Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How to configure VLAN Routing?

Posted on 2009-07-14
7
Medium Priority
?
1,404 Views
Last Modified: 2012-05-07
HI Everyone,
I am planning the configuration of a new network using 4 new switches and using a layer 3 Dell powerconnect 6224 to route between the different VLANs and the external network but I am not entirely sure about how to set up the intra vlan routing etc and was hoping that someone could give me  a few pointers.?

Basically I am ok at to create the VLANs etc on the switches and from what I have read that I need to enable IP routing on the layer 3 switch using the "enable ip routing" command but I am unsure about setting the default gateways etc.


I am planning on using a gateway appliance and want all outbound traffic to go through this device. Do I set the IP address of the gateway appliance as the default gateway for all of the VLANs etc or do I create a default route on the layer 3 switch?

I was under the impression that I cannot configure a default gateway that is on another subnet  so I am wondering what the best approach is in this situation.

Any assistance in helping me clarify this process would be most appreciated.
0
Comment
Question by:SteveJ-007
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 14

Expert Comment

by:mds-cos
ID: 24856839
What is a "gateway appliance"?  Are you talking about a firewall or a router?  If this device is going to be your router for VLAN routing as well as external access you will need to configure it with an IP address that corresponds to each of the VLAN segments.  Set the gateway for computers to the correct IP address for that VLAN.  This would typically be done in the VLAN setup of the router (e.g. the router you select should be VLAN aware, and when you set up the VLANs you will assign an IP address to the virtual port for the specific VLAN).

If the PowerConnect is going to be your main router for VLAN routing (which is how I read your question), and the "gateway appliance" is something like a firewall, the PowerConnect would be the default gateway for all of your devices -- again the correct VLAN IP for the specific VLAN segment the device is on.  Then set the routes on the PowerConnect itself so that it uses the firewall as the default route (0.0.0.0 / 0).  This way IP traffic to any network segment it does not "know about" will get sent to the firewall.  You must remember to configure appropriate routes in the firewall as well back to the VLAN's with the PowerConnect as the next hop gateway.
0
 

Author Comment

by:SteveJ-007
ID: 24856978
Hi mds-cos,
The Gatway appliance that I was planning to use was is a Zxel Zwall USG 1000 UTM appliance.

I would prefer that the Power connect did all the VLAN routing and from what I understand form your post I think that I will create a default route to this device and then configure the default gateway of the VLANS to have the powerconnect switch as their default gateway.

What I am unsure of is the the actual configuration of the default gateway ports e.g.

suppose I have VLAN 1 and VLAN2 with ip address ranges of 192.168.1.0/24 and 192.168.2.0/24  for clients that are on those specific VLANs would I just configure the default gateway to be 192.168.1.0 and 192.168.2.0 or would I actually assign an IP address to one of the ports on the powerconnect switch for each VLAN etc 192.168.1.1 192.168.2.1 and configure them as the default gateway.

I understand that I can create a default route on the powerconnect switch to an interface but I was unsure about what value I would use for the different vlans as default gateways,

any assistance in helping me resolve these issues will be most appreciated

0
 
LVL 8

Expert Comment

by:dosdet2
ID: 24860638
Hi SteveJ-007,
The IP addresses (192.168.1.1  & 192.168.2.1) would actually be assigned to the vlan itself - basically virtual ports within the layer 3 switch.  Your workstation's gateway ip should point to these addresses.  Ports should be assigned to their respective vlans, but not assigned ip numbers.

Then within the layer 3 switch, you should have default routes for destination IP addresses 0.0.0.0 that point to the internal side (internal nat address) IP address of your Zxel Zwall device (192.168.254.1 in the graphic).  

Make sure that the internal nat address in the Zwall is in a different network IP than your 2 vlans and that it matches the IP on the switchport it is connected to.  So you will basically need 3 vlans (including the one that goes to your Zwall) within your layer 3 switch.  See the Graphic - IP numbers are listed to show matching networks.

SteveJ-007.jpg
0
Simplify Your Workload with One Tool

How do you combat today’s intelligent hacker while managing multiple domains and platforms? By simplifying your workload with one tool. With Lunarpages hosting through Plesk Onyx, you can:

Automate SSL generation and installation with two clicks
Experience total server control

 
LVL 8

Accepted Solution

by:
dosdet2 earned 1200 total points
ID: 24860691
Let me know if I have your configuration wrong in the graphic.  
If it is correct, then the summary would be:

vlan1 Workstation gateway = 192.168.1.1
vlan2 workstation gateway = 192.168.2.1

Layer3 switch default route = ip 0.0.0.0  mask 0.0.0.0 points to 192.168.254.1

0
 
LVL 14

Assisted Solution

by:mds-cos
mds-cos earned 800 total points
ID: 24861714
Nice graphics ;-)  I didn't know you could post like that on EE.

One added comment for educationalional purposes.  192.168.1.0 is not a usable IP address with your network mask so would never be set as the gateway for a device.  The bottom and top addresses for any given IP segment are reserved (one is the network address and the other is the broadcast address).  So for a standard /24 or 255.255.255.0 mask, the ...0 address is the network address and ...255 is the broadcast address.

Don't get wrapped around the axel when setting up VLAN routing by overthinking it.  The same rules that apply to standard routing apply to VLAN routing.  You can almost think of each VLAN as if it were a physically seperate segment when defining routing requirements.
0
 
LVL 8

Expert Comment

by:dosdet2
ID: 24862279
That is another issue that you did not address in your original question.  Do you want the two vlans to talk to each other?  If you do, you would need to set that up in the routing table if the layer3 switch - as mds_cos mentions above.

Otherwise they would be basically 2 networks sharing an internet connection.
0
 

Author Closing Comment

by:SteveJ-007
ID: 31603592
Great thanks a lot for the detailed response it is a lot of help.
0

Featured Post

Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question