Adding BYOD vlan to smoothwall

[Sheridan]

Are you HP wise? If so Tag the ports any clients are in, Untag the one Smoothie is in. That's how I did mine and it's working fine.

 

Steve

 

All netgear here, I've tried untagging the core switch port that the smoothie is attached to but no difference so far. I feel like I'm so close!

[ITGuyWestMidlands]

Try it with a wireless client with a static ip address and try and ping your vlan interface - if you get a response back then your vlan config is fine

[Sheridan]

Well, I'm still stumped with this. I've plugged in a laptop to a port on one of the edge switches (with the port pvid set to 80 as a laptop NIC can't have a vlan set) and I can ping the smoothwall gateway from there - so the vlan appears to be good.

 

I just can't get that same laptop to get a dhcp address from the smoothwall.

[Steve21]

Did you try using a ip-helper on that VLAN? not that you should need it if it's all right but just in case Netgear do something odd :s

 

Just to clarify, if you plug the laptop direct into the Smoothie it's getting ti just not via a single switch? (Laptop one port VLAN'd to another port on same switch?)

 

Any chance of posting some screenshots with the config for those two ports/VLAns etc

 

Steve

[Sheridan]

Sorry about the delay - I've been away for a couple of days!

 

Plugging into the smoothie direct gets an IP, but using the same laptop on a edge switch (with the vlans all configured) doesn't work. But assigning a fixed ip address on that laptop I can ping the smoothie, which suggests the vlan is correctly configured. I've got an ip-helper already on the core switch, but it only applies to the other 'domain' vlans and this seperate vlan shouldn't even connect to any of those - hence the reasons I'm using the smoothie for dhcp!

[Steve21]

Going back one step here. I thought you meant you'd plugged the smoothie and laptop into the same switch (with vlans) to test it? Or are you still going across multiple switches/cores etc between the two?

 

Any chance of the VLAN/ports config data or screenie?

 

Steve

[Sheridan]

Going back one step here. I thought you meant you'd plugged the smoothie and laptop into the same switch (with vlans) to test it? Or are you still going across multiple switches/cores etc between the two?

 

Any chance of the VLAN/ports config data or screenie?

 

Steve

 

Yes - on the core switch the smoothie is plugged into port 1, if I assign PVID 80 to port 2 and plug a laptop into that I get a dhcp address.

 

However, at the edge switche(s) if I configure a port with PVID 80, and have vlan 80 tagged on the trunk ports I get no dhcp address, but can ping the dhcp server when using a fixed IP - so it seems like something blocking dhcp requests across the switches. Netgear don't have a huge amount of options and we have a helper address set on the core switch which is working fine, but that shouldn't be a factor as this vlan is not routed and remains seperate. I'll see if I can pull off some screen shots to make sense of this, but this is how we have it:

 

Core Switch

Port 1 - Smoothie - VLAN 80, pvid 80 (ie completely seperate vlan 80)

Port 2 - test port - PVDI 80, untagged - plugging into this works fine presumably as its on the same switch!

Port 10 - Uplink from edge, tagged 80 (and other vlans not relating to this)

 

Edge switch

Port 1 - laptop - PVID 80, untagged (to test)

Port 24 - uplink to edge, tagged 80 (again with other vlans not relating to this)

 

In my mind the 80 vlan is then a distinct vlan with only the laptop port and the smoothie on it - so a dhcp request should be fine as the multicast is not trying to cross vlans?

Edited November 3, 2016 by Sheridan

[Steve21]

And just to clarify, when you say untagged that's untagged on vlan 80? (Or do you mean you have no tag at all on it?) And has all over vlans removed from that port? e.g Port 1 Edge

 

Steve

[Sheridan]

And just to clarify, when you say untagged that's untagged on vlan 80? (Or do you mean you have no tag at all on it?) And has all over vlans removed from that port? e.g Port 1 Edge

 

Steve

 

Yes exactly that - Untagged for Vlan 80, no tagging for anything else. Its only destined to be part of vlan 80.

[MicrodigitUK]

Yes - on the core switch the smoothie is plugged into port 1, if I assign PVID 80 to port 2 and plug a laptop into that I get a dhcp address.

 

However, at the edge switche(s) if I configure a port with PVID 80, and have vlan 80 tagged on the trunk ports I get no dhcp address, but can ping the dhcp server when using a fixed IP - so it seems like something blocking dhcp requests across the switches. Netgear don't have a huge amount of options and we have a helper address set on the core switch which is working fine, but that shouldn't be a factor as this vlan is not routed and remains seperate. I'll see if I can pull off some screen shots to make sense of this, but this is how we have it:

 

Core Switch

Port 1 - Smoothie - VLAN 80, pvid 80 (ie completely seperate vlan 80)

Port 2 - test port - PVDI 80, untagged - plugging into this works fine presumably as its on the same switch!

Port 10 - Uplink from edge, tagged 80 (and other vlans not relating to this)

 

Edge switch

Port 1 - laptop - PVID 80, untagged (to test)

Port 24 - uplink to edge, tagged 80 (again with other vlans not relating to this)

 

In my mind the 80 vlan is then a distinct vlan with only the laptop port and the smoothie on it - so a dhcp request should be fine as the multicast is not trying to cross vlans?

 

On your uplink ports between switches you need one VLAN untagged to carry all tagged VLANS between the switches.

 

This would normally be your management VLAN 1 or 10 or something else depending on what VLAN the switches management and web interface live on.

 

Some switches will brake this rule by slowing all VLANS to be tagged but automatically setting a primary VLAN to carry the tagged traffic. A primary VLAN is basically a untagged VLAN to carry all the tagged ones. I think HP Procurve / HPE Aruba switches can do this strange auto setting of a primary VLAN if you tag all VLANs on a port.

 

Netgear however will not set a primary VLAN automatically on some switch models, if you simply just tag all VLANs on a link. Try untagging one (the management/primary VLAN) on both switch uplinks and you should see all the tagged VLANs get carried between switches.

Edited November 3, 2016 by MicrodigitUK

[Sheridan]

The uplink ports are all default to untagged on the management vlan (1) - the only tagging on the uplink ports is the actual vlans themselves

[MicrodigitUK]

The uplink ports are all default to untagged on the management vlan (1) - the only tagging on the uplink ports is the actual vlans themselves

 

That sounds correct. Think we will need some screen shots of the 2 switches VLAN config for the ports in question.

 

One other thing to check is the Netgear switch firmware. Is it running the latest version for both core and edge switch? I have in the past (going back 6 years) seen Inter Switch VLAN communication issues on uplinks with bugs in the Netgear firmware. It's a bit of a long shot but worth checking.

 

Post some screen shots of config pages if you can.

[Sheridan]

Well Netgear have had a look at this and are also confused!

 

At the edge switch any device plugged in to a port configured on the vlan does not get dhcp leases from anything running dhcp on the port in the core switch. Assigning fixed IP's to both of the those ports shows connectivity (i.e ping) and packet capture shows the vlan is working as expected.

 

If I run a packet capture on the dhcp host devices plugged into the core, it does not see any of the dhcp requests I can see being sent on the client device plugged into the edge switch, so somewhere the edge switch is blocking dhcp requests but neither me nor Netgear support can see why! Bizarre, but its also a major issue that will prevent me from setting up byod on our wireless - unless I replace our entire stock of switches with HP

[Steve21]

Can you as a test set you core to do DHCP on that VLAN rather than smoothie? And see if that gets to the edge? Just in case some reason it's getting blocked from Smoothwall.

 

Steve

[Sheridan]

Can you as a test set you core to do DHCP on that VLAN rather than smoothie? And see if that gets to the edge? Just in case some reason it's getting blocked from Smoothwall.

 

Steve

 

I've taken the smoothwall completely out of the equation now - a laptops running packet capture on the core switch port does not see dhcp requests coming from the client on the edge switch port. But both can ping each other when with fixed ip's - until I can actaully see the dhcp requests coming across to the core I'm guessing its a switch fault, as the smoothwall won't see any requests to respond to!

[Steve21]

Does that mean even your normal machines aren't working (PCs on old VLANs etc) or just for this VLAN? Just wondering if somethings gone odd with the VLAN in the background if it might be easier to start from a new VLAN

 

Steve

[Sheridan]

Does that mean even your normal machines aren't working (PCs on old VLANs etc) or just for this VLAN? Just wondering if somethings gone odd with the VLAN in the background if it might be easier to start from a new VLAN

 

Steve

 

Everything else works fine, the other dozen or so vlans (wireless and lan) work ok - its just this one which is a seperate isolated vlan (i.e not routed)

 

It now seems to be a specific problem with one model of the netgear switches, as testing on a older model of switch seems to work! So my nice new stacks are not working!

[Sheridan]

Well if anyone else is thinking of trying this with Netgear switches - don't bother. Its a bug in their firmware which isn't resolved. The only way I can resolve this is to ditch a load of their switches and replace them with HP or similar. Not a happy bunny as these are only 2 years old. Ironically some of the older crappier switches work fine, but the new 'Smart' ones are useless.

[ITGuyWestMidlands]

Do you have any official info of the bug?