VLAN gotchas

[chazzy2501]

so the port could be a tagged member of both vlans, but the nic on the server may not be able to support this?

[localzuk]

so the port could be a tagged member of both vlans, but the nic on the server may not be able to support this?

 

Indeed, if you tag them, then you have to also tag them on the server and it has to be able to handle tagging.

[chazzy2501]

do you know if 1 nic can be a member of multiple tagged vlans?

[localzuk]

do you know if 1 nic can be a member of multiple tagged vlans?

 

I think it can, yes, however this would be down to the NIC driver etc...

[m25man]

This is defo the best vlan thread for a while keep up the good work and interesting read..

 

However, not wanting to rain on your parade I would highly recommend you make financial provision for something like the good old LinkRunner as a minimum frontline tool for debugging and troubleshooting this lot!

Its not cheap but I couldnt live without mine.

Im a Fluke User and Evangelist, I do not work for or sell them, but as a network professional I make my living out of using them and they have paid for themselves countless times over..

The Linkrunner Pro will make short work of diagnosing, documenting and debugging your VLan setups and you will soon learn never to step out of your office without it.

[john]

This is defo the best vlan thread for a while keep up the good work and interesting read..

 

However, not wanting to rain on your parade I would highly recommend you make financial provision for something like the good old LinkRunner as a minimum frontline tool for debugging and troubleshooting this lot!

Its not cheap but I couldnt live without mine.

Im a Fluke User and Evangelist, I do not work for or sell them, but as a network professional I make my living out of using them and they have paid for themselves countless times over..

The Linkrunner Pro will make short work of diagnosing, documenting and debugging your VLan setups and you will soon learn never to step out of your office without it.

 

Sorry to continue to de-rail, you say about the Fluke Link Runner Pro, what will that do to help us with VLAN'ing other than pinging and stuff which others do?

[gshaw]

Sorry to de-rail the de-rail but seeing as this thread seems to be a bit more lively than another thread I had some VLAN bits in I'm going to be cheeky and cross-post...

 

If designing an ACL to do something along the lines of...

 

- allow traffic from client VLAN to access ISA server IP

- allow traffic from client VLAN to access DHCP server (via DHCP-helper set on the VLAN)

- deny everything else (HP does this by default but you can define it explicitly as well)

 

Not sure how you'd want to do DNS for those clients, might just be better to set something like your ISP \ Google DNS for the public wifi clients so they never touch your internal DNS server? If you wanted to use the internal DNS just add another ip permit rule.

 

As far as I've understood it the ACL would look something like this (assuming client subnet of 192.168.6.0/24)

ip access-list standard "PUBLIC_WIFI_ISOLATION"

remark "ALLOW ACCESS TO DHCP SERVER 192.168.1.250"
10 permit ip 192.168.6.0 0.0.0.255 192.168.1.250 0.0.0.0 

remark "ALLOW ACCESS TO FIREWALL GREEN INTERFACE"
20 permit ip 192.168.6.0 0.0.0.255 192.168.7.10 0.0.0.0

30 deny any any

 

And on the VLAN definition...

vlan 6
name "WLAN_GUEST"
ip address 192.168.6.254 255.255.255.0
vlan 6 ip access-group "PUBLIC_WIFI_ISOLATION" in

 

(then tag \ untag ports as required)

 

If this looks wrong to anyone please correct me as it's only a theoretical design I've come up with after reading forums \ HP documentation!

 

If that ACL is correct then my other idea for isolating classroom PCs should work on the same concept, but in this case it would be denying certain traffic then allowing everything else...

[m25man]

Sorry to continue to de-rail, you say about the Fluke Link Runner Pro, what will that do to help us with VLAN'ing other than pinging and stuff which others do?

 

It fully supports 802.1x including setting vlan ID, has CDP LLDP so you can plug it in blind tell what vlans are available it will tell you which switch and port number you are connected to set your vlan I'd and watch the dhcp working....

 

30 seconds to validate an outlet.... Now how much time will that save you in a lifetime