VLANs - 2nd attempt

[mdrabble]

I attempted to set up VLANs in the summer and failed miserably.

 

i've had a break from looking at this so hopefully try again with a slightly clearer head.

 

Last time I tried to use our Core (DLink) Switch to handle the routing - so this time I am going to use Smoothwall to handle the routing.

 

So before I set off down this slippery road again - I wondered if anyone has any details/guides for setting up Smoothwall to handle VLAN routing followed by configuring Unifi EdgeMax Lite edge switches to forward VLAN routing to the Smoothwall box.

 

Thoughts so far....

 

1. Smoothwall internal network Port - add VLAN Ports and assign VLAN IP Address to each VLAN port - leaving the untagged IP as the default gateway address

2. DLink Core Switch add VLANs but not assigned any IP address to those VLANs.

3. Unifi edge switches add VLANs but not assigned any IP address to those VLANs.

 

4. Configure DHCP on Windows Server for all VLANs except wireless

5. Configure DHCP on smoothwall for Wireless VLANs (using Meraki and Smoothwalls recommended way of setting this up)

 

6. Core switch add IP Helpers (not sure if I need to add on edge switches)

 

7. Tag some ports and test before rolling out whole school.

 

I have a feeling I have missed some important bits out so feel free to point things out

[mavhc]

First question is: Why are you setting up VLANs?

[timbo343]

I attempted to set up VLANs in the summer and failed miserably.

 

i've had a break from looking at this so hopefully try again with a slightly clearer head.

 

Last time I tried to use our Core (DLink) Switch to handle the routing - so this time I am going to use Smoothwall to handle the routing.

 

So before I set off down this slippery road again - I wondered if anyone has any details/guides for setting up Smoothwall to handle VLAN routing followed by configuring Unifi EdgeMax Lite edge switches to forward VLAN routing to the Smoothwall box.

 

Thoughts so far....

 

1. Smoothwall internal network Port - add VLAN Ports and assign VLAN IP Address to each VLAN port - leaving the untagged IP as the default gateway address

2. DLink Core Switch add VLANs but not assigned any IP address to those VLANs.

3. Unifi edge switches add VLANs but not assigned any IP address to those VLANs.

 

4. Configure DHCP on Windows Server for all VLANs except wireless

5. Configure DHCP on smoothwall for Wireless VLANs (using Meraki and Smoothwalls recommended way of setting this up)

 

6. Core switch add IP Helpers (not sure if I need to add on edge switches)

 

7. Tag some ports and test before rolling out whole school.

 

I have a feeling I have missed some important bits out so feel free to point things out

Off the top of my head, tbt looks about right.

[mdrabble]

First question is: Why are you setting up VLANs?

 

Will be introducing IP Phone, plus want to separate wireless traffic etc

[caffrey]

If you use Smoothwall for routing, don't forget the firewall rules to pass traffic. We use Smoothwall for routing but I'd much rather use something else and not relying on it especially if I move to another UTM solution.

[mdrabble]

When you say firewall rules to pass traffic...... does this also include traffic for DHCP, DNS etc......

 

Was going to take look later this morning and wanted to check before I spend some time scratching my head why it doesnt work

Edited November 17, 2017 by mdrabble

[Davit2005]

When you say firewall rules to pass traffic...... does this also include traffic for DHCP, DNS etc......

 

Was going to take look later this morning and wanted to check before I spend some time scratching my head why it doesnt work

 

Yes, you may need rules for both DHCP and DNS. We had to setup DHCP ports both ways between the Server and Client Zones on our firewall for this to work. DNS jus needs to be allowed to your DNS servers, and your DNS servers allowed out to the Internet.

[ITGURU]

I attempted to set up VLANs in the summer and failed miserably.

 

i've had a break from looking at this so hopefully try again with a slightly clearer head.

 

Last time I tried to use our Core (DLink) Switch to handle the routing - so this time I am going to use Smoothwall to handle the routing.

 

So before I set off down this slippery road again - I wondered if anyone has any details/guides for setting up Smoothwall to handle VLAN routing followed by configuring Unifi EdgeMax Lite edge switches to forward VLAN routing to the Smoothwall box.

 

Thoughts so far....

 

1. Smoothwall internal network Port - add VLAN Ports and assign VLAN IP Address to each VLAN port - leaving the untagged IP as the default gateway address

2. DLink Core Switch add VLANs but not assigned any IP address to those VLANs.

3. Unifi edge switches add VLANs but not assigned any IP address to those VLANs.

 

4. Configure DHCP on Windows Server for all VLANs except wireless

5. Configure DHCP on smoothwall for Wireless VLANs (using Meraki and Smoothwalls recommended way of setting this up)

 

6. Core switch add IP Helpers (not sure if I need to add on edge switches)

 

7. Tag some ports and test before rolling out whole school.

 

I have a feeling I have missed some important bits out so feel free to point things out

 

I'm using D-Link for L3 inter-vlan Routing, so a couple of things to check:

Whats the model of the switch? Did you add a L3 IP Interface address into the switch for the VLAN?

Once you have done the above, if you point the clients default gateway to the IP of the switch you can then test ping all the Interfaces on the L3 switch to confirm routing.

[caffrey]

These are the rules that were migrated over, back before the firewall was updated it was called zone bridging

Edited November 17, 2017 by caffrey

[mdrabble]

I'm using D-Link for L3 inter-vlan Routing, so a couple of things to check:

Whats the model of the switch? Did you add a L3 IP Interface address into the switch for the VLAN?

Once you have done the above, if you point the clients default gateway to the IP of the switch you can then test ping all the Interfaces on the L3 switch to confirm routing.

 

DLink DXS-3600-32S and yea added IP to VLAN interface and pointed gateway address to the switch but managed to get some bits working but the biggest issue was the Meraki Wifi.

 

I ran out of time during the summer break which is why I opted to abandon it.

[ITGURU]

DLink DXS-3600-32S and yea added IP to VLAN interface and pointed gateway address to the switch but managed to get some bits working but the biggest issue was the Meraki Wifi.

 

I ran out of time during the summer break which is why I opted to abandon it.

 

Ah nice! I wanted to get one of those top of rack switches to replace our aging DES-660 chassis, but do also have a DGS-6604 Chassis when we expanded on 10gb links.

[mdrabble]

Ok..... had a look this morning and I am admitting defeat and feeling very inadequate - so if any suppliers out who feel they can help please get in touch, also happy for fellow edugeeker to tag suppliers etc and will leave it up to the supplier to decide if they want to contact me.

 

To save relaying the same information to different companies, the network consists of the following:

 

Firewall/Router - Smoothwall S8 UTM

Core Fibre Switch - DLink DXS-3600-32S

Core Copper Switch - DLINK DGS-3420-28TC

Edge Switches - Unifi EdgeSwitch Lite

Wireless Access Points - Meraki APs

 

Would like VLAN creating so Windows clients use Windows DHCP and Meraki Wireless Clients use Smoothwall DHCP.

 

Please PM me your contact details and I will be in touch.

Edited November 22, 2017 by mdrabble

[caffrey]

Might be worth reaching out to Smoothwall, I'm sure there was some catch when I did this

 

Have you set up policies under web proxy - manage policies and created a transparent policy for the vlan ?

 

And another under Network - smoothwall access ?

[NB9457]

Have you tagged all the VLANs on the uplink ports to the switches?

[mdrabble]

Might be worth reaching out to Smoothwall, I'm sure there was some catch when I did this

 

Have you set up policies under web proxy - manage policies and created a transparent policy for the vlan ?

 

And another under Network - smoothwall access ?

 

Yea did all that - also added the subnet under Network->Subnet and still no joy.

 

DHCP wouldnt work plus from a manual IP i could only ping the vlan gateway address.

 

I could perceive with it but I think my sanity will rather get someone in to sort it and leave me in the safe knowledge it would have been done correctly

[mdrabble]

Ok, this is what I have done so far....

 

On the smoothwall box, I added a VLAN port, tagged to relevant VLAN and then configured IP on that interface.

 

Added the following firewall rules.

 

Added the Smoothwall Access rules

 

Added the Network with Network->Subnets

 

Switches,

added VLANs

Set uplink ports as Trunk ports

Switch with Smoothwall connected is also tagged for VLAN

On edge switches added IP Helper address (Windows DHCP Server) - Couldnt add to DLink DXS-3600-32S unless I added an interface for the VLAN - which I can do and leave it empty, but since edge switches all have help addresses thought would be ok.

 

Windows DHCP Server - created scope for VLAN - Router set for VLAN Gateway address.

 

On the switch I am testing a port has been set to VLAN 200 and tagged for VLAN 1 - so

 

 

On a laptop - DHCP doesnt work and with a manually set IP address I can only ping the vlan gateway address.

 

I know i've missed something but no idea what!

[caffrey]

Those rules look the same as mine, it's going to be something so simple you'll kick yourself - done this a few times with Smoothwall when I put a support ticket in

 

Did you create the DHCP scopes on Smoothwall for the wifi ?

 

I have a similar problem to you that may be related, My main radius BYOD setup on Smoothwall works fine I can ping devices on either subnet without a problem. But my guest network doesn't...

[mdrabble]

The VLAN is going to be for the phone system - thought I would try the easy one first! as the phones don't need external access.

 

DHCP for the phones will be Windows DHCP

[markwilfan]

You need to set the ip helper on your router. If smooth wall is routing your vlans you need to set up there. Not sure you can though.

 

Have you considered using one of your switches as the router. Are any L3 switches?

 

Our core switch routes LAN vlans and Smoothwall does our wireless vlans

[markwilfan]

Just reread your posts. Not sure you can have Smoothwall dhcp for some vlans and another dhcp for others. You have the option for dhcp relay which would allow you to use another dhcp but can't see how you would mix them

[caffrey]

Yes you can, I have windows DHCP for network PC's etc. and Smoothwall DHCP for two vlans

 

Here are the interfaces, and the scope if it's any help

 

 

[markwilfan]

Yes you can, I have windows DHCP for network PC's etc. and Smoothwall DHCP for two vlans

 

Here are the interfaces, and the scope if it's any help

 

[ATTACH=CONFIG]46344[/ATTACH]

 

[ATTACH=CONFIG]46345[/ATTACH]

So is your lan a flat lan?

[caffrey]

Flat lan yes, vlans at the moment are only for wifi

[markwilfan]

Flat lan yes, vlans at the moment are only for wifi

That's why it works then. The dhcp server will be broadcasting on that subnet. If the dhcp server is in a different vlan you need an ip helper configured on the router

[markwilfan]

When I get to work I'll post a map of how we got ours configged