fiza Posted June 22, 2017 Posted June 22, 2017 I have a server on VLAN2 from where I can ping a PC on VLAN3 From the PC on VLAN3 I can ping the Server on VLAN2. when I look at the ports both of these are connected to they are shown as 'Access' ports and only their own VLAN is listed as untagged ie 3U or 2U I was under the impression they should not be able to communicate. Is this correct and if so does that mean there is a configuration error somewhere? I didn't set up the VLANs BTW.
Michael Posted June 22, 2017 Posted June 22, 2017 That's correct, untagged ports shouldn't be able to communicate, only tagged ports can. Untagged should only work on its own native VLAN. I guess it also depends how your router has been setup too. 1
ADMaster Posted June 22, 2017 Posted June 22, 2017 It sounds like inter vlan routing is turned on. Here is a document from cisco, what are your switches? Configure InterVLAN Routing on Layer 3 Switches - Cisco 1
fiza Posted June 22, 2017 Author Posted June 22, 2017 That's correct, untagged ports shouldn't be able to communicate, only tagged ports can. Untagged should only work on its own native VLAN. I guess it also depends how your router has been setup too. Router is supplied by Schools Broadband. It sounds like inter vlan routing is turned on. Here is a document from cisco, what are your switches? Configure InterVLAN Routing on Layer 3 Switches - Cisco Would our Router be allowing the 2 devices to ping each other?
colly72 Posted June 22, 2017 Posted June 22, 2017 If you have a layer 3 router and inter vlan routing is enabled, then they will be able to ping each other. Either disable inter vlan routing or put ACLs in place 1
fiza Posted June 22, 2017 Author Posted June 22, 2017 If you have a layer 3 router and inter vlan routing is enabled, then they will be able to ping each other. Either disable inter vlan routing or put ACLs in place If inter vlan routing is enabled would this mean that the vlans are not segregated at all? Would broadcasts from VLAN3 reach devices on VLAN2?
Davit2005 Posted June 22, 2017 Posted June 22, 2017 You may have issues blocking ping by ACLs I've found. If you had a firewall in between the devices it would make it easier. You can however block things like RDP via ACLs quite easily.
ADMaster Posted June 22, 2017 Posted June 22, 2017 It is quite possible the router is allowing the devices to ping each other. If you don't have access to the router contact schools broadband. If you do have access run show ip route or the equivalent on your system.
fiza Posted June 22, 2017 Author Posted June 22, 2017 The problem I am having is that I have put some phones on VLAN2 and computers on VLAN3. Prior to going on VLAN2 the phones were on VLAN3 but were experiencing dropouts during conversations. I was advised to put them on a separate VLAN. I moved a couple over to VLAN2 but they continue to have the dropouts. Does the inter vlan routing mean that broadcast traffic can travel between the 2 VLANS? Is the traffic on VLAN3 still interfering with the phones?
colly72 Posted June 22, 2017 Posted June 22, 2017 If inter vlan routing is enabled would this mean that the vlans are not segregated at all? Would broadcasts from VLAN3 reach devices on VLAN2? Even though you can ping vlan to vlan, each VLAN would still be a separate broadcast domain and segmented (layer 2). A layer 3 switch allows for IP routing.
colly72 Posted June 22, 2017 Posted June 22, 2017 The problem I am having is that I have put some phones on VLAN2 and computers on VLAN3. Prior to going on VLAN2 the phones were on VLAN3 but were experiencing dropouts during conversations. I was advised to put them on a separate VLAN. I moved a couple over to VLAN2 but they continue to have the dropouts. Does the inter vlan routing mean that broadcast traffic can travel between the 2 VLANS? Is the traffic on VLAN3 still interfering with the phones? Are you using SIP for your phone system?
RobD Posted June 22, 2017 Posted June 22, 2017 Are they wireless phones or wired phones? If you're using Cisco kit then you could try some auto QoS.
fiza Posted June 22, 2017 Author Posted June 22, 2017 Are they wireless phones or wired phones? If you're using Cisco kit then you could try some auto QoS. These are wired phones. Are you using SIP for your phone system? It's a hosted solution from Horizon gamma systems.
colly72 Posted June 22, 2017 Posted June 22, 2017 Is the dropout at both ends or just internally? I know you mentioned in a previous thread that your firewall wasn't the issue but I still think it may be a config issue with that. I'd check that SIP was configured correctly and also bypass all IPS, authentication, antivirus scanning etc for your VOIP vlan. Also, as @RobD said, check to see if you can configure QoS. What firewall do you have? 1
clockend25 Posted June 22, 2017 Posted June 22, 2017 This is interesting as I recently introduced a new BYOD VLAN to our previously flat network, and we also have a SB-supplied router. The two gateways on the router can ping each other, but clients on each side can't, although this wasn't initially the case and SB had to do some configuration their end to ensure traffic wasn't being routed. 1
fiza Posted June 22, 2017 Author Posted June 22, 2017 Is the dropout at both ends or just internally? I know you mentioned in a previous thread that your firewall wasn't the issue but I still think it may be a config issue with that. I'd check that SIP was configured correctly and also bypass all IPS, authentication, antivirus scanning etc for your VOIP vlan. Also, as @RobD said, check to see if you can configure QoS. What firewall do you have? The firewall is also controlled by SB.
fiza Posted June 22, 2017 Author Posted June 22, 2017 Do you know what make the firewall is? It's fortigate
colly72 Posted June 23, 2017 Posted June 23, 2017 I don't know much about Fortigate firewalls but I've heard that SIP ALG can cause issues. Perhaps you could get them to disable it and try setting up SIP as in this document? Fortinet Knowledge Base - View Document
colly72 Posted June 23, 2017 Posted June 23, 2017 Here's a another link that describes the issue: SIP ALG - Intuitive Technology Knowledge Base
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now