Solved

How to configure VLAN Routing?

Posted on 2009-07-14
7
1,389 Views
Last Modified: 2012-05-07
HI Everyone,
I am planning the configuration of a new network using 4 new switches and using a layer 3 Dell powerconnect 6224 to route between the different VLANs and the external network but I am not entirely sure about how to set up the intra vlan routing etc and was hoping that someone could give me  a few pointers.?

Basically I am ok at to create the VLANs etc on the switches and from what I have read that I need to enable IP routing on the layer 3 switch using the "enable ip routing" command but I am unsure about setting the default gateways etc.


I am planning on using a gateway appliance and want all outbound traffic to go through this device. Do I set the IP address of the gateway appliance as the default gateway for all of the VLANs etc or do I create a default route on the layer 3 switch?

I was under the impression that I cannot configure a default gateway that is on another subnet  so I am wondering what the best approach is in this situation.

Any assistance in helping me clarify this process would be most appreciated.
0
Comment
Question by:SteveJ-007
  • 3
  • 2
  • 2
7 Comments
 
LVL 14

Expert Comment

by:mds-cos
ID: 24856839
What is a "gateway appliance"?  Are you talking about a firewall or a router?  If this device is going to be your router for VLAN routing as well as external access you will need to configure it with an IP address that corresponds to each of the VLAN segments.  Set the gateway for computers to the correct IP address for that VLAN.  This would typically be done in the VLAN setup of the router (e.g. the router you select should be VLAN aware, and when you set up the VLANs you will assign an IP address to the virtual port for the specific VLAN).

If the PowerConnect is going to be your main router for VLAN routing (which is how I read your question), and the "gateway appliance" is something like a firewall, the PowerConnect would be the default gateway for all of your devices -- again the correct VLAN IP for the specific VLAN segment the device is on.  Then set the routes on the PowerConnect itself so that it uses the firewall as the default route (0.0.0.0 / 0).  This way IP traffic to any network segment it does not "know about" will get sent to the firewall.  You must remember to configure appropriate routes in the firewall as well back to the VLAN's with the PowerConnect as the next hop gateway.
0
 

Author Comment

by:SteveJ-007
ID: 24856978
Hi mds-cos,
The Gatway appliance that I was planning to use was is a Zxel Zwall USG 1000 UTM appliance.

I would prefer that the Power connect did all the VLAN routing and from what I understand form your post I think that I will create a default route to this device and then configure the default gateway of the VLANS to have the powerconnect switch as their default gateway.

What I am unsure of is the the actual configuration of the default gateway ports e.g.

suppose I have VLAN 1 and VLAN2 with ip address ranges of 192.168.1.0/24 and 192.168.2.0/24  for clients that are on those specific VLANs would I just configure the default gateway to be 192.168.1.0 and 192.168.2.0 or would I actually assign an IP address to one of the ports on the powerconnect switch for each VLAN etc 192.168.1.1 192.168.2.1 and configure them as the default gateway.

I understand that I can create a default route on the powerconnect switch to an interface but I was unsure about what value I would use for the different vlans as default gateways,

any assistance in helping me resolve these issues will be most appreciated

0
 
LVL 8

Expert Comment

by:dosdet2
ID: 24860638
Hi SteveJ-007,
The IP addresses (192.168.1.1  & 192.168.2.1) would actually be assigned to the vlan itself - basically virtual ports within the layer 3 switch.  Your workstation's gateway ip should point to these addresses.  Ports should be assigned to their respective vlans, but not assigned ip numbers.

Then within the layer 3 switch, you should have default routes for destination IP addresses 0.0.0.0 that point to the internal side (internal nat address) IP address of your Zxel Zwall device (192.168.254.1 in the graphic).  

Make sure that the internal nat address in the Zwall is in a different network IP than your 2 vlans and that it matches the IP on the switchport it is connected to.  So you will basically need 3 vlans (including the one that goes to your Zwall) within your layer 3 switch.  See the Graphic - IP numbers are listed to show matching networks.

SteveJ-007.jpg
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 8

Accepted Solution

by:
dosdet2 earned 300 total points
ID: 24860691
Let me know if I have your configuration wrong in the graphic.  
If it is correct, then the summary would be:

vlan1 Workstation gateway = 192.168.1.1
vlan2 workstation gateway = 192.168.2.1

Layer3 switch default route = ip 0.0.0.0  mask 0.0.0.0 points to 192.168.254.1

0
 
LVL 14

Assisted Solution

by:mds-cos
mds-cos earned 200 total points
ID: 24861714
Nice graphics ;-)  I didn't know you could post like that on EE.

One added comment for educationalional purposes.  192.168.1.0 is not a usable IP address with your network mask so would never be set as the gateway for a device.  The bottom and top addresses for any given IP segment are reserved (one is the network address and the other is the broadcast address).  So for a standard /24 or 255.255.255.0 mask, the ...0 address is the network address and ...255 is the broadcast address.

Don't get wrapped around the axel when setting up VLAN routing by overthinking it.  The same rules that apply to standard routing apply to VLAN routing.  You can almost think of each VLAN as if it were a physically seperate segment when defining routing requirements.
0
 
LVL 8

Expert Comment

by:dosdet2
ID: 24862279
That is another issue that you did not address in your original question.  Do you want the two vlans to talk to each other?  If you do, you would need to set that up in the routing table if the layer3 switch - as mds_cos mentions above.

Otherwise they would be basically 2 networks sharing an internet connection.
0
 

Author Closing Comment

by:SteveJ-007
ID: 31603592
Great thanks a lot for the detailed response it is a lot of help.
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now