VLAN Help for 2nd subnet

[steveritus]

I'm trying to setup a VLAN for a 2nd subnet for our school which can be used for non-proxy internet access for teachers and guests devices.

 

 

Our router has been configured with 2 subnets, one port: 172.18.192.0/24, gateway 172.18.192.254 (which hosts the server and everything), another port 10.0.59.0/24 (gateway: 10.0.59.254

They both feed into our HP V1910 switch, along with the server and other various items.

 

I've tried creating a VLAN interface for the new subnet with a static IP and have attached a laptop to the same switch also with a static IP. I've tried all manner of tagged / untagged port configs, however cannot get the laptop to ping the 10. gateway. The laptop will ping the VLAN interface on the switch. Our main server on the 172. will ping the 10.0.59.254 gateway (even though I wasn't expecting it to)

 

I really don't know what I'm missing. Any pointers would be much appreciated

[FN-GM]

The for the new VLAN the default gateway and the vlan interface IP should be the same thing. How are you creating this gateway that you can't ping?

 

Our main server on the 172. will ping the 10.0.59.254 gateway (even though I wasn't expecting it to)

 

Unless you put an access control list in place. As soon as you give a VLAN an IP it will be fully routable.

[steveritus]

Thanks for replying. Our routing is centrally controlled so I have no access to it. I've just been given the subnet and gateway details.

[FN-GM]

My reply still stands.

 

Though if you don't control the internet router, to get internet access you will need to get your provider to make changes.

[tomb1987]

First off why would you be giving guests and teachers unfiltered internet? This poses both a safeguarding and security risk. Think there might need to be some political work done here.

 

secondly, you will need to get the company who manages your router to do it. On the switch to make it non-routable just go into the VLAN config and issue the command disable layer 3, you can then enable this for certain VLAN's even narrowing it down to certain protocols.

 

Check the router port is configured properly as a trunk port and the port on the switch should be an access port. If you set it as untagged this will keep it super simple. Do you have a support company as this is a super simple task and I'm sure that can show you how to set it up. Other things you can look at is switch and router firmware. Even a tiny school should have 4 VLANs (flat,wireless,phone,servers) this obviously reduces if you don't provide all of these services

[LytchettNM]

Our router has been configured with 2 subnets, one port: 172.18.192.0/24, gateway 172.18.192.254 (which hosts the server and everything), another port 10.0.59.0/24 (gateway: 10.0.59.254

 

OK so not getting into the should you be allowing this type of unfiltered access, you should be able to plug a computer/laptop into the port of the router’s interface that has the 10.0.59.0 subnet with say a static ip (assuming that the router does not have DHCP setup) of 10.0.59.1/24 and be able to ping the gateway of 10.0.59.254, if you can’t then the config on the router is not correct.

With regard to if it should be tagged etc well that depends on what your are plugging in.

Let say you create a new VLAN on your edge switch’s ie VLAN 59 then the ports on that edge switch that face a computer would normally be untagged and the port of that switch that is connected to your core switch would normally be tagged for VLAN 59, for each switch that is going to require access to this VLAN you will need to repeat this process.

Now on the core switch if you have been able to ping the 10.x.x.x network then that port would need to be plugged into your core switch and that port on your core switch would need to be untagged on VLAN 59, the other ports that connect between the core switch and edge switch’s will need to be tagged. This will create a layer 2 Network/subnet across of the edge switches you configure, so the next this that will need to sorted out would DHCP and DNS I would use the router to provide these just to keep things simple.

Edited February 25, 2018 by Techforyou

[steveritus]

Many thanks for this advice. I will try and sort it out.

 

BTW. It isn't unfiltered internet access. It's just so people don't have to manually enter a proxy server when connecting to the network.

[steveritus]

I can plug a laptop into the router and ping the gateway - no problem. When I connect the router port and laptop to a separate switch - all ok.

 

When I plug the router port and laptop into the core switch - i get nothing. I've kept both ports as access on untaqgged vlan4.

[LytchettNM]

So the first thing I would do is put an IP address on the core switch within VLAN 4 in the same subnet as the router, then ping from the core switch to the router this will prove you have the port of the core switch configured correctly.

What is the make and model is your core switch?

Some switch’s require the PVID to be set manually or there may be an issue with having two ports connected between your router and core switch.

[steveritus]

I've created a VLAN interface on the core switch. I set the router port to trunk tagged vlan4 and the laptop port to access vlan 4. From the switch I can't ping the router. We have 2 HP v1910 switches. I have tried using the 2nd switch but with the same issue

[LytchettNM]

I've created a VLAN interface on the core switch. I set the router port to trunk tagged vlan4 and the laptop port to access vlan 4. From the switch I can't ping the router. We have 2 HP v1910 switches. I have tried using the 2nd switch but with the same issue

 

Ok so you said that you have set the “router port” to trunk.

Do you mean the port of the router or the port of the core switch connecting to the router?

If can plug your laptop into the routers port and it works then the port of the router is configured as an access port, so the port of the switch you are connecting to the router must be configured the same as an access port.