VLAN setup

[smurfomatic]

I'm trying to set up separate VLANs for the first time. The plan is to have the default VLAN for all school traffic, and a new one (VLAN 2) just for the Guest wifi so that visitors are blocked from accessing school systems. I would like to use the Zonedirector as a DHCP server for the Guest wifi to keep it completely separate from our servers.

 

Network layout:

 

Ruckus Zonedirector -> HP 2920 switch -> fibre link -> HP 2920 switch -> Smoothwall -> internet

 

What I've done so far:

 

Added new VLANs to the HP switches, configured Zonedirector port to access both VLANs

 

What needs to be done:

 

 

Change Zonedirector Access VLAN to 2

Enable DHCP server on Zonedirector, with different IP range to server

Switch Guest wifi from VLAN 1 to 2

 

Would this work? Seems like it's too straightforward! Does anything else need changing, for example on the Smoothwall?

 

Already made a booboo today, by changing the Access VLAN on Zonedirector first, which dropped it off the network! I had to console connect to fix it.

[AB_IT]

I'd seriously consider renaming your VLAN's from the default values of 1/2 etc for security purposes.

 

See here hopefully this will help https://networkengineering.stackexchange.com/questions/32737/why-should-the-native-vlan-never-be-used

[smurfomatic]

I'd seriously consider renaming your VLAN's from the default values of 1/2 etc for security purposes.

 

See here hopefully this will help https://networkengineering.stackexchange.com/questions/32737/why-should-the-native-vlan-never-be-used

 

Okay thanks, something to consider. Do you think the steps detailed above will get things working as intended?

[PlantHead]

If it was me I would set the DHCP for my guest network as the firewall and keep all traffic as far away from the core network as possible.

That way you can get set DHCP and DNS etc from the firewall and they never touch your internal network.

 

Create Guest VLAN on Zone Director switch, Core Switch and firewall switch - which hopefully are all the same switch

I don't have a Smoothwall but on your Firewall create another virtual connection/interface on the same port as all your other traffic and limit it to the Guest Vlan and setup DHCP. Use the virtual connection/interface ID as the gateway in DHCP

Edited February 17, 2020 by PlantHead

[AB_IT]

Okay thanks, something to consider. Do you think the steps detailed above will get things working as intended?

 

Should do as long as you've ensured each switch is aware of each VLAN it looks fine. Personally I don't like to use Smoothwall to route the VLAN's as it's software based and is much slower, have you got a Layer3 switch you could use instead?

 

I've never seen an issue using DHCP and DNS on your core network and IMO it's much easier to manage so I'd use a standard Windows DC to manage the VLAN's DHCP and DNS. If you're going to use Smoothwall I'd make sure you have heartbeat setup as a wrong turn on the Smoothwall's part could completely kill your network.

[smurfomatic]

Should do as long as you've ensured each switch is aware of each VLAN it looks fine. Personally I don't like to use Smoothwall to route the VLAN's as it's software based and is much slower, have you got a Layer3 switch you could use instead?

 

I've never seen an issue using DHCP and DNS on your core network and IMO it's much easier to manage so I'd use a standard Windows DC to manage the VLAN's DHCP and DNS. If you're going to use Smoothwall I'd make sure you have heartbeat setup as a wrong turn on the Smoothwall's part could completely kill your network.

 

Okay thanks for this, so just set a new IP scope on my DC, for the guest access? How do I get the server to recognise the different VLANs? Running Server 2012 at the moment

[AB_IT]

Okay thanks for this, so just set a new IP scope on my DC, for the guest access? How do I get the server to recognise the different VLANs? Running Server 2012 at the moment

What are you using to route your VLAN's i.e what will be the gateway? If it's the Smoothwall there is a way but I'm unsure as I've never opted to use Smoothwall as the gateway for VLAN's. If it's a core switch, I presume your core is HP?

 

You need to setup each individual VLAN followed by an IP-Helper address and point that IP to your DHCP server. Then create a separate scope in DHCP for each subnet.

[smurfomatic]

What are you using to route your VLAN's i.e what will be the gateway? If it's the Smoothwall there is a way but I'm unsure as I've never opted to use Smoothwall as the gateway for VLAN's. If it's a core switch, I presume your core is HP?

 

You need to setup each individual VLAN followed by an IP-Helper address and point that IP to your DHCP server. Then create a separate scope in DHCP for each subnet.

 

Currently (on the "one VLAN") we have the Smoothwall as the gateway. Core switch is HP so may be better to use that, just need to read up on configuring it properly.

[AB_IT]

Currently (on the "one VLAN") we have the Smoothwall as the gateway. Core switch is HP so may be better to use that, just need to read up on configuring it properly.

 

Here's an instruction for HP switches https://techhub.hpe.com/eginfolib/networking/docs/switches/K-KA-KB/15-18/5998-8164_mrg/content/ch12s04.html that will tell you the command to set an IP Helper Address.

 

ip helper-address "IP Of DHCP Goes Here"

[PlantHead]

I've never seen an issue using DHCP and DNS on your core network and IMO it's much easier to manage so I'd use a standard Windows DC to manage the VLAN's DHCP and DNS. If you're going to use Smoothwall I'd make sure you have heartbeat setup as a wrong turn on the Smoothwall's part could completely kill your network.

 

The recommendation to use the firewall is to avoid leaking between the guest and school network but if the smoothwall isn't up to the job then a switch is the best bet.

I also think if you use Windows DHCP then every user technically should have a CAL to use it.

[AB_IT]

The recommendation to use the firewall is to avoid leaking between the guest and school network but if the smoothwall isn't up to the job then a switch is the best bet.

I also think if you use Windows DHCP then every user technically should have a CAL to use it.

Nothing will leak as long as you stop the firewall from sending traffic from the guest subnet to other subnets and visa-versa, we have it setup so that it will only route the ports required for DHCP service and the DC's IP and anything else is blocked, i.e if you send a ping or any other network request that isn't a DHCP request it gets rejected.

 

Yes but I would assume you'd have CAL's for everyone using the server anyway as it's a DC and I presume it has AD on it with all usernames, profiles on it anyway.

[Davit2005]

My recomendations as I have done this a few times and on Ruckus, but not used a smoothwall

 

1. Create SSID on Ruckus for guest as a vlan i.e. vlan 3

2. Add the vlan as a tagged port on the ports connected to APs

3. Tag the vlan all the way to the firewall as layer 2 and route the traffic there as a seperate zone/network

4. Either configure the firewall to provide DHCP or allow dhcp/dns traffic back into your core network, allowing dhcp/dns traffic to specific internal servers should not pose any security risk.

 

I cannot see there been a big issue because the firewall is software based TBH.

 

If you route the guest network in your internal network you will end up with the internal traffic being routable from the guest network unless you employ ACLs which are more difficult to manage than firewall rules.

Edited February 18, 2020 by Davit2005

[smurfomatic]

All switches are now configured with the new VLAN, do they all need the "IP helper address" or just the core switch?

 

At the moment I'm not getting issued an IP address, but that may be a problem with the server end.

[Davit2005]

All switches are now configured with the new VLAN, do they all need the "IP helper address" or just the core switch?

 

At the moment I'm not getting issued an IP address, but that may be a problem with the server end.

 

It depends, you need to put the IP helper address on where the VLAN is being routed or has its gateway IP address.

 

If you were using a windows DHCP server you should only need to create the scope.

Edited February 18, 2020 by Davit2005

[AB_IT]

All switches are now configured with the new VLAN, do they all need the "IP helper address" or just the core switch?

 

At the moment I'm not getting issued an IP address, but that may be a problem with the server end.

Each VLAN will need it's own IP helper address if you're using the server for DHCP.

 

Check and make sure you can communicate across vlans using ping if you can't ping anything it could be with how you setup your routing.

 

I must add though we don't use Ruckus. Unifi here.

 

As a result I use Unifis built in Guest network features that prevent traffic communicating across to other Vlans I'm not sure if Ruckus has the same!?

Edited February 18, 2020 by AB_IT

[smurfomatic]

Each VLAN will need it's own IP helper address if you're using the server for DHCP.

 

Check and make sure you can communicate across vlans using ping if you can't ping anything it could be with how you setup your routing.

 

I must add though we don't use Ruckus. Unifi here.

 

As a result I use Unifis built in Guest network features that prevent traffic communicating across to other Vlans I'm not sure if Ruckus has the same!?

 

I had the wrong idea on IP helper addresses, hoping I've sorted that part out now.

 

Ruckus has a "guest" option for configuring the SSID, which is what our guest wifi is configured as. Will need to check the documentation to see if this does block across vlans.

[smurfomatic]

Still struggling...

 

All ports on HP switches set to have VLAN 2 "tagged"

Server set up with NIC teaming and VLAN 2 configured

New DHCP range (current network 10.x.x.x, VLN 2 is 11.x.x.x)

IP helper address set to 11.0.0.1 - which is the DHCP server for VLAN 2

 

The VLAN 2 connection reports as "no network access" and has received 0 packets. I'm sure I've missed something obvious, but can't see what it is...

[AB_IT]

Still struggling...

 

All ports on HP switches set to have VLAN 2 "tagged"

Server set up with NIC teaming and VLAN 2 configured

New DHCP range (current network 10.x.x.x, VLN 2 is 11.x.x.x)

IP helper address set to 11.0.0.1 - which is the DHCP server for VLAN 2

 

The VLAN 2 connection reports as "no network access" and has received 0 packets. I'm sure I've missed something obvious, but can't see what it is...

 

What's your gateway IP for the 11. network? Have you setup your core switch to have an IP on that range and made all switches aware of VLAN 2?

 

Also is your core switch a Layer 3 switch? Also have you setup your Smoothwall to stop routing traffic? Network - Configuration - Interfaces should have all subnets listed in there but disabled so that it's aware of them.

Edited February 20, 2020 by AB_IT

[smurfomatic]

The gateway is currently set as the server IP address.

 

If I set up the core switch with an 11. IP range, won't that impact on all the 10. traffic? All switches have VLAN 2 configured.

 

The switch is a HP 2920, can't tell in the documentation I've found online if it's a Level 3 or not.

 

I've not changed anything on the smoothwall, in terms of routing traffic. Though that shouldn't be causing the issue of no traffic at all on the server end.

 

Thanks for your help so far. If this doesn't work soon I'm just going to rely on the Ruckus guest wifi settings blocking traffic to anything other than the internet!

[AB_IT]

The gateway is currently set as the server IP address.

 

If I set up the core switch with an 11. IP range, won't that impact on all the 10. traffic? All switches have VLAN 2 configured.

 

The switch is a HP 2920, can't tell in the documentation I've found online if it's a Level 3 or not.

 

I've not changed anything on the smoothwall, in terms of routing traffic. Though that shouldn't be causing the issue of no traffic at all on the server end.

 

Thanks for your help so far. If this doesn't work soon I'm just going to rely on the Ruckus guest wifi settings blocking traffic to anything other than the internet!

Gateway shouldn't be the server address it should be your core switches address on VLAN 2 network. Your core switch (as long as it's layer 3) can have multiple VLAN's on it i.e you should have an interface vlan 1 set up with an IP and then a separate interface vlan 2 setup with another IP address, this wouldn't effect you VLAN 1 network.

If your switch isn't Layer3 it won't be capable of any of this and you will have to do the routing and VLAN setup on your Smoothwall server.

 

This is a good example of what your switch should look like it sounds as though the 2920 is a Layer 3 switch so should be capable. https://community.spiceworks.com/topic/2022035-hp-procurve-2920-layer-3-routing-switch-example

Edited February 20, 2020 by AB_IT

[Davit2005]

You should set the helper address to the IP address of your dhcp server.

 

Ti rule out anything on the WiFi side you could untagg a port on a switch where you have the guest vlan configured, plug a laptop in and see if it gets an IP address etc. At least you can break it down to smaller chunks to see where the issue is. Even so far as temporarily giving the laptop a static configured IP address on the guest vlan and trying to ping the gateway and dhcp server (if you have allowed ping on the local firewall).

Edited February 20, 2020 by Davit2005

[smurfomatic]

Gateway shouldn't be the server address it should be your core switches address on VLAN 2 network. Your core switch (as long as it's layer 3) can have multiple VLAN's on it i.e you should have an interface vlan 1 set up with an IP and then a separate interface vlan 2 setup with another IP address, this wouldn't effect you VLAN 1 network.

If your switch isn't Layer3 it won't be capable of any of this and you will have to do the routing and VLAN setup on your Smoothwall server.

 

This is a good example of what your switch should look like it sounds as though the 2920 is a Layer 3 switch so should be capable. https://community.spiceworks.com/topic/2022035-hp-procurve-2920-layer-3-routing-switch-example

 

Thanks - will give this a try tomorrow

[Davit2005]

Thanks - will give this a try tomorrow

 

I would still strongly suggest having the guest wifi routed on the firewall, is there no one at Smoothwall that you could reach out to for a bit of guidance to get it setup?

[smurfomatic]

I would still strongly suggest having the guest wifi routed on the firewall, is there no one at Smoothwall that you could reach out to for a bit of guidance to get it setup?

 

I'm sure there is someone who could help, but can't see how that would work. How is the Smoothwall going to identify the difference between guest and normal traffic, unless it's separated by VLAN?

[Davit2005]

I'm sure there is someone who could help, but can't see how that would work. How is the Smoothwall going to identify the difference between guest and normal traffic, unless it's separated by VLAN?

 

Create the Guest SSID as a layer 2 vlan all the way to the Smoothwall. You are using a different vlan anyway for the guests aren't you?