Hi there,
I'm in need of some expert help, I've got myself in over my head and have run out of ideas! Basically I'm trying to set up a 3com Baseline 2924-SFP Plus managed switch with 4 vlans. My intention is to keep 4 departments separated from each other but share the same broadband connection.
I thought when I was buying the switch that it could act as a DHCP server and all I would have to do is configure it so that each VLAN had a different subnet but it turns out the switch doesn't act as DHCP server.
Currently I have the switch set up in such a way that the all clients are getting their IP address from the broadband router and each client has an internet connection but clients in the different VLANs can still see each other.
I've set it so that:
- ports 1-4 are tagged members of VLAN1 and untagged members of VLAN4
- ports 5-8 are tagged members of VLAN2 and untagged members of VLAN4
- ports 9-16 are tagged members of VLAN3 and untagged members of VLAN4
- ports 17-23 are tagged members of VLAN1 and untagged members of VLAN4
- Port 24 is an untagged member of VLAN4 and is also the port where the broadband router is plugged in.
As I've said before, I'm in over my head here but I kinda need to get it up and running properly, next time I'll leave it to a pro!
Thanks,
Liam
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I will try to explain this as I see it...could be wrong without more information.
What you got:
They can all see each other because all are untagged members of Vlan 4.
Tagged is for switch to switch/router relay( not in your case tho, dsl router will need an untagged vlan).
untagged is basically for end node, pcs..printers etc.
You want port 24 tagged for Vlan 1, 2, 3 ,4...Your DSL router probably doesn't understand vlans specifically tagged vlans.
All ports are tagged for 1, 2, 3 or 4 ....a pc or printer does not understand 'tagged' or Cisco term "Trunked".
Here is what you want:
Make the router ip the default gateway for the switch. Assign one vlan to the router subnet. Assign this vlan to untagged 24 and only use for this vlan. This address is used for gateway of last resort, create a vlan only for this and assign no where else.
You may need a static route to route all traffic to dsl address.
Leave IP routing off ..as suggested by Quori.
Each vlan needs to be on it's own subnet and end nodes will use this address as their gateway.
If you want dhcp, then you have to have a dhcp server on the other side and use a dhcp helper address.
I can answer all you VLAN needs as my network has many...let me know if this is not clear enough for you.
Thanks---
Mick
There are a few things wrong with the above - mostly around layer 2 and layer 3 operation, but before I go into that -- what sort of router are you using? Can you check if Proxy-ARP is enabled on your switch for your VLANs? What is your default gateway for your clients set to?
Reason I ask is your switch is layer 2 only, so shouldn't be facilitating inter-VLAN communication (simply can't!) unless it is using proxy-arp.
Are all the pcs that get their dhcp from the router on the same subnet? Is vlan4 on this subnet? It sounds like all the pcs are using vlan4 only. Maybe I am underestimating you dsl router, does it understand vlans? Quori is correct that your switch is layer 2 only, so no routing capabilities, I based some of my info from his earlier comment regarding routing on the switch.
If you are using multiple VLANs they need to have separate subnets which will require an external router interface for each subnet or a routing process running on the switch.
By definition devices in one VLAN can't communicate with devices in another VLAN without a router.
If your current router can handle tagging then it could be used with one tagged logical interface on its physical port for each of the 4 subnets you need.
Hi,
I would also guess that everything is currently in the same vlan (vlan4).
Remember pc's send and receive untagged Ethernet by default.
You will not be able to separate the network into segments with your current equipment.
You need to add
1. a dhcp server to handout ip's + gateway settings for each vlan, this could be done on a current server or on a L3-Switch capable of dhcp.
2. a router (L3 device) to interconnect the vlan's and do the require filtering, recommended would be a L3-Switch that can do wire-speed routing.
One option (as explained above) is to create one subnet for each VLAN. This will require that the DSL router have to support 802.1Q trunking (tagged vlans), and changes in IP addresses.
There is another option, though: Overlapping VLANs (Private VLANS in Cisco can accomplish the same). The principle is that you put the switch uplink (link to router) in more than one VLAN, so that traffic from the router is sent to all VLANs, but traffic from end devices is only forwarded to members of that specific VLAN.
The trick is that the switch should be able to accept more than one vlan on an untagged port, and I'm not sure if 3Com can do it, or how. I'm a Cisco guy myself...
I'll have a look, and get back to you.
Hi, first off thanks everyone for their help so far, they've gone a long way in helping me understand whats gone wrong.
I think I will have to follow Diepes advice and have to invest in more equipment but I'm also interested in Otto_N's suggestion, I'll have a look at the 3com switch and see if it's possible.
Based on the 3com user guide (http://support.3com.com/i
As I indicated: some Cisco switches have "private VLAN" functionality, but we're also using some Foundry switches. But if the router can support 802.1Q, and possibly serve as DHCP server, it should be much less hassle.
Business Accounts
Answer for Membership
by: QuoriPosted on 2009-09-13 at 19:27:49ID: 25322716
What specifically are you having an issue with or want to change?