

[nathan]

I have Netgear GS752TS and can't seem to find anything about inter-vlan routing. Do the switches support this?

 

EDIT: I presume i would need to add a static route

 

Edited July 15, 2016 by nathan

[Sephiroth]

what are you using for your internal routing at the moment?

[nathan]

It will be a ISP issued router on say 192.168.40.1.

 

I have a virtual machine running Unifi wireless management. I could set the VLAN of the hyper-v machine to say VLAN10 which is the guest wifi but then i would need to be on the guest wifi in order to manage it. Could i configure a static route to allow communication from our curriculum side (VLAN1) to the guest wifi (VLAN10)

Edited July 15, 2016 by nathan

[Sephiroth]

It will be a ISP issued router on say 192.168.40.1.)

 

Sorry, I missed the "Brand new school" bit

 

If you have no core switch, I would get a device to use as a router (another Netgear switch with layer 3 licence would be ideal. We have an M7300 fibre switch, though that may be overkill for a primary. an M5300 or if you have the money and foresee expansion in the future, an M7100) and configure that to be the default gateway of each subnet. Then it's default gateway becomes then next upstream router (192.168.40.1 in your example). This will connect to all edge switches (and ideally no edge switches will be connected together).

 

Once you've got routing set up properly, VLANs can be created on the router and given an IP address on the router. This will be the routers address on that subnet and therefore the gateway for that subnet. then you'll need add the VLANs to each of your edge switches with the uplinks (at both core and edge) tagged on every VLAN being used.

 

The client's gateway will be the router's address within their subnet. With this set up all packets will go to the router for it to pass to the next hop. For internal traffic, that will be direct to wherever it's destined for and externally it'll be the upstream router.

 

For clarity:

-Untagged packets into the network from a client will be tagged by the switch with the VLAN set by the PVID of that port

-Untagged packets out of the network to a client will gave any VLAN tag stripped from the packet

-Tagged packets will pass through any port that is tagged for the VLAN in the packet

 

-A port can have a multiple VLANs tagged but only 1 untagged (though it can have tagged and an untagged at the same time; e.g. if you have phones with network passthrough that support VLAN tagging, you can set the port on the switch to be tagged on VOIP[10] and untagged on Default[1])

[Davit2005]

It will be a ISP issued router on say 192.168.40.1.

 

I have a virtual machine running Unifi wireless management. I could set the VLAN of the hyper-v machine to say VLAN10 which is the guest wifi but then i would need to be on the guest wifi in order to manage it. Could i configure a static route to allow communication from our curriculum side (VLAN1) to the guest wifi (VLAN10)

 

So the Router will be doing the intervLan routing (the routing of traffic between vLANS) ?? In this is the case you will not need to be adding ip addresses for the vlans on the switch In My Opinoin.

 

Doing IntervLan routing on a layer 3 switch is the best approach rather than the router on a stick method.

 

I have only experience with Cisco and HP switching so could not advise you on config of the Netgear unfortunately.

 

The basics is that:

Each vLAN would have its own IP address

Each device on each vlan uses the ip address assigned to the vlan as their default gateway

The device that is doing the intervLAN routing has a default route/gate way of last resort, a route that forwards any ip addesses unknown pointing to the internet for internet traffic i.e. via the organisations firewall/router.

 

If the device performing intervLan (i.e. Switch) is seperate from the Router/Firewall then a static route may need have to be used on the Router/Firewall to return packets back to the switch.

 

Hope that makes sense.

Edited July 15, 2016 by Davit2005

[Sephiroth]

Doing IntervLan routing on a layer 3 switch is the best approach rather than the router on a stick method.

 

I have no experience with doing it this way, though should also work if preferred. Either way I would use a Layer 3 switch rather than a dedicated router.

 

I have a full Netgear environment with M7300 24 port fibre core and M5300 edge switching in each cab. If you need advice with config just ask.

[nathan]

So for VLANS that need to get out to the internet; i would need to add a static route with the default gateway of the router.

 

If i design it so i don't need any cross talking VLANS i should be fine?

[Sephiroth]

This is the Routing table from my core:

 

The "Learned Routes" at the bottom are the VLANs subnets and the "Next Hop Address" is the router's address and the gateway for the subnet.

 

I have static routes for any traffic that goes to our other site, which you can ignore, but also in the "Static Routes" tab, at the top, is the default route, which means; anything that the router doesn't know about goes to this address (in my case, the firewall/gateway).

 

Once you've added the addresses to the VLANs here:

they are automatically added to the Learned Routes table (above).

 

The routing table is what tells the router where everything is. As it knows where all the subnets are and what the IP ranges are for each, it knows that for a client on VLAN 170 sending packets to the servers on VLAN 10, the packets need to be routed between the 2 subnets.

 

As far as internet access is concerned, What happens is that your device sends a packet request for a website address to it's gateway, the router. the router doesn't know where that address is, so it passes the request to it's default route, the upstream gateway. This process is the same, regardless of which subnet tthe request came from.

Edited July 15, 2016 by Sephiroth

[nathan]

Thank you all for the replies, i think it's starting to sink in now.

 

I'm just configuring the switches, in CAB A we have;

 

2x GS752TS

1x GS728TP

 

In CAB B;

 

1x GS752TS

1x GS728TP

 

My issue is that with GS728TP i'm trying to tag the uplinks with the various VLANS that will be in use so they carry the data from various switches etc.

 

On the GS752TS i can tag the default VLAN 1, but if i try and do it with the GS728TPs i get an error message saying;

 

VLAN 1 : VLAN was not created by user

[Davit2005]

Thank you all for the replies, i think it's starting to sink in now.

 

I'm just configuring the switches, in CAB A we have;

 

2x GS752TS

1x GS728TP

 

In CAB B;

 

1x GS752TS

1x GS728TP

 

My issue is that with GS728TP i'm trying to tag the uplinks with the various VLANS that will be in use so they carry the data from various switches etc.

 

On the GS752TS i can tag the default VLAN 1, but if i try and do it with the GS728TPs i get an error message saying;

 

VLAN 1 : VLAN was not created by user

 

No problem, vLANS can be a little daunting at first but once you have done few the experience is a lot easier.

[nathan]

I've had to change the default VLAN ID from 1 to 50 so i can fully tag the uplink with the various VLANS. Managed to do it without locking myself out which is a first!

[nathan]

I've had to change the default VLAN ID from 1 to 50 so i can fully tag the uplink with the various VLANS. Managed to do it without locking myself out which is a first!

 

Although i have ran into another problem, i've just attempted to put in a static route to the router and i get the following message;

 

Error! The specified Static Route Next Hope Router Address can't be in the same subnet as the service/network port.

 

Any idea what the service/network port is?