Calling all VLAN Gods!

[Jaan]

Hey all, i've finally got some time to put my research into practice and move away from a flat network!

 

I'm a total VLAN noob, but have done lots of research, watched loads of videos and was feeling confident..... but i seem to have failed at the first hurdle!

 

I'm not getting an IP address on my newly created VLAN30 and now i think i'm overlooking things.

 

First thing i'm confused myself over is access vs trunk ports and how they handle VLANs

 

From what i understand, an access port can only support 1 VLAN, anything more than 1 and it has to be a trunk port? is this right....... what about Voice vlan? is this an exception to the rule? my switches seem to allow me to have a access port set with a default vlan of 30 but also says allowed 1-4094... this seems to contradicted what a access port is?

 

I know i can Google and AI search this, but wanted to ask from a real world point of view as some info contradicts.

 

More details on my lack of a DHCP IP in my next post.... just need to check a few things first.

 

Fanks

[DGardiner]

how are ou distributing the ip?

 

are you using an ip helper on the router to forward to your server on another vlan? or do you have a dhcp server in that vlan?

[FN-GM]

Quote

From what i understand, an access port can only support 1 VLAN, anything more than 1 and it has to be a trunk port? is this right.......

 

Correct

 

Quote

what about Voice vlan? is this an exception to the rule?

 

Correct

 

Quote

my switches seem to allow me to have a access port set with a default vlan of 30 but also says allowed 1-4094... this seems to contradicted what a access port is?

 

What is the full configuration of the port. On Cisco switches you can add configuration that doesn't actually apply as it superseded by other config. For example, you can have allowed VLANS on an access port, the line of config is there but doesn't actually do anything.

 

 

Before getting to DHCP, check if static IP addressing works.

Edited October 21, 2025 by FN-GM

[Jaan]

Thanks all, here's my not getting a IP address on VLAN30 issue.

 

Probably too much info here, but just trying to post a clear picture of where i'm at. I have multiple vlans to create but thought i'd start with 1 first (vlan30) and see if i can get it working and getting an IP address from the correct scope..... here goes....

 

I have a core L3 switch that will be doing the inter vlan routes, i'm not using the FW to do this. My edge switches are L2+ and both core and edges are FS switches. The firewall is a Sophos XGS but i've not done anything to that yet, from what i understand i need to set a static route on it for the vlan scope once i'm ready to allow internet access..... but i need an IP address first, so i'm worry about the FW later..... unless that is my issue!

 

I also have a windows DHCP servers that will be doing DHCP for these VLANs. I'm not using dhcp on any of the switches.

 

I have created vlan 30 on both my core and edge switches. Created a SVI on the core switch;

 

SVI: 10.10.15.254 /22 (255.255.252.0) on vlan 30

 

and enabled dhcp relay to my windows dhcp server 10.15.20.111.

 

The DHCP scopes on the win server are as follows:

 

10.10.12.0 /22

dhcp range: 10.10.12.2 - 10.10.15.253

10.10.12.1, 10.10.15.254 & .255 not in dhcp scope

003 router = 10.10.15.254 (svi ip on L3 switch???)

006 DNS = 10.15.20.111

 

trunk ports on switch uplinks are aware of vlan 30 and the port my test pc is connected to on the edge has a default pvid of 30 but "allows 1-4094" and is a access port.

 

I think that's it... i was expect to get a IP address from the new scope, but just get a 169.x.x.x.

 

Any thoughts?

 

EDIT: IP errors removed

 

Edited October 21, 2025 by Jaan

[FN-GM]

Quote

10.10.21.1, 10.10.15.254 & .255 not in dhcp scope

 

21 is outside of your range. Should this be 12?

 

I am not familiar with FS switches, but on Cisco routing isn't enabled by default. You need to turn it on with this command:

 

IP Routing

 

 

Have you tried setting a static IP address and seeing if that works?

 

 

Have you also configured IP helpers on the SVI so it can find the DHCP server?

Edited October 21, 2025 by FN-GM

[1TF0rward]

11 minutes ago, Jaan said:

SVI: 10.10.15.254 /22 (255.225.252.0) on vlan 30

Should this not be 255.255.252.0?

[FN-GM]

1 minute ago, 1TF0rward said:

Should this not be 255.255.252.0?

 Correct, I hadn't spotted that.

[Davit2005]

Is your DHCP server also routed on the same core switch i.e. has it's gateway on the same core switch?

 

As @FN-GM mentions. set a static IP in the correct range, see if you can ping the default gateway of the new vlan, then see if you can ping the DHCP server (assuming the windows firewall on the DHCP server is set to allow). 

 

Trace the MAC address of the client to the core switch, if this does not work the could be a vlan config issue on an edge switch or anywhere in between.

 

Breakdown into basic steps 🙂

Edited October 21, 2025 by Davit2005

[Jaan]

Thanks all,

 

Couple of typos in there welldone for spotting that! errors updated

 

I have a dhcp relay (ip helper) on my core switch that points to my 10.15.20.111 dhcp server

 

i'll try settings a static ip and pinging the dhcp.... i'll look into checking if routing is enabled on the switch... i just assumed it was.

 

 

[Jaan]

22 minutes ago, Davit2005 said:

Is your DHCP server also routed on the same core switch i.e. has it's gateway on the same core switch?

 

no my dhcp server's gw is 10.15.20.2 which is the Sophos XGS

[Jaan]

after setting a static ip on my test PC

 

i can ping the core svi but not the dhcp server. the dhcp server normally response to ping requests from the flat network

 

PC also not appearing in DNS reverse lookup zone.

Edited October 21, 2025 by Jaan

[Jaan]

Routing seems to be enabled. Looking at the documentation, as soon as a svi is created its enabled.... and not control by the ubiquitous "ip routing" cli command.

 

 entering "show ip route" into the web cli displays;

 

FS#show ip route
Codes:  C - Connected, L - Local, S - Static
        R - RIP, O - OSPF, B - BGP, I - IS-IS, V - Overflow route
        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
        E1 - OSPF external type 1, E2 - OSPF external type 2
        SU - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
        IA - Inter area, EV - BGP EVPN, A - Arp to host
        * - candidate default
Gateway of last resort is no set
C     10.10.12.0/22 is directly connected, VLAN 30
C     10.10.15.254/32 is local host.
FS#

[Davit2005]

1 hour ago, Jaan said:

 

no my dhcp server's gw is 10.15.20.2 which is the Sophos XGS

Try putting a route on the XGS to the vlan 30 subnet that you configured on the core switch. You will prob need that anyway to enable the XGS to know how to get to the vlan 30 subnet to route traffic back to the clients on vlan 30.

 

assuming there is no firewall rules between the 2 interfaces on the XGS.

 

i.e. route 10.10.12.0/22 via the core switch IP. I'm assuming you can ping the core switch from the XGS.

 

Also it looks like you have no gateway/route set on the core.

 

I think if your DHCP server was routed on the core switch you'd probably been cooking on gas by now 🙂

Edited October 21, 2025 by Davit2005

[Jaan]

Thanks, i'll check it out.... just got called out for something else 🙃

 

i assumed i only needed one static route on the xgs for internet traffic..... have i misunderstood that?

Edited October 21, 2025 by Jaan

[Davit2005]

13 minutes ago, Jaan said:

Thanks, i'll check it out.... just got called out for something else 🙃

 

i assumed i only needed one static route on the xgs for internet traffic..... have i misunderstood that?

The XGS will need to know how to get to the 10.10.12.0/22 network. Routers do not forward traffic unless they know where to forward it to. It will not be aware of 10.10.12.0/22 because it does not have an interface relating to that on it's system.

Edited October 21, 2025 by Davit2005

[Jaan]

And i need this even tho i'm using my L3 for intervlan routing? (sorry i'm new to vlans)

 

I even had this written down (step7) but have one static rule covering the whole 10.10.0.0 /16. I assume that's ok and i don't need one for each svi?

 

 

[Davit2005]

25 minutes ago, Jaan said:

And i need this even tho i'm using my L3 for intervlan routing? (sorry i'm new to vlans)

 

I even had this written down (step7) but have one static rule covering the whole 10.10.0.0 /16. I assume that's ok and i don't need one for each svi?

 

 

Yep you should of covered it with the /16 we do similar. You still need a route on the core switch thou? Do a tracert on the client that has a static IP to the DHCP server and see how far it gets.

Edited October 21, 2025 by Davit2005

[Jaan]

So i need a static route on both my xgs and the core switch?

 

doing a tracert from my test pc i get;

 

1 - 10.10.15.254 - reports: Destination unreachable.

 

The XGS is connected to the LAN via 10.15.20.2/255.255.252.0

 

I have not done anything to the xgs yet with regards to any VLANS

 

I can't ping from the XGS to the core SVI of 10.10.15.254

 

thanks for looking

[Davit2005]

5 minutes ago, Jaan said:

So i need a static route on both my xgs and the core switch?

 Yep looks like it. Not familiar with FS switches but in an earlier output the core shows following Gateway of last resort is no set

 

You should be able to ping the core from the XGS, not familiar with those either but do you need to specify source interface or IP for the ping? It might be vlan tagging on either the XGS or core?

[Jaan]

I can't currently ping to core from the XGS. the XGS does allow me to select a source interface and IP to ping.

 

I think the issue deepens here.

 

I can't create a static route on the XGS as the Management IP of the core isn't on the same subnet. I can change that, however creating a static route from the xgs to the core would create a single point of failure. VRRP or HSRP on the cores would help to protect against this, but i'll need to research it. The "core" is in fact two stacked switches with management IPs of 192.168.1.50 & .51 .... i think the core switches will need new management interface IPs on the same subnet as the XGS LAN interface with the cores ideally having VRRP or HSRP ......... well this just snowballed 🙃

[Davit2005]

1 hour ago, Jaan said:

I can't currently ping to core from the XGS. the XGS does allow me to select a source interface and IP to ping.

 

I think the issue deepens here.

 

I can't create a static route on the XGS as the Management IP of the core isn't on the same subnet. I can change that, however creating a static route from the xgs to the core would create a single point of failure. VRRP or HSRP on the cores would help to protect against this, but i'll need to research it. The "core" is in fact two stacked switches with management IPs of 192.168.1.50 & .51 .... i think the core switches will need new management interface IPs on the same subnet as the XGS LAN interface with the cores ideally having VRRP or HSRP ......... well this just snowballed 🙃

The unreachable would indicate it is getting to the core but not any further which could be a lot of causes i.e. vlan or ip routing.

 

The core switch needs to know where to route default traffic too and the XGS needs to know where to send it back.

 

A static route will still work to a VRRP IP address as long as you use the virtual address of the vrrp instance for the static route, therefore giving you redundancy. We have same setup between our current cores and our firewall. Stacking unless it is logical is always going to be a PITA. Although in our case the firewalls we use are active/passive and the passive firewalls interfaces are shutdown leaving only the active firewall interfaces up. But the core to firewall still uses a vrrp for the route from firewall to core.

 

You could create a subnet jus for routing, this would be more advisable in my opinion, a subnet not used anywhere else. It jus needs to be a 255.255.255.248 (/29) network which gives enough addresses for the VRRP on the core and the XGS. It should still give you the flexibility although you still have a point of failure as in one firewall but less is best.

 

So for instance:

core to XGS vlan255

vrrp ip: 172.16.0.1

SW1 ip:172.16.0.2

SW2 ip: 172.16.0.3

XGS ip: 172.16.0.6

 

Put a route on the XGS for the 10.10.12.0 (vlan 30).

 

 

Edited October 22, 2025 by Davit2005

[Jaan]

1 hour ago, Davit2005 said:

 

You could create a subnet jus for routing, a subnet not used anywhere else. It jus needs to be a 255.255.255.248 (/29) network which gives enough addresses for the VRRP on the core and the XGS.

 

 

 

So point the XGS to an a new routing only svi on the core?

 

Not just any existing svi owned by the stack?

Edited October 22, 2025 by Jaan

[Davit2005]

14 minutes ago, Jaan said:

 

So point the XGS to an a new routing only svi on the core?

 

Not just any existing svi owned by the stack?

Yep. Obviously a bit more work. The flat network should not be impacted as it is jus layer 2 with an IP interface only on the XGS. Any new vlans can be created on the core switch and as long as you have them in the bigger 10.10.0.0/16 range you should not need to do any more than create them on the core and edge switches. I'd also create the static route with a metric of 10 for a bit of flexibility. Directly connected interfaces will normally have a metric of 0 with the normal default metric of 1 for static routes. This is much lower than any dynamic routing protocols but that is another story completely and for a small network with minor changes not worth the hassle to create a dynamic routing protocol. Not only that dynamic routing protocols can take up system resources.

Edited October 22, 2025 by Davit2005

[Jaan]

i've added my existing flat network 10.15.20.0 /22 to my L3 switch svi and i'm now able to get dhcp requests for my new vlan from the dhcp thats on my "old" flat network. That network is on a different subnet so i guess adding an SVI to that subnet allows te switch to be aware of it.

 

I haven't created a static route on anything yet. But i'm get DHCP and able to tracert to 10.15.20.111 from my client on the new vlan now.

 

Internet next!

 

Thanks for all your input, gonna step away from it for the moment a documents a few things before moving on.

 

 

Edited October 27, 2025 by Jaan

[Davit2005]

39 minutes ago, Jaan said:

i've added my existing flat network 10.15.20.0 /22 to my L3 switch svi and i'm now able to get dhcp requests for my new vlan from the dhcp thats on my "old" flat network. That network is on a different subnet so i guess adding an SVI to that subnet allows te switch to be aware of it.

 

I haven't created a static route on anything yet. But i'm get DHCP and able to tracert to 10.15.20.111 from my client on the new vlan now.

 

Internet next!

 

Thanks for all your input, gonna step away from it for the moment a documents a few things before moving on.

 

 

If your DHCP server has its gateway on the same L3 switch then that makes it a hell of a lot easier 🙂. vLANS don't add security on their own though and would consider either ACLs or enabling firewall on servers so you can lock down traffic from clients to the servers and even server to server 🙂