Can this be done with our current equipment ? (VLAN / Wireless / Smoothwall)

[caffrey]

Our network currently consists of a mix of Netgear GS724tv2 and GS748tv2 switches which are working fine (multi cabinet network over the site with gbic fibre converters), we are in the process of adding wireless access points to the network (Dlink dwl-2100)

and are looking at adding guest access to the internet through our smoothwall school guardian.

So with this equipment is it possible to setup VLANs with dual SSID for this purpose ?

been playing about with it today and just can't seem to make it work - so just wondering wether or not its the hardware at fault.

The switches seem to have vlan capability and the access points have multi SSID but - not had a lot of luck.

Any pointers would be appreciated

[caffrey]

nm sussed it.

[jerryOBI]

Looking for answers to the same questions. Sorry, what does "nm sussed" mean?

[caffrey]

means I worked it out for myself - I set up a small test network and played around till it worked

I ended up using two school guardian firewalls - just made things easier. I can explain better when i'm back at work tomorrow if you like.

[jerryOBI]

That would be great. Thanks.

[caffrey]

Ok, here's what i did with the switches, bare with me I'm rubbish at writing docs

also i've got nowhere to upload images at the mo so i've attached them.

 

This is for the GS724T switches, the GS748tv2 are a little different

 

VLAN1C.jpg

 

This is the main lan, the lan that all machines are tied to. All the ports are untagged with the exception of port 22 which is the link to the 2nd firewall

 

VLAN2C.jpg

 

This is the lan for the wireless access points, now this is where it gets fun

 

ports 1,2,3 there are links to the wireless access points and are tagged (T)

port 22 is untagged as this goes to the firewall

ports 23,24 are uplinks with gbics - ALL uplinks have to be tagged on ALL switches - else the tags wont get broadcast

 

PVIDc.jpg

 

Port VLAN ID's

 

This is where you give the ports IDs as to which VLAN they are sitting on

 

As you can see ports 1,2,3 (Wireless access points) are assigned to VLAN2 as is port 22(The firewall)

 

The rest of the ports are assigned to VLAN1

 

One thing to remember is ports 23,24 - The uplink ports have to stay assigned to VLAN1 they just pass the tag info around.

 

Thats pretty much it for the switches, only problem with this is that the wireless access points and the firewall cannot be access from VLAN1 (I added a 3rd nic to the firewall connected to VLAN1 so I can easily administer it)

 

As a result - i've no screenshots of the wireless access points - but if i remember correctly they were straightforward to set up - the hardest part (for me) was setting up the switches.

 

Hope this is ok, well at least provides some pointers

 

Cheers

 

Mark

[jerryOBI]

I actually think I get it. Thank you for the helpful information. :-)

 

Jerry

[caffrey]

no problem, happy to help!

[jpaterson]

just outta curosity, did you have to get another license for smoothwall?

[caffrey]

No, see this thread I started http://www.edugeek.net/forums/internet-related-filtering-firewall/59822-schoolguardian-vlans.html

worked out great as I cobbled together a pc using old parts so essentially cost nothing - did all of this guest access stuff on a shoestring!

 

 

forgot to add

 

The wireless access points have to support multissid

 

Set the main vlan1 SSID with strong key and I disabled broadcasting (bit of a hassle setting up the laptops but its all done now)

 

second SSID on vlan2 is unsecured

 

Second firewall on vlan2 Is transparent and dishes out IP addresses

[singh763173]

Hi caffrey,

 

was wondering if you would be kind enough to help me out with setting up of my vlans.

 

is the FS526T similar to the ones that you have used?

 

I also have a server 2008 box running dhcp server and have already set up the two scopes in there. I also have a standard WAG120N wireless router. I plan to setup a wrg54gl in the second vlan. I also have a GS105E which i can throw into the mix if need be.

[caffrey]

A quick read of the FS526T manual tells me that they look similar, but hard to tell with netgear products, only way to find out is set up some test environment if you have the spare equipment.

We only have one scope on the server - the other smoothwall box takes care of the leases for the wireless network, remember that the wireless environment is completely seperate from the main lan

thanks to the vlan also our router isn't wireless, we rely on access points for that. Also probably no need for 2 routers if your router has lan ports

[singh763173]

thanks for getting back to me, much appreciated.

 

This is currently my home setup, which is where i do all my testing. Im just brushing up on things, always useful lol

 

could you tell me what the physical setup and the config on the switch should be?

 

My current setup consists of the following:

 

Switch with default vlan (all ports) DHCP taken from server

WAG120N wireless router connected to switch (static IP 192.168.1.x assigned)

DHCP Server connected to switch

Client machines wired to switch

Wireless devices connect straight to router.

 

What I want to do is split the switch in two and have the second vlan on the 192.168.2.x scope.

I can setup a smoothwall box thats not a problem - ill figure out using the dhcp server with both vlans afterwards.

The second vlan will be used as a less secure network and i have another router (WRG54GL) which i would like to use for the wireless on that scope.

 

I can tell im over complicating the explanation a little... do u get it? lol

[caffrey]

tried dd-wrt firmware on the routers ? I believe they support vlan

Other than that i'd start off simple

maybe 2 nics in the server with 2 scopes connected to the switch

then set up the vlan similar to my instructions then try devices on different ports on the switch to see what IP they pick up

this is more or less what i did - I used our spare switch and created a small network, when i got it working i just scaled it up to the full network (9 cabs and lotsa switches!)

[singh763173]

ddwrt isnt compatible with the WAG120N but is with the wireless router. Im going to have a play around with it this weekend. Ill report my findings!

 

Thanks for your help

[jerryOBI]

I was wondering if someone could help me with the specifics of how to set up a VLAN for the network using Schoolguardian. No formal network training here and but this must be tackled, so any help would be very appreciated…

Current Network:

1. I currently have a 10.0.0.0 network 255.0.0.0 with a proxy for filtering at 10.0.0.1:xxx where 10.0.0.1 is the Gateway.

2. I also use the DHCP server which points to my primary DNS at 10.0.0.2 and Secondary at 10.0.0.4.

3. I use the DHCP server to hand out static IPs created per MAC addresses of each client. And this, in turn, is used by Guardian Authentication to Identify by IP and filter by groups.

So now I wish to set up a VLAN that will have use of all these assets including – DHCP server/ group filtering, internet access, and proxy. But not sure of all

the hoops I need to jump through to get there.

Here is what I’m thinking:

1. Set up VLAN in Networking>Interface>Interface

2. Set up New DHCP Subnet for VLAN at Services>DHCP>DHCP Server.

a. Question here – How will I point to access DNS?

3. Set up Routing Rule using Networking>Routing>Add a new rule.

4. Set up Zone bridging using Networking>filtering>zone bridging.

a. Question – do I need both Routing rule and Zone bridging?

 

I’m I thinking correctly? How do I proxy and DNS? What am I missing?

Again, any help would be wonderful.

jerryOBI

Edited July 20, 2011 by jerryOBI