mdrabble Posted July 5, 2017 Posted July 5, 2017 Currently planning vlans and need some questions answering from people who have vlans, wifi (meraki if poss) and smoothwall setups Currently taking the existing IP Range and splitting it down into small chunks.... eg.. Desktop, Servers, Printer etc. My idea for the wifi vlans are as follows: VLAN 100 - Wireless APs IP: 10.16.118.1/24 (Network IP Range) SUBNET: 255.255.255.0 RANGE: 10.16.118.0 - 10.16.118.254 HOSTS: 254 VLAN 130 - School Devices IP: 10.16.117.0/24 (Network Range) SUBNET: 255.255.255.0 RANGE: 10.16.117.1 - 10.16.117.254 HOSTS: 254 VLAN 110 - Staff Wifi IP: 10.0.2.1/23 SUBNET: 255.255.254.0 RANGE: 10.0.2.1 - 10.0.3.254 HOSTS: 510 VLAN 120 - Student Wifi IP: 10.0.2.1/22 SUBNET: 255.255.252.0 RANGE: 10.0.4.1 - 10.0.7.254 HOSTS: 1022 VLAN 140 - Guest Wifi IP: 10.0.8.1/24 SUBNET: 255.255.255.0 RANGE: 10.0.8.1 - 10.0.8.254 HOSTS: 254 Meraki config - I would set up the reevant VLANs on the SSIDs etc and enable VLAN tagging. On my core switch have a port tagged only allowing traffic with VLANS 110, 120 & 140 and plugged directly into a different port on smoothwall and configure this port with the vlans and get this port to use DHCP So.... does this seem a sensible approach and easy enough to implement? Cheers
robyholmes Posted July 5, 2017 Posted July 5, 2017 I would suggest you try and link the VLAN ID to the IP range. So for my network I have VLAN 172.16.10 as VLAN10, 172.16.20 as VLAN 20. Makes management down the line easier. (Someone else told me this, and its true) 2
Katy Posted July 5, 2017 Posted July 5, 2017 I would suggest you try and link the VLAN ID to the IP range. So for my network I have VLAN 172.16.10 as VLAN10, 172.16.20 as VLAN 20. Makes management down the line easier. (Someone else told me this, and its true) +1 to this, I used to have that kind of layout before joining a trust, now we have multiple ranges (not all contiguous) on the trust WAN and it's very difficult to work out which VLAN a device is on just off its IP address 1
mdrabble Posted July 24, 2017 Author Posted July 24, 2017 Cheers Guy - finally got round to finalizing things and yes makes much more sense to do it the way you suggested
mdrabble Posted July 24, 2017 Author Posted July 24, 2017 Quick question - inter vlan routing..... how do i configure/check? Cheers
markwilfan Posted July 24, 2017 Posted July 24, 2017 Your core switch (must be layer 3) or router needs all vlans configured and a valid ip address. The on hp you just turn on routing. On your other post sounds like you were using the 10g unifi switches as "core" switches but thought they were l2 only
mdrabble Posted July 24, 2017 Author Posted July 24, 2017 (edited) Using a DLink DXS-3600-32S as my core switch and Unifi EdgeLite for my edge switches. I thought the DXS-3600 was full L3 capable but turns out the SI (Standard Image) version has only some L3 options. Although I am slightly confused looking at the L3 options available. Routing IP Helper IP4 Interfaces I am hoping I do not need to purchase the EI (Enhanced Image) upgrade as £2k is a bit much at the moment. If I cannot use the DLink switch then I will have to use either my existing smoothwall S8 appliance or my wipe and reinstall my old Smoothwall UTM1000 appliance for routing (or spin up a VM with some kind of software routing option) As a side thought..... I have an HP 2920-48G switch (am I right in thinking that is Layer 3 capable -if so could I use that instead of the Smoothwall box?) Is it possible to tell from the attached images if, indeed the switch isn't capble for the L3 routing needed? Cheers Mark Edited July 24, 2017 by mdrabble added HP details 1
Blue_Cookeh Posted July 24, 2017 Posted July 24, 2017 It looks to me like that switch should be able to do basic Layer 3 routing with directly connected networks. Can you ping between VLANs if you have a host in each one with the gateway set as that DLink switch? If all else fails, then yes, you can use the 2920 switch you have as a L3 core switch, that’s what we’re using. 1
mdrabble Posted July 25, 2017 Author Posted July 25, 2017 Cheers, I'll have another look when I get to work later.
mdrabble Posted July 25, 2017 Author Posted July 25, 2017 Ok...... in need of lots of hand holding, and help..... lots and lots of help!! Lets start from the beginning........ and hopefully someone can tell me what I am doing wrong..... Trying to set up VLANs with IP Helpers but I've not done something right as client not getting DHCP at all. I'm more at home with a switch GUI than command line - so feel free to provide CLI command if that is going make things better. AD Server Created DHCP scope 10.16.120.0/22 DNS point to windows servers Router points to DLINK switch Core Switch - DLink DXS-3600-32S L2 Features Created VLAN 120 and tagged Port 1/0/19 on VLAN 120 including VID and left VLAN 1 as native VLAN Set port 1/0/19 as a Trunk and allowed all VLANS L3 Features Added IPv4 Route - 10.16.120.0 255.255.252.0 on interface VLAN 120 Added IPv4 Static/Default Route - Gateway 10.16.123.254 on interface vlan 120 UDP Helper (IP Helper Address) added - Interface VLAN 120 with helper address 10.16.119.250 (WIndows DHCP) Unifi EdgeLiite Setup Switch IP details as follows Switch IP: 10.16.118.177 (a temp address) Subnet: 255.255.248.0 Gateway: 10.16.118.55 (DLInk switch) Created VLAN 120 Uplink port Untagged VLAN 1 and Tagged VLAN 120 Client port 1/0/8 - Untagged on VLAN 120 - Have tried Tagged and Exclude for Port 1/0/8 on VLAN 1 Port Summary on 1/0/8 show Port VLAN ID as 120 Any help pointers (slap round the head) welcome
Davit2005 Posted July 25, 2017 Posted July 25, 2017 Is the DHCP servers default gateway the Core switch, the switch doing the Intervlan routing? You'd normally jus have to set the IP address helpers on the vlans of the Core switch, set the approritate IP and subnet on the vlan, set the appropriate scopes on the dhcp server and it works.
mdrabble Posted July 25, 2017 Author Posted July 25, 2017 No but the dhcp scope for the vlan ip range is. I'll double check settings in the morning just in case I've missed something
mdrabble Posted July 26, 2017 Author Posted July 26, 2017 Right..... here are my setting on the DLink Core IP Helper DLink-Core(config-vlan)#show ip helper Interface Helper-address VRF ---------- --------------- ------------- vlan120 10.16.119.250 IP Route DLink-Core(config-vlan)#show ip route Code: C - connected, S - static * - candidate default Gateway of last resort is 10.16.118.55 to network 0.0.0.0 C 10.16.112.0/21 is directly connected, vlan1 C 10.16.120.0/22 is directly connected, vlan120 Total Entries: 2 IP Interfaces DLink-Core(config-vlan)#show ip interface Interface vlan1 is enabled, Link status is up IP Address is 10.16.118.55/21 (Manual) ARP timeout is 20 minutes. IP MTU is 1500 bytes Helper Address is not set Proxy ARP is disabled IP Local Proxy ARP is disabled gratuitous-send is disabled, interval is 0 seconds Interface vlan120 is enabled, Link status is up IP Address is 10.16.120.1/22 (Manual) ARP timeout is 240 minutes. IP MTU is 1500 bytes Helper Address is 10.16.119.250 Proxy ARP is disabled IP Local Proxy ARP is disabled gratuitous-send is disabled, interval is 0 seconds mgmt_ipif 0 is enabled, Link status is down IP Address is 192.168.0.1/24 Gateway is 0.0.0.0 Total Entries: 3 DHCP on Windows 2012r2 IP Scope - 10.16120.0 - 10.16.123.254 Subnet - 255.255.252.0 Gateway 10.16.118.55 (DLink Switch) DNS - 10.16.119.250, 10.16.119.248 What am I missing???
Katy Posted July 26, 2017 Posted July 26, 2017 Your default gateway for the DHCP scope (10.16.120.0) needs to be the core switch interface for that vlan (i.e. 10.16.120.1). Your DHCP server itself needs default gateway to be the core switch interface in its own VLAN (assuming the servers are in vlan1 so that would be 10.16.118.55). Otherwise no traffic on vlan 120 would be able to "see" 10.16.118.55 because it's on a different subnet as well as a different vlan.
mdrabble Posted July 26, 2017 Author Posted July 26, 2017 I've change the Gateway address on my DHCP to 10.16.118.55 (can ping 10.16.120.1) Chnaged DHCP scope so VLAN 120 gateway address is 10.16.120.1 Tested a VLAN'd port and still not getting DHCP address. Think at this rate it may be easier and cheaper to get someone in to sort it
markwilfan Posted July 26, 2017 Posted July 26, 2017 Have you tried drawing a picture. Sometimes that helps me.
markwilfan Posted July 26, 2017 Posted July 26, 2017 So of you can ping across vlans now the routing is working. Look out for typos and the scope is active etc
mdrabble Posted July 27, 2017 Author Posted July 27, 2017 DHCP now working on my VLANS!! - out of frustration I rebooted the core switch and edgeswitch I am using for testing Something must have needed a reboot Only issue now is can't ping any ip addresses or anything using DNS....... Oh well will keep plodding on
mdrabble Posted July 27, 2017 Author Posted July 27, 2017 Scratch that....... can ping VAN1 IP Addresses and internal DNS once I set the gateway address to the Core Switch (10.16.118.55) on those computers Cant ping websites tho such as bbc and google. Ran Tracert and it reaches the VLAN gateway on hop 1 and it report back as destination unreachable. DNS forwarders are set to Smoothwall - Using Smoothwall.... do I have to set the internal nic to use 10.16.118.55 gateway?
mdrabble Posted July 27, 2017 Author Posted July 27, 2017 (edited) didnt configure the core switch with an IP route to smoothwall..... now working on servers but not my clients Halfway there...... Edited July 27, 2017 by mdrabble
Davit2005 Posted July 27, 2017 Posted July 27, 2017 On the Smoothwall you may need to put routes back to each subnet, otherwise the response may not know where to go. 1
mdrabble Posted July 27, 2017 Author Posted July 27, 2017 (edited) Right.... still stuck.... On a Server on VLAN 1 - IP:10.16.119.250 NetMask:255.255.248 Gateway:10.16.118.55 Internet works fine & Tracert shows as expected - <1ms <1ms 5ms 10.16.118.55 (Core Switch/Gateway for Server) <1ms <1ms <1ms 10.16.119.254 (Smoothwall) <1ms <1ms <1ms x.x.x.x (ISP etc......) Client on V120 IP: 10.16.112.2 NetMask: 255.255.252.0 Gateway:10.16.123.254 No internet and Tracert shows the following: 3ms 6ms 6ms 10.16.123.254 (vlan gateway address) * * * request timed out Cant ping smoothwall either from the client on V120..... have added the CoreSwitch IP as Gateway for internal nic but no joy (unless smoothwall needs a reboot) Sudden thought....... CoreSwitch...... what gateway address should this have? At the moment the Gateway address is Smoothwall (10.16.119.254) Edited July 27, 2017 by mdrabble
ADMaster Posted July 27, 2017 Posted July 27, 2017 (edited) Vlan 120 client ip and gateway are in different subnets Mask needs to be 255.255.248.0 or with the current mask bring the gateway to 10.16.115.254 The gateway of your vlan1 is in vlan 120 ip space You need to sort out your overlapping addresses Use an online subnet calculator with cidr your looking at /22 and /21 right now Your /21 can be made into two /22s Also there doesn't appear to be a method to your gateways Use .1 or. 254 and stick to it .55 is odd to me. It makes documentation easier later on I also number the vlan to the third octet where possible Your vlan 120 should start out at 10.16.120.0 or make it vlan 112 It just helps to keep it all straight in my opinion Edit I see your switch config and dhcp scope list vlan 120 as 10.16.120 and your most recent post lists it as 10.16.112 I'll just assume typo and forget most of my post Edited July 27, 2017 by ADMaster
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now