VLAN setup

[smurfomatic]

Create the Guest SSID as a layer 2 vlan all the way to the Smoothwall. You are using a different vlan anyway for the guests aren't you?

 

That's what I'm trying to set up, a second VLAN for guest wifi only. The issues I'm having are in getting the guest users to get IP addresses from the server, which will hopefully be solved by setting up the core switch as @AB_IT suggested.

[smurfomatic]

Still no joy...

 

Core switch now configured with fixed IP on VLAN 2, and routing set up to direct traffic to the server. Can't ping the server from the switch or vice versa (bearing in mind they are in separate buildings, joined by a fibre link) so just about to give up!

[Davit2005]

OK, so where have you setup the route.

 

Could you paste the switch config but please remove anything sensitive. Also if there has been anything done on the Smoothwall detail that a bit but again remove anything sensitive i.e. IP addresses etc.

 

You should just go down either avenue.

1. Take the vlan as layer 2 to the Smoothwall and seperate it to it's own network/zone/subnet

2. Route the vlan on the core switch

 

You do not need to do both.

 

If you want to use the smoothwall you will need to think about dhcp, dns and rules needed to allow traffic to internal services but I'm guessing for guests this will be minimal.

 

If you want to route on your internal network you may only need the rules on the smoothwall to allow vlan traffic out to the internet and a route for the traffic coming back through the smoothwall to the internal network.

 

Is the vlan that your dhcp server on at the moment routed at the core 3 switch?

Edited February 21, 2020 by Davit2005

[smurfomatic]

Here is the switch config:

 

ProCurve 2910al-48G-PoE Switch# show config

 

Startup configuration:

 

; J9148A Configuration Editor; Created on release #W.14.38

 

hostname "ProCurve 2910al-48G-PoE Switch"

module 1 type J9148A

ip routing

vlan 1

name "DEFAULT_VLAN"

untagged 1-48

ip address dhcp-bootp

exit

vlan 2

name "Guest"

ip helper-address 11.0.0.1

ip address 11.0.0.2 255.0.0.0

tagged 1-48

exit

ip route 11.0.0.0 255.0.0.0 11.0.0.1

snmp-server community "public" unrestricted

spanning-tree

spanning-tree priority 0

loop-protect 1-48

loop-protect 1-48 receiver-action no-disable

 

I haven't done anything on the Smoothwall, as I want to get the devices to get IP addresses issued first! Don't want to overcomplicate things.

[Davit2005]

What is the IP 11.0.0.1 for?

 

But above all I can see an issue there. You have ip routing setup on the switch but you only have an IP address set on vlan 2 and a route. But I cannot see how this will work as I cannot see how can the dhcp server route the IP address back to the client.

 

Save your self any further time and see if Smoothwall tech can advise you on how to route/terminate the guest vlan at the firewall.

 

This is how I done it at the previous college I worked for, a previous school and at home.

Edited February 21, 2020 by Davit2005

[mavhc]

If it's just for guest wifi then there's no problem with using the smoothwall as the router, because all guest wifi traffic will be going via that anyway.

 

So, question is: Are you planning to add more VLANs in the future?

 

Remember that a VLAN is like having a completely separate LAN, until you configure it so it's not. And that's what you want, because you're doing it for security.

 

Do you have UTM licence? If so you can use https://help.smoothwall.net/FilterFirewall/Content/4Services/7DHCP/DHCP.htm on smoothwall it seems.

 

That would seem to avoid any security problems, any problems with multiple blocks of IPs and DHCP mixing up VLANs, 1 DHCP server for your network, a different dhcp server for the guest wifi.

 

Next up, how does your DNS work? Are you wanting to filter the guest wifi? https://help.smoothwall.net/FilterFirewall/Content/3Network/1Configuration/2DNS/DNSPage.htm?Highlight=dns

 

Are you just letting guest wifi users use 8.8.8.8 etc? Could set that in DHCP options.

 

Do they need a proxy? Transparent? HTTPS CA cert installing?

[PyROm]

We have smoothwall route our wifi guest network here. You do not need IP helpers setup if your aim is to keep your networks seperate. On your zone director set it so your ssid is tagged to a vlan, set that vlan as tagged on all your switches (and relevent ports) back to smoothwall.

 

On your smoothwall, on the network interface the traffic is coming in on, create a new vlan interface (Network->Interfaces). You will need to use a different subnet for your guest network so that smoothwall (or any other network kit) knows what network you are talking to, for example if your main network is 192.168.0.0/255.255.255.0 you could use 192.168.1.0/255.255.255.0 as your guest network subnet. I would use the smoothwalls dhcp and dns servers to provide those functions on your subnet (you have to enable them for the vlan and set them up).

[smurfomatic]

Thanks for the suggestions regarding using Smoothwall, I will try to use this but unlikely to get a chance before the Easter holidays!