5 Vlans, 2 Hp Procurve Switches, One Router, need help!!

My current setup is for a local small church/school.

2x  HP 1810g-24 gigabit swtiches.
2x WAPs
1x Asus RT-n66u (dot1q supporting)

Goal is to create multiple vlans to separate the groups, fileshare, print, etc. with internet access to vlans.

I created 4 vlan's on top of the default 1. they are as follow...

vlan 1 - default
vlan10 - staff
vlan20 - student
vlan30 - multimedia team
vlan40 - general use

I also created a trunk on switch 1 port 2, and trunked it with port 1 of switch 2.

all wiring is centralized to a server rack.
I am also intending to add in a WAP for the student, and one for the general use.

The trouble i am having is, putting in the right untagged/tagged configurations to allow
the vlan's to see the router. I was able to get it at one point, but I didn't save and couldn't recover the settings.  

I have attached an excel sheet of the layout of the switches.
vlan-distro.xlsx
Dakren12Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dakren12Author Commented:
i forgot to mention, all the end hosts are just computers, desktops, laptops, printers, etc... or additional consumer level routers/wap's
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
your trunks need to carry all Tagged VLANs.

your access ports, network ports that connect to staff, student PCs need to be tagged with correct VLANs.

so a student network port is VLAN 20, staff 10 etc

router should understand the tagged traffic

by doing this staff and student traffic will be separated.
0
jburgaardCommented:
I agre with hanccocka as far as trunks are concerned: TAG all vlans on up/downlink-ports
OR untag vlan1&Tag the rest
-but do it same way in both ends!

The port leading to router shoud mach config in that end:
my guess would be: untag vlan1&Tag the rest (native vlan =untagged)

But the access-ports must just be UNtagged in one vlan

HTH
0
Powerful Yet Easy-to-Use Network Monitoring

Identify excessive bandwidth utilization or unexpected application traffic with SolarWinds Bandwidth Analyzer Pack.

Dakren12Author Commented:
so this is what you guys are saying?

Switch 1 (Port 1 is connected to router, only vlan1 is untagged for router)
               (Port 2 is trunk, tagged for every vlan)

             1 2 3 4 5 6 7 8 9 10  11 12 13 14 15 16 17 18 19 20 21 22 23 24
vlan 1   UTUUU  UUUU  U   U   U   U   U   U  U  U   U   U  U  U   U  U   U
vlan10  T T T T T T  T T T  T   T    T    E   E   E   E   E   E   E   E   E   E   E   E
vlan20  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   T   T   T   T   T
vlan30  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   E   E   E   E   E
vlan40  T T E E E E  E E E  E   E    E    E   E  E   E   E    E   E   E   E   E   E   E


Switch 2 (Port 1 is trunk, connected to trunk of switch 1, taggged for all vlans)

             1 2 3 4 5 6 7 8 9  10 11 12 13  14 15 16 17  18 19 20 21 22 23 24
vlan 1   T UUUU  UUUU  U   U   U   U  U   U  T   U   U   U   U   U  U   T  U
vlan10  T E E E E E  E E E  E   E    E   E   E   E   E    E   E    E   E    E  E   E   E
vlan20  T E T T T T  T T T  T   E    E   E   E    E   E   E   E    E   T    T   T   T   T
vlan30  T E E E E E  E E E  E   T    E   E   E   E   E    T   E    E   E    E   E   E   E
vlan40  T E E E E E  E E E  E   E    T   T   T   T   U   E    T   T   T    T   T   U  T

Port 16 and 23 is untagged on vlan40 and tagged in vlan1, these port are wireless
access points.

I have attached an excel version
LAYOUT.xlsx
0
jburgaardCommented:
normaly a NIC on a PC will not 'understand' a Tagged packet, so UNtag accessports in relevant vlan
0
Dakren12Author Commented:
if NIC's wont understand tagged packets.... does that mean i have to UNtag every port that goes to a computer in the corresponding vlans?
0
jburgaardCommented:
yes
and maybe also to AccessPoints
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
if NIC's wont understand tagged packets.... does that mean i have to UNtag every port that goes to a computer in the corresponding vlans?

Yes.
0
Rick_O_ShayCommented:
I looked in the user manual for the Asus RT-n66u router and don't see anyhting about VLANs or VLAN tagging which would be required for your setup.
0
Dakren12Author Commented:
hmmmm, I telnet into the router, and i saw this

Jan 1 01:00:07 kernel: 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
0
Rick_O_ShayCommented:
If it does do tagging then you need to have the port on the router and the port it is connected to on the switch tagged for all 4 VLANs. Just like you did for the trunks between the switches.

vlan10 - staff
vlan20 - student
vlan30 - multimedia team
vlan40 - general use
0
Rick_O_ShayCommented:
You will also need a different IP interface on the router for each VLAN/Subnet.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Dakren12Author Commented:
i dont think my router support multiple interfaces for each vlan/subnets, do you have a recommendation under $400?
0
Rick_O_ShayCommented:
I can't give you a specific recommendation but you might check out Draytek and Netgear which usually have good pricing.

Just make sure they can do what you want for the VLAN routing piece in your design.
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Draytek 2830N
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.