mrforgetful Posted February 19, 2007 Posted February 19, 2007 What am I missing here? The switch already has vlan1, vlan10, vlan50 I telnet to my switch I type menu I go to the vlan menu I add a vlan with name vlan30 and id 30 I go Port Assignment and change my ports to no for every vlan except vlan 30 which I set to untagged (this is how the other working vlans are done) What else do I need to do, because when I do this the ports dont work.
DMcCoy Posted February 19, 2007 Posted February 19, 2007 The machines in the vlan aren't tagging their traffic are they?
mrforgetful Posted February 19, 2007 Author Posted February 19, 2007 I've no idea to be honest how would I find out? They work fine on those ports if they're set to use one of the other vlans on that switch just not any of the ones I add in.
Geoff Posted February 19, 2007 Posted February 19, 2007 Have a look in your clients network driver properties for anything that mentions '802.1Q'
Ric_ Posted February 19, 2007 Posted February 19, 2007 @mrforgetful: If you are changing all the ports, the management connection might be getting broken before the job can complete. Try doing the same thing using a serial connection.... don't forget to check the settings for the management interface to make sure it is in the correct vlan.
mrforgetful Posted February 19, 2007 Author Posted February 19, 2007 The NIC does have a VLAN ID property but it's not set. Thing is the PC works no matter what it's plugged into. I'm only changing 6 ports, two to ID 20, two to 30 and two to 60. I think I'll just move them to another switch lol. Thanks anyways
Mr_T Posted February 19, 2007 Posted February 19, 2007 What am I missing here? The switch already has vlan1, vlan10, vlan50 I telnet to my switch I type menu I go to the vlan menu I add a vlan with name vlan30 and id 30 I go Port Assignment and change my ports to no for every vlan except vlan 30 which I set to untagged (this is how the other working vlans are done) What else do I need to do, because when I do this the ports dont work. Which Model switch are you using? I tend to set up Vlans using the CLI
mrforgetful Posted February 19, 2007 Author Posted February 19, 2007 Forgot that bit lol, it's a 2650. I use the cli on the Ciscos.
DMcCoy Posted February 19, 2007 Posted February 19, 2007 I assume you only want the ones on each vlan to talk to eachother. You will need to route the vlans if you want them to talk to anything else.
mrforgetful Posted February 19, 2007 Author Posted February 19, 2007 They want to talk to everything. How do I set up a route? A point to some documentation would be fine
Mr_T Posted February 20, 2007 Posted February 20, 2007 Forgot that bit lol, it's a 2650. I use the cli on the Ciscos. Try using they CLI the commands are almost identical to IOS. Are you remembering to save the config at the end? I know it's basic but it's possible.
DMcCoy Posted February 20, 2007 Posted February 20, 2007 ftp://ftp.hp.com/pub/networking/software/2600-2800-4100-6108-AdvTraff-Oct2005-59908853.pdf
GeeDee Posted March 1, 2007 Posted March 1, 2007 What exactly are you trying to achieve? Unless you have a 'special' setup, you want to configure all the ports for your new vlan as untagged; except for the uplink port(s) which will need to be tagged. The switch at the other end of the uplink will then need the vlan creating & tagging as well as untagged on any other ports with machines in the new vlan on. Then same on any other switches elsewhere. That will create you a 'new' network, across multiple switches - but unless you have either another router or you configure ipforwarding (or whatever HP might call it - assuming your switches are layer3) to forward layer3 traffic you won't be able to talk to anything except your new network. Are you sure you actually want a new VLAN? What's the purpose of it here?
mrforgetful Posted March 1, 2007 Author Posted March 1, 2007 It's not a new vLAN it's just new to this switch. We have the following vLAN arrangement 1 - Servers 3 - Printers 10 - ITRoom1 20 - ITRoom2 30 - ITRoom3 40 - ITRoom4 50 - ITRoom5 60 - ITRoom6 70 - ITRoom7 80 - F and G floord 90 - C,D,E Floors 110 - A and B Floors 110 - H Floor and Library I've added two new computers to to each of the rooms 2, 3 and 6 but the switch they are patched into only has vLANs 10, 50 and 70 on it. I just wanted to include the relevant vLANs for the new PCs. I've now just patched them into other switches so they're working.
Face-Man Posted March 1, 2007 Posted March 1, 2007 Does your backbone switch deliver the relavant "tagged" vlan packets to the switch. The port with your uplink in must have Vlans 20 30 and 60 tagged for both the switch with the "untagged" computers on and the upstream switch. If you want to check it works you can allocate the switch an ip address and see where you can ping it from. (though be careful about subnets it can get very fussy). As a general rule all data traveling between switches when you are using VLANs should be tagged and all data to worksation untagged (unless you want to configure multi homes in networking). I hope this helps
GeeDee Posted March 1, 2007 Posted March 1, 2007 For the purposes of 'making it work'; you probably haven't tagged the vlan on the uplink. Aside from that though, why on earth so many vlans? Seperating by room seems a little more than overkill! You can happily run several hundred machines on a single network even over 100meg uplinks. The only thing you're going to cut down on over all those vlans is broadcast traffic - which really won't be an issue (at least not in the average environment) until you hit ~400 odd machines. Seems like extra overhead on your switches & technician time for no good reason really.
mrforgetful Posted March 2, 2007 Author Posted March 2, 2007 Yes! That's the problem. Well, they're not tagged so I'm guessing it is. We have a vLAN per room just because when I came here there were already around that many vLANs but weren't in any particular arrangement. When the Head of ICT wanted to look into blocking internet access by room I realised we have enough to assign each room it's own vLAN and then I could block access using our ISA, so that's how it ended up like this. It works fine until there's something like this, but I'll remember this oversight and it wont happen again lol.
GeeDee Posted March 2, 2007 Posted March 2, 2007 You can assign each room it's own network as part of a larger single subnet without arsing around with a small world of vlans. vlan'ing everything off just creates so much unnecessary load on the switches that have to do all this extra routing. Why not just assign each room a /24 of part of a /16 network (or a /26 as part of a /23 or whatever). You can then do your room blocking by network to get just the same result without all the overhead. Glad you managed to solve it though.
DMcCoy Posted March 2, 2007 Posted March 2, 2007 You can assign each room it's own network as part of a larger single subnet without arsing around with a small world of vlans. vlan'ing everything off just creates so much unnecessary load on the switches that have to do all this extra routing. Why not just assign each room a /24 of part of a /16 network (or a /26 as part of a /23 or whatever). You can then do your room blocking by network to get just the same result without all the overhead. Glad you managed to solve it though. Its the broadcast traffic that I'm looking at reducing with vlan implementation, as well as 802.1x. Mixing different subnet masks can also break things (snmp for me).
mrforgetful Posted March 2, 2007 Author Posted March 2, 2007 I know nothing about subnetting *ashamed*
GeeDee Posted March 2, 2007 Posted March 2, 2007 Its the broadcast traffic that I'm looking at reducing with vlan implementation, as well as 802.1x. Mixing different subnet masks can also break things (snmp for me). Sure, and that's the primary reason for deploying vlans in this kind of environment usually - but you really don't need many. Running Windows clients, you could happily shove ~350 - 400 machines in a single vlan, even with 100meg uplinks & clients using el cheapo switches. And you don't need to mix subnet masks (nor should you) just to provide a 'simple' way to select a logical group of machines. The machines can run on a /24 (or whatever), but when you tell your proxy to deny on a /26, only those logical machines will be affected. It's just an easy way to select part of a network. I know nothing about subnetting *ashamed* It's actually pretty easy to get your head round, at least at this sort of level. All you need to remember is that a /24 is your typical "home network" block of 255 addresses, using a subnet mask of 255.255.255.0. So 10.10.1.0/24 would be a single network of 10.10.1.0 through 10.10.1.255, using a subnet mask of 255.255.255.0. You then just work from there, so a 10.10.1.0/23 would be 10.10.1.0 through 10.10.2.255 (and 10.10.1.0/25 would be 10.10.1.0 through 10.10.1.127). So, if your network runs on a big network of 10.10.1.0/24, but you tell your proxy to please ban 10.10.1.0/25 - that would be 10.10.1.0 through 10.10.1.127. Likewise, banning 10.10.1.128/25 is the other half of the network. You can of course go deeper, a /30 is a network of 4 machines.
mrforgetful Posted March 2, 2007 Author Posted March 2, 2007 Makes no sense to me lol. I don't think I can remember what /23 etc changed the addresses to. Anyways, on a brighter note (or not you may think ) today I've taught myself to add a vLAN from scratch, so now I have a VLAN130 First time I've set up a DHCP scope, DNS Lookup Zone, configured the support for it on my Core Switch and added a Virtual LAN adaptor! Go me. I've earn't my fish and chips for dinner hehe, oh and Curry tonight with the IT department. Sorry I'm ranting - really good mood. Thanks for all your help and advice guys.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now