VLAN/Smoothwall/DHCP question

[Lebowski]

Hello all

 

Trying to set up Smoothwall as a DHCP server for BYOD devices in my school while using windows server for the internal network DHCP. I've configured an interface on the Smoothwall to give out IP addresses in a different range, plugged it into the switch and everything works as it should, it hands out an IP and the device can connect and use internet. Issues arrise in that the smoothwall is giving IP's to computers that should be getting IP's from the windows server DHCP. I've tagged the port the smoothwall dhcp interface goes into with a vlan but it still does it. Just hoping someone can point me in the right direction if they have a similar setup

[tdh1987]

Hi

 

If you’ve dedicated an interface on your Smoothwall for this task then it should be “untagged” on your network switch port.

 

I presume you’ve configured the BYOD SSID network to use the same VLAN and that your WAPs switch ports are configured as “tagged” so it can pass both VLANs

 

Try that and see how you get on.

 

Thanks

 

Tom

[Joeloman]

Check DHCP-Global to make sure that your VLAN against AD is not ticket for DHCP.

 

Normally it might be better to just use one DHCP (Smoothwall) and use Smoothwall as DNS and then only Conditional DNS forwarders for the internal domains.

 

We also usually try to have BYOD on a completely separate network card, then you don't have to be afraid of VLAN spoofing.

[Lebowski]

Hi

If you’ve dedicated an interface on your Smoothwall for this task then it should be “untagged” on your network switch port.

I presume you’ve configured the BYOD SSID network to use the same VLAN and that your WAPs switch ports are configured as “tagged” so it can pass both VLANs

Try that and see how you get on.

Thanks

Tom

That's right, Basically I have nic 1 on the smoothwall going into 1 switch. I have nic 2 on the smoothwall going into another switch as it's POE, this has DHCP enabled and set up in smoothwall, it gives out IP addresses and works fine, the port is tagged (I should try untagging it?) all the access points are tagged in the same vlan on this switch.

 

It all does what I want, it just just overruling the windows DHCP and giving ip addresses to computers, despite being tagged in a vlan.

Edited December 1, 2023 by Lebowski

[Lebowski]

Tried untagging the port on the switch so smoothwall to switch untagged, access points to switch tagged, the 2 DHCP's are still clashing.

[tdh1987]

“Check DHCP-Global to make sure that your VLAN against AD is not ticket for DHCP”

 

Have you checked this yet?

[ibpalle]

From the description it sounds like there is a physical connection between the 2 LANs. DHCP discovery is done using broadcasts that are not subnet specific so the only way this could happen is if DHCP discovery broadcasts for LAN 1 are also seen on LAN 2, which requires a physical connection between the 2, Smoothwall does not pass broadcasts between subnets.

[tdh1987]

How are your uplinks configured between your 2 switches?

[Lebowski]

How are your uplinks configured between your 2 switches?

The Default VLAN is set to untagged then the VLAN which I want to use for the smoothwall DHCP is set to tagged.

[tdh1987]

Your uplink ports should be set at "tagged" not "untagged". Please adjust and try again

[Lebowski]

Your uplink ports should be set at "tagged" not "untagged". Please adjust and try again

Sorry, just being clear, I need to have default VLAN as tagged, then the VLAN I want for the smoothwall DHCP as untagged?

[tdh1987]

What switches are you using?

 

What are the VLAN IDs for the main network and your BYOD network?

 

Thanks

 

Tom

[Lebowski]

ID 1 = default vlan, windows server DHCP running on this.

ID 202 = VLAN id for the smoothwall DHCP to be used for BYOD

[Davit2005]

If you have 2 DHCP servers on the same vlan they will likely clash, jus the way DHCP works. PC sends out DHCP discover > Server sends out offer > PC sends request > Server sends acknowledgment.

 

Personally you should not be having any clients on vlan 1 and the client vlan should be tagged all the way through on uplinks.

 

Creating a sub interface for vlan on the smoothwall and implementing DHCP server only on that sub interface even without knowing Smoothwall sounds like the ticket. You defo do not want 2 dhcp servers on the same vlan.