Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 651
  • Last Modified:

5 Vlans, 2 Hp Procurve Switches, One Router, need help!!

My current setup is for a local small church/school.

2x  HP 1810g-24 gigabit swtiches.
2x WAPs
1x Asus RT-n66u (dot1q supporting)

Goal is to create multiple vlans to separate the groups, fileshare, print, etc. with internet access to vlans.

I created 4 vlan's on top of the default 1. they are as follow...

vlan 1 - default
vlan10 - staff
vlan20 - student
vlan30 - multimedia team
vlan40 - general use

I also created a trunk on switch 1 port 2, and trunked it with port 1 of switch 2.

all wiring is centralized to a server rack.
I am also intending to add in a WAP for the student, and one for the general use.

The trouble i am having is, putting in the right untagged/tagged configurations to allow
the vlan's to see the router. I was able to get it at one point, but I didn't save and couldn't recover the settings.  

I have attached an excel sheet of the layout of the switches.
vlan-distro.xlsx
0
Dakren12
Asked:
Dakren12
  • 5
  • 4
  • 3
  • +1
3 Solutions
 
Dakren12Author Commented:
i forgot to mention, all the end hosts are just computers, desktops, laptops, printers, etc... or additional consumer level routers/wap's
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
your trunks need to carry all Tagged VLANs.

your access ports, network ports that connect to staff, student PCs need to be tagged with correct VLANs.

so a student network port is VLAN 20, staff 10 etc

router should understand the tagged traffic

by doing this staff and student traffic will be separated.
0
 
jburgaardCommented:
I agre with hanccocka as far as trunks are concerned: TAG all vlans on up/downlink-ports
OR untag vlan1&Tag the rest
-but do it same way in both ends!

The port leading to router shoud mach config in that end:
my guess would be: untag vlan1&Tag the rest (native vlan =untagged)

But the access-ports must just be UNtagged in one vlan

HTH
0
Get quick recovery of individual SharePoint items

Free tool – Veeam Explorer for Microsoft SharePoint, enables fast, easy restores of SharePoint sites, documents, libraries and lists — all with no agents to manage and no additional licenses to buy.

 
Dakren12Author Commented:
so this is what you guys are saying?

Switch 1 (Port 1 is connected to router, only vlan1 is untagged for router)
               (Port 2 is trunk, tagged for every vlan)

             1 2 3 4 5 6 7 8 9 10  11 12 13 14 15 16 17 18 19 20 21 22 23 24
vlan 1   UTUUU  UUUU  U   U   U   U   U   U  U  U   U   U  U  U   U  U   U
vlan10  T T T T T T  T T T  T   T    T    E   E   E   E   E   E   E   E   E   E   E   E
vlan20  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   T   T   T   T   T
vlan30  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   E   E   E   E   E
vlan40  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   E   E   E   E   E


Switch 2 (Port 1 is trunk, connected to trunk of switch 1, taggged for all vlans)

             1 2 3 4 5 6 7 8 9  10 11 12 13  14 15 16 17  18 19 20 21 22 23 24
vlan 1   T UUUU  UUUU  U   U   U   U  U   U  T   U   U   U   U   U  U   T  U
vlan10  T E E E E E  E E E  E   E    E   E   E   E   E    E   E    E   E    E  E   E   E
vlan20  T E T T T T  T T T  T   E    E   E   E    E   E   E   E    E   T    T   T   T   T
vlan30  T E E E E E  E E E  E   T    E   E   E   E   E    T   E    E   E    E   E   E   E
vlan40  T E E E E E  E E E  E   E    T   T   T   T   U   E    T   T   T    T   T   U  T

Port 16 and 23 is untagged on vlan40 and tagged in vlan1, these port are wireless
access points.

I have attached an excel version
LAYOUT.xlsx
0
 
jburgaardCommented:
normaly a NIC on a PC will not 'understand' a Tagged packet, so UNtag accessports in relevant vlan
0
 
Dakren12Author Commented:
if NIC's wont understand tagged packets.... does that mean i have to UNtag every port that goes to a computer in the corresponding vlans?
0
 
jburgaardCommented:
yes
and maybe also to AccessPoints
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
if NIC's wont understand tagged packets.... does that mean i have to UNtag every port that goes to a computer in the corresponding vlans?

Yes.
0
 
Rick_O_ShayCommented:
I looked in the user manual for the Asus RT-n66u router and don't see anyhting about VLANs or VLAN tagging which would be required for your setup.
0
 
Dakren12Author Commented:
hmmmm, I telnet into the router, and i saw this

Jan 1 01:00:07 kernel: 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
0
 
Rick_O_ShayCommented:
If it does do tagging then you need to have the port on the router and the port it is connected to on the switch tagged for all 4 VLANs. Just like you did for the trunks between the switches.

vlan10 - staff
vlan20 - student
vlan30 - multimedia team
vlan40 - general use
0
 
Rick_O_ShayCommented:
You will also need a different IP interface on the router for each VLAN/Subnet.
0
 
Dakren12Author Commented:
i dont think my router support multiple interfaces for each vlan/subnets, do you have a recommendation under $400?
0
 
Rick_O_ShayCommented:
I can't give you a specific recommendation but you might check out Draytek and Netgear which usually have good pricing.

Just make sure they can do what you want for the VLAN routing piece in your design.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Draytek 2830N
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 5
  • 4
  • 3
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now