Solved

VLANs on Netgear FSM7328s Switch

Posted on 2012-12-28
21
777 Views
Last Modified: 2013-04-05
Hi All,

I am also trying to create 3 vlans on a FSM7328s so I can separate the network to work on machines that are infected.

I have done the following so far.

1. Default vlan - IP 192.168.0.253 (our main network)
2. Created a vlan 10 - IP 192.168.2.254
3. Created a vlan 100 - IP 192.168.100.254

I setup a laptop on for each vlan and can ping each gateway and CANNOT ping each laptop. Now, I need to be able get on the Internet with both laptops on each vlan but still not ping each other.

This is where I am having the problem. I am assuming that I need to create a "trunking" port on the netgear, but I cannot figure it out.

Would love some help with this.

Thanks!
0
Comment
Question by:itsupportmd
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 10
21 Comments
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727135
That's right. The uplink that goes from this switch to your production network needs to be a trunk so that traffic from each of the VLANs can traverse the link. Remember, too, you'll need routing information on your production routing/switching gear so that packets can get back to the VLANs in question as well. When those packets come into your network destined for the laptops in the isolated VLANs, they'll need to know how to get there.
0
 

Author Comment

by:itsupportmd
ID: 38727178
Thanks for the reply. Ok, so I have created static routes in my router, but I still don't know how to make the port on the Netgear switch which connects to my production network a trunking port.
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727219
You want to set that port to be in both your VLANs as well as the default VLAN that delivers traffic to your network. They'll need to be untagged at the access (laptop) side and tagged on the egress/trunk side.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:itsupportmd
ID: 38727233
Thanks, but that is the problem. I can't figure out how to get that configured.
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727249
0
 

Author Comment

by:itsupportmd
ID: 38727320
Thanks, but the FSM7328s switch does not have that interface.
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727343
Here's your admin guide.



http://www.downloads.netgear.com/files/gsm7212_gsm7224_gsm7248_60015_adminguide.pdf

Specifically, in example #4 under the Vlan Configuration section...

Switching --> VLAN --> Port Configuration. To specify the handling of untagged frames on receipt,
and whether frames will be transmitted tagged or untagged.
0
 

Author Comment

by:itsupportmd
ID: 38727448
Ok, thanks. I was able to figure out how to make that port connecting to the production network tagged. I now can ping everywhere on the production network, but I am still unable to get on the Internet.

I tried using the router for dns, my dns server, and the isp, but no go. Any ideas? I now I am probably missing something simple.
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727455
when you do a tracert -d to an internet location from these problem laptops, what happens?
Paste a tracert to google or something so we can see where it fails.
0
 

Author Comment

by:itsupportmd
ID: 38727491
I did tracert -d www.google.com and google.com and the error returned was.....unable to resolve target system name
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727505
Okay. Does your DNS server know how to get back to your laptops from a routing perspective?
0
 

Author Comment

by:itsupportmd
ID: 38727516
Hmmm..I dont' know that answer, so I am assuming probably not. How to I tell it?
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727536
get on your DNS box and try to ping to one of the laptops that cannot access the internet.
0
 

Author Comment

by:itsupportmd
ID: 38727571
ok. I can ping both vlan gateways, from the dns server.
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727578
Okay. Can you ping the laptops themselves from the DNS server?
0
 

Author Comment

by:itsupportmd
ID: 38727588
no
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38727598
okay.
Do you have the laptops' default gateway set as the VLAN gateway address?
IS windows firewall on?
Do this....do an nslookup of www.google.com and record the IP. Get on one of the problem laptops and do a tracert -d of that IP address. Let's figure out if it's routing, DNS, or a combo that's screwing you up here.
0
 

Author Comment

by:itsupportmd
ID: 38727652
Ok. Laptop's gateway is the vlan gateway.

nslookup from Google.com - 74.125.228.71
From the laptop, I did tracert -d 74.125.228.71 - stopped at first hop which is the vlan gateway with destination unreachable
0
 
LVL 11

Expert Comment

by:rharland2009
ID: 38728221
do you have the port that the laptop is plugged into on your switch in the appropriate VLAN?
0
 

Author Comment

by:itsupportmd
ID: 38728308
Yes, that port connects to another simple switch on our network. We can ping everywhere and even remote desktop to the servers on the production network, but cannot surf the Internet.

I even tried changing the static routes on the router to point to the gateway of the default vlan gateway instead of .1 which is the production gateway.
0
 
LVL 11

Accepted Solution

by:
rharland2009 earned 500 total points
ID: 38736510
Okay, what routes are on your router? Do packets coming in from the internet know how to get to your laptops on these new VLANs?
Secondly, you've said you can ping stuff on your production network, RDP, etc. inside the building, but cannot get DNS resolution.
I'm assuming you can ping your DNS server.
Can you run nslookups against it from the command line on one of the problem laptops?
0

Featured Post

Don't Miss ATEN at InfoComm 2017!

Visit booth #2167 to see the  new ATEN VM3200 32 x 32 Modular Matrix Switch. Other highlights include the VE8950 4K HDMI Over IP Extender, VS1912 12-Port DP Video Wall Media Player  and VK2100 ATEN Control System. Register now with Free Pass Code ATEN288!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
clear arp 1 56
QoS on Cisco router 10 59
Changing VLAN information 3 49
Cisco IOS upgrade c3560_backup and deletion of drwx 7 87
The worst thing when starting a new job is when the previous Network Administrator left behind no documentation. How do you get into the devices? If you've been in this situation or just accidently mistyped your password, this article will hopefully…
I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question