Calling all VLAN Gods!

[Jaan]

Yeah thanks for that, i'm taking small steps.... i'd like to get the VLANS in place then do the ACLs. slow migrate from the flat network to vlan with ACLs and implement instages.

 

I guess my next step is static routes on the Core switch for the firewall/internet and also one on the Firewall back to the core switch

[Jaan]

Infact my current VLAN1 the flat network can access the internet even though its gw has changed from my firewall Ip to the SVI GW. My Firewall already knows about the VLAN1 subnet

 

My newly created VLAN30 clients even though getting an IP can't access the internet. Their GW is the SVI of their vlan.... i assume thats because my firewall isn't aware on my new VLAN30 network..... i have set a static route on my Core switch back to the firewall ip. 0.0.0.0 0.0.0.0 10.15.20.2 (firewall ip)

[Davit2005]

4 minutes ago, Jaan said:

Infact my current VLAN1 the flat network can access the internet even though its gw has changed from my firewall Ip to the SVI GW. My Firewall already knows about the VLAN1 subnet

 

My newly created VLAN30 clients even though getting an IP can't access the internet. Their GW is the SVI of their vlan.... i assume thats because my firewall isn't aware on my new VLAN30 network..... i have set a static route on my Core switch back to the firewall ip. 0.0.0.0 0.0.0.0 10.15.20.2 (firewall ip)

Yep you will need a route back otherwise the firewall will not know how to get traffic back to vlan 30 subnet. I am confused with how the flat network is working though with no routes on the firewall.

[Jaan]

I have LAN and interface settings on the firewall for the vlan 1 subnet already inplace from before i started messing.  i can't see any static routes tho.

[Jaan]

Its alive!

 

I have now managed to create a new VLAN30 and i'm able to get a dhcp ip from the new IP Scope from the Windows DHCP server..... i've added static scopes to the core switch and XGS and i'm able to ping from the vlan30 client to the DHCP server/s, Sophos XG, the new SVI on the core and access the internet (once i created a new firewall rules for the test machine).

 

Just wanted to say a big thank you to all the responded, especially @Davit2005 who has been extremely helpful in answering my noobie vlan questions..... thanks for your patience ...... also Google gemini has been really useful also.

 

Think i'm gonna stop here and enjoy the rest on my last day until next monday! woohoo...... 

 

roll on the rest of the VLANS!

 

Cheers

[Davit2005]

21 hours ago, Jaan said:

Just wanted to say a big thank you to all the responded, especially @Davit2005 who has been extremely helpful in answering my noobie vlan questions..... thanks for your patience ...... also Google gemini has been really useful also.

 

No problem at all. You've done most of the hard work so adding vlans should be a relatively easy thing to do from now on. As long as the Smoothwall knows where to forward the traffic to 🙂 . I've created 100+ in my current employment and normally I don't forget anything 🙄

[Jaan]

Only issue i can see, is that anything i drop onto vlan30 (works fine) but i'm not getting anything in my reverse and forward lookup zones on the DNS server for that ip/subnet. 

 

Any ideas?

[Jaan]

 

🥳 Success! Fixed Reverse Lookup Issue, but New VLAN Puzzle! 🧐

 

Hey everyone,

 

Just wanted to share a quick update and give a huge thanks again —I finally fixed my reverse lookup issue! I realised I misunderstood the setup and needed to explicitly add all my ARPA addresses into my reverse lookup zones. Everything's sorted on that front now, which is a big relief!

 

The New VLAN Conundrum (L2 VLANs without L3 VLAN SVI)

However, as I'm finally starting to enjoy getting my head around VLANs and inter-VLAN routing, I've hit a conceptual roadblock that I just can't seem to figure out.

Here's my current understanding that works:

 

L3 VLAN (Inter-VLAN Routing):

• When I configure an SVI (Switched Virtual Interface) on my core switch (which acts as the L3 router), it has an IP address and subnet assigned to it.
• I use a DHCP helper (or IP helper-address) command on this SVI.
• When a device in that VLAN requests an IP, the core switch forwards the DHCP broadcast to my Windows DHCP server using the SVI's IP address as the source IP.
• The Windows DHCP server uses this source IP (the SVI's IP) to correctly identify the DHCP scope it needs to use. (The server looks at the SVI's IP and finds the matching scope).

The Question: Pure L2 VLAN DHCP

• What happens if I just want a pure L2 VLAN without any inter-VLAN routing enabled on the core switch?
• In this scenario, the VLAN has NO SVI and NO IP/subnet configured on the core switch.
• How do the DHCP requests from devices in this L2-only VLAN get to my Windows DHCP server (which is usually in a different VLAN)?
• Crucially, if it does somehow reach the server, how does the DHCP server know which DHCP scope to use, since there's no SVI IP address to match it to?

Is the only solution to have the DHCP server directly connected to this L2 VLAN, or am I missing a fundamental mechanism for getting L2 traffic across L3 boundaries for DHCP?

 

I don't have any ACLs yet so all my L3 VLANs are inter VLAN routing. (not even looked at ACLs yet... i just know its a concept that exists)

 

Thanks in advance for any insights! 🙏

 

 

Yes i did get Gemini to rewrite this to clearly get my point across!

 

thanks again Jaan

 

[5tu]

You'll need a DHCP server in the same layer 2 VLAN (as there is no ip/routing for that VLAN on the core).

 

Edit: or use a forwarder as @mavhc suggests below

Edited November 21, 2025 by 5tu

[mavhc]

You use a dhcp forwarder, or add another nic to your server on that vlan

[Julian]

As others have already said, without layer 3 routing, each layer 2 vlan needs its own DHCP server.

This can be useful! I have used this to keep BYOD traffic away from my core network traffic. (I assume that all BYOD devices, are virus infected, and wish to compromise the school core network, so I do not allow them to see the school core network). My BYOD DHCP functionality, is provide by the router, which also provides NAT mapping.

[Davit2005]

Clients send a broadcast, vlans are local area networks split into broadcast domains. 

 

From our DHCP server (DDI/IPAM appliance) I see the dhcp discover comes from the gateway IP of the subnet the client is on, we use reservations for 99% of our network and if their is no reservation the client device does not get an IP and this is reported in the logs.

 

If your DHCP server is routed on the core switch this is very straight forward only requiring a helper or relay address on the core switch. If you intend to put a NIC on your DHCP server for each subnet I'd be very careful. You literally have a connection from every client to the DHCP server.

 

Why do you want to get rid of Inter-vlan routing ?

Edited November 21, 2025 by Davit2005

[Jaan]

So i already have a dhcp relay on my core for my IPv4 address that point to the dhcp servers (see attachment)

 

This also shows the IPv6 section where i can assign an ipv6 equivalent and which vlan its broadcasts on.....should i have a vlan select for the ipv4 section?

 

i still get get my head around how a L2 client is assigned an IP from the correct scope on the dhcp server if the broadcast doesn't come from a subnet that matches a IP scope/subnet define in my windows dhcp server.... maybe i should step back and enjoy the weekend!

 

 

[Davit2005]

19 minutes ago, Jaan said:

So i already have a dhcp relay on my core for my IPv4 address that point to the dhcp servers (see attachment)

 

This also shows the IPv6 section where i can assign an ipv6 equivalent and which vlan its broadcasts on.....should i have a vlan select for the ipv4 section?

 

i still get get my head around how a L2 client is assigned an IP from the correct scope on the dhcp server if the broadcast doesn't come from a subnet that matches a IP scope/subnet define in my windows dhcp server.... maybe i should step back and enjoy the weekend!

 

 

If you are not using IPv6 don't worry about it. I can only assume that the DHCP server knows which range of IPs to give a client is based on the gateway IP address 🙂

Edited November 21, 2025 by Davit2005

[KK20]

lets say you have v10 10.10.0.0/16 v20 10.20.0.0/16 v30  10.30.0.0/16  with a DHCP server on 10.10.1.1      if you tell your router to add a DHCP HELPER on v20 and v30 (wont need one on v10 as the client will never ask the router to route since it is on the same subnet) of address 10.10.1.1  then a client connecting on 10.30.0.0 sending a DHCPDISCOVER will hit the router, the router will send this to the helper address alongwith the subnet information that it has come from.  As long as the DHCP server has a valid pool for that subnet then it will send a DHCPOFFER response back to the routerwhich passes this back to the client on the other vlan 30,.  The router will handle all the routing - your 10.10.1.1 does not need to be tagged on the v20 nor v30.