VLAN segregation : Should Ping work?

[fiza]

I have a server on VLAN2 from where I can ping a PC on VLAN3

From the PC on VLAN3 I can ping the Server on VLAN2.

 

when I look at the ports both of these are connected to they are shown as 'Access' ports and only their own VLAN is listed as untagged ie 3U or 2U

 

I was under the impression they should not be able to communicate. Is this correct and if so does that mean there is a configuration error somewhere?

 

I didn't set up the VLANs BTW.

[Michael]

That's correct, untagged ports shouldn't be able to communicate, only tagged ports can.

 

Untagged should only work on its own native VLAN. I guess it also depends how your router has been setup too.

[ADMaster]

It sounds like inter vlan routing is turned on. Here is a document from cisco, what are your switches?

Configure InterVLAN Routing on Layer 3 Switches - Cisco

[fiza]

That's correct, untagged ports shouldn't be able to communicate, only tagged ports can.

 

Untagged should only work on its own native VLAN. I guess it also depends how your router has been setup too.

 

Router is supplied by Schools Broadband.

 

It sounds like inter vlan routing is turned on. Here is a document from cisco, what are your switches?

Configure InterVLAN Routing on Layer 3 Switches - Cisco

 

Would our Router be allowing the 2 devices to ping each other?

[colly72]

If you have a layer 3 router and inter vlan routing is enabled, then they will be able to ping each other. Either disable inter vlan routing or put ACLs in place

[fiza]

If you have a layer 3 router and inter vlan routing is enabled, then they will be able to ping each other. Either disable inter vlan routing or put ACLs in place

 

If inter vlan routing is enabled would this mean that the vlans are not segregated at all? Would broadcasts from VLAN3 reach devices on VLAN2?

[Davit2005]

You may have issues blocking ping by ACLs I've found. If you had a firewall in between the devices it would make it easier.

 

You can however block things like RDP via ACLs quite easily.

[ADMaster]

It is quite possible the router is allowing the devices to ping each other. If you don't have access to the router contact schools broadband.

If you do have access run show ip route or the equivalent on your system.

[fiza]

The problem I am having is that I have put some phones on VLAN2 and computers on VLAN3. Prior to going on VLAN2 the phones were on VLAN3 but were experiencing dropouts during conversations. I was advised to put them on a separate VLAN. I moved a couple over to VLAN2 but they continue to have the dropouts. Does the inter vlan routing mean that broadcast traffic can travel between the 2 VLANS? Is the traffic on VLAN3 still interfering with the phones?

[colly72]

If inter vlan routing is enabled would this mean that the vlans are not segregated at all? Would broadcasts from VLAN3 reach devices on VLAN2?

 

Even though you can ping vlan to vlan, each VLAN would still be a separate broadcast domain and segmented (layer 2). A layer 3 switch allows for IP routing.

[colly72]

The problem I am having is that I have put some phones on VLAN2 and computers on VLAN3. Prior to going on VLAN2 the phones were on VLAN3 but were experiencing dropouts during conversations. I was advised to put them on a separate VLAN. I moved a couple over to VLAN2 but they continue to have the dropouts. Does the inter vlan routing mean that broadcast traffic can travel between the 2 VLANS? Is the traffic on VLAN3 still interfering with the phones?

 

Are you using SIP for your phone system?

[RobD]

Are they wireless phones or wired phones? If you're using Cisco kit then you could try some auto QoS.

[fiza]

Are they wireless phones or wired phones? If you're using Cisco kit then you could try some auto QoS.

These are wired phones.

Are you using SIP for your phone system?

It's a hosted solution from Horizon gamma systems.

[colly72]

Is the dropout at both ends or just internally? I know you mentioned in a previous thread that your firewall wasn't the issue but I still think it may be a config issue with that. I'd check that SIP was configured correctly and also bypass all IPS, authentication, antivirus scanning etc for your VOIP vlan. Also, as @RobD said, check to see if you can configure QoS. What firewall do you have?

[clockend25]

This is interesting as I recently introduced a new BYOD VLAN to our previously flat network, and we also have a SB-supplied router. The two gateways on the router can ping each other, but clients on each side can't, although this wasn't initially the case and SB had to do some configuration their end to ensure traffic wasn't being routed.

[fiza]

Is the dropout at both ends or just internally? I know you mentioned in a previous thread that your firewall wasn't the issue but I still think it may be a config issue with that. I'd check that SIP was configured correctly and also bypass all IPS, authentication, antivirus scanning etc for your VOIP vlan. Also, as @RobD said, check to see if you can configure QoS. What firewall do you have?

The firewall is also controlled by SB.

[colly72]

Do you know what make the firewall is?

[fiza]

Do you know what make the firewall is?

It's fortigate

[colly72]

I don't know much about Fortigate firewalls but I've heard that SIP ALG can cause issues. Perhaps you could get them to disable it and try setting up SIP as in this document?

 

Fortinet Knowledge Base - View Document

[colly72]

Here's a another link that describes the issue:

 

SIP ALG - Intuitive Technology Knowledge Base