Vlan Quickie

[Simcfc73]

I am in the process of looking at VLAnning some of my network.

 

Firstly the IP cameras just by port based VLANS.

 

These are netgear switches so I think the teminology is slightly different.

 

On the switch I have untagged port 1 which holds the camera with VLAN 99

 

I have also untagged port 23 whcih goes into the server.

 

As soon as I remove the untagged on port 1 for the default vlan I cannot ping.. shouldn't this work? Both are in the VLAN 99

[localzuk]

The way it usually works for VLANs is this:

 

Untagged ports are assigned to vlans (ie. You untag a port for VLAN 99)

Tagged ports are used as trunks between switches. So all VLANS get tagged on that port.

 

VLANs also need separate DHCP ranges, and then some form of cross VLAN routing if you intend to work across them.

 

So, imagine you have the following

 

VLAN - Purpose

1 - Servers

2 - Clients

3 - CCTV

 

Every switch would need all 3 vlans tagged on their ports which trunk back to your core.

 

Then, you untag each port which has a server on it with VLAN 1, repeat for each port which has a client on it with VLAN 2 and again with cctv with VLAN 3.

 

That would give you 3 'networks' which can't by default see each other. You then need some form of core switch which points each vlan at your dhcp server (on HP switches, this is the dhcp-helper config line). And then something to route between them, if you so wish.

[Simcfc73]

Thats what I thought I had done but as soon as I untag the default port the camera stops responding to pings.

 

I haven't done any DHCP stuff, I just want to get the vlans working on the same IP range.

[localzuk]

Thats what I thought I had done but as soon as I untag the default port the camera stops responding to pings.

 

I haven't done any DHCP stuff, I just want to get the vlans working on the same IP range.

 

What do you have doing cross vlan routing? And you can't have them working in the same IP range, they need to be 2 different ranges. (ie. 2 different subnets).

[Simcfc73]

I was hoping just to use port based VLANS and not use it as a router. I think I need to read more up on this stuff.

[localzuk]

I was hoping just to use port based VLANS and not use it as a router. I think I need to read more up on this stuff.

 

It doesn't matter what method you use to vlan, you still need some form of router to route traffic between the vlans. Imagine VLANs as being entirely separate networks for the different equipment.

[Simcfc73]

Mmmm... I added another Ip address to the server and changed the IP address on the camera and it still didn't work.

 

I was hoping to just use the one switch so I can test VLANS... no inter switch traffic fromt he cameras, the camera and server are ont he same switch.

 

What I don't understand ( and need to read up on) is why use VLANS if you have to subnet... if traffic is on different subnet then why vlan anyway???

[localzuk]

Mmmm... I added another Ip address to the server and changed the IP address on the camera and it still didn't work.

 

I was hoping to just use the one switch so I can test VLANS... no inter switch traffic fromt he cameras, the camera and server are ont he same switch.

 

What I don't understand ( and need to read up on) is why use VLANS if you have to subnet... if traffic is on different subnet then why vlan anyway???

 

How do you have multiple different subnets running on one VLAN without any routing? VLANs allow segregation of traffic - so you can use one set of physical switching infrastructure to support multiple networks. That's the base point of them.

 

On top of that, you can then add routing between VLANs to allow different VLANs to communicate with each other. However, that generally doesn't route broadcast traffic. It also allows you to provide guaranteed network bandwidth to certain applications (for example you can ensure your VOIP phone system has top priority and has guaranteed bandwidth).

 

So, the point of VLANs is basically to allow you to segregate your network into several bits, and then control how they can communicate with each other. This reduces the damage caused to your network should one segment misbehave etc...