Migrating to a layer 3 network -- have it working but confused.
Posted on 2012-08-31
This is a 2 part question and is a bit complex (at least to me).
We currently have a flat network and we are moving to a layer 3 network (obviously with multiple vlans.
Our equipment consists of:
2xDell 6248 (stacked and fully layer 3)
1x2824 (layer 2 "managed" w/ vlan support). Managed is in quotes because it is very basic. Most configuration has to be done via the web interface -- as the cli is missing many of the commands that the 6248 would have. For example: Vlan creation can only occur via the web interface.
This is uplinked to the 6248 over a single copper connection
1x2848 (same as the 2824 but with 48 ports). This will be connected via LAG (4 ports) to the 6248. This is not done yet and not part of the equation (yet).
The first 48 ports of the 6248 are set to access mode for Vlan 100 (untagged). On stack member 2, port 40 is connected to the 2824. The port is set to general mode and the settings are as follows:
pvid 100. My understanding is that this will actually forward the untagged packets as Vlan 100.
All packets are admitted and ingress filtering is enabled.
Additionally, this port is a member of Vlan 500 (Tagged)
On the 2848:
All ports except for 23 and 24 are members of Vlan 100 (untagged). However, it does not seem to matter if I make these ports members or not. As, any connection that is vlan 100 works on these ports. IE the ports can be members of the Vlan 1 (default) and a vlan 100 (untagged) client can still communicate.
Port 23 (Uplink port)
Is a member of Vlan 1, can admit all and Ingress filtering is enabled.
Port 24 is a member of Vlan 500, can admit all and Ingress filtering is enabled.
This all works. I can place members of vlan 100 on the 2824 and they can communicate with the rest of the network. These connections are untagged. I can place a vlan 500 member (untagged as well) on port 24 and it can communicate with all of the other vlans.
Now for my problems:
My understanding is that trunk connection is the usual way of connecting switches. However, this does not work --- I can only communicate with the 2824 when set to general with the configuration above. I am assuming that this is because of the limitations of the 2824 -- as it has no explicit way to set the access mode of the ports. It appears that all of the ports are set to access. Is this the reason or is there something else I am missing?
Additionally, it seems that general mode is more flexible in trunking. Should I just use general anyway when connecting to switches/firewalls etc?
Now for my other question:
I have all of this working but I am confused by how it works. Meaning, how can the 2824 operate correctly for Vlan 100, 500. My problems:
Ports 1-22 will work properly for vlan 100 regards if they are to Vlan 100 or Vlan 1. Why is this?
Port 23 (uplink) is set to Vlan 1 and it works. Any other setting seems to cause problems. As such, Vlan 100 and Vlan 500 pass through. This is very confusing -- as I would think, that the Ingress filtering would discard the frames that don't match vlan 1.
My best guess is that I am not actually passing tagged vlans from the 6248 (though the settings would seem otherwise). However, if this is the case then how exactly can vlan 100 and vlan 500 work correctly?
I hope all of this makes sense --- feel free to ask for clarification etc.
Added by _alias99 per author's request:
NOTE: despite what I wrote above, the uplink ports on both switches are tagged for 100 and 500. I misread my notes and typed in something that was clearly wrong (engage autopilot).