?
Solved

VLAN and Routing Design

Posted on 2014-01-27
11
Medium Priority
?
424 Views
Last Modified: 2014-01-30
Have attached a proposed LAN diagram to illustrate what I am trying to do.  Want to totally separate the Staff and Public into 2 VLANs.  Then create another for all the video equipment.  The Staff and Public do have to share a standalone server which I could put on another VLAN.

VLAN10  = Staff
VLAN20  = Patron
VLAN30  = Video
VLAN40  = Shared Resources

All the switches are L3 capable, but not familiar with routing setup.  Have setup VLANs in L2 mode and with the Sonicwall performing the routing.   Got some feedback that it would be better to do the routing with the switches?  How would that change the configuration?

So far does this seem like a good proof of concept?  Any other thoughts.
LAN-Diagram.png
0
Comment
Question by:Webcc
  • 4
  • 4
  • 3
11 Comments
 
LVL 37

Expert Comment

by:bbao
ID: 39814017
your network topology should be changed to meet your requirement of routing between VLANs with a L3 switch.

simply use one of the L3 switch as the central router, then connect the other switches and Sonicwall to the central switch through the ports assigned to the VLANs on each connecting devices.

as for the L3 routing configuration on the central switch, please see below the discussion on Cisco site.

https://supportforums.cisco.com/thread/2080774
0
 

Author Comment

by:Webcc
ID: 39814196
Not clear on how to config the L3 switch.  First I assume that I have to assign IP addresses to the VLANs and then how do I configure the L3 switch to connect to the other switches and Sonicwall?  Do I configure trunk ports and tag the VLANs on those ports?

Started with this on one switch -
VLAN1      192.168.1.1 (mgmt VLAN)
VLAN30    10.10.30.1
VLAN50    10.10.50.1

Sonicwall -
Setup interface X5   192.168.1.2
Subinterface X5:30  10.10.30.2
Subinterface X5:50   10.10.50.2

Is this a correct start?  Do all the VLANs have to be setup on the Sonicwall?
0
 
LVL 26

Accepted Solution

by:
Soulja earned 2000 total points
ID: 39815440
What you want to do is:

1. For your L3 switch connected to the Sonicwall. Enable routing and create a vlan interface for each vlan.

2. Trunk the vlans to the other switches that are layer 2.

3. Configure one vlan interface on the layer 2 switches for management. Configure the default gateway on the L2 switches to be the vlan 1 interface of your layer 3 switch.

4. The connection to the sonicwall from your L3 switch will be an access port on vlan 1.

5. Remove the subinterfaces on the Sonic as it won't be routing vlans anymore. It will only route internet /wan traffic.

6. Create a default route on the L3 switch to the sonicwall.

7. Create static routes on your sonicwall to your vlan 30 and 50 subnets. The next hop will be the vlan 1 interface of the L3 switch.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 37

Expert Comment

by:bbao
ID: 39817380
> Do all the VLANs have to be setup on the Sonicwall?

VLAN is not necessarily seen on the SonicWALL device except you do have VPN based or related controls on that. commonly, if you multiple internal VLANs or subnets and they all share the same Internet connection, the internet-facing firewall or router just need to have one link (on a dedicated subnet) back to the central L3 switch.
0
 

Author Comment

by:Webcc
ID: 39819818
Have a few questions:

1.  Connected L3 switch to Sonicwall on interface X5.  
            SWITCH   = >       VLAN1 =   192.168.1.1
                                         VLAN30 = 10.10.30.1
                                          VLAN50 = 10.10.50.1
            SONICWALL =>   X5 = 192.168.1.2
2. Trunked Port 27 to L2 Switch
3. Configured VLAN1 on L2 Switch =>  192.168.1.3  Default gateway = 192.168.1.1
4. Connected L3 to Sonicwall  set as an Access port on L3 switch
Thought this had to be a trunk port with the VLANs added to the port as Tagged?

5. Done
6.  Created Default Route on L3 as 192.168.1.2
7. Conceptually I get the thought process but cannot figure out to set the routes?
      Asking for Source, Destination, Service, Gateway, Interface and Metric....
     Do I need to create new address objects to accomodate VLAN IP's and L3 Gateway?
0
 
LVL 26

Expert Comment

by:Soulja
ID: 39819847
Yes. The connection fron l3 to sonic should be an access port.
You options sound like a fw rule.
Regardless the route  should be something like:
Source any
destination 10.10.30.0
service any
Gateway 192.168.1.1
I am not that familiar with Sonicwalls but the concept should be the same.
0
 

Author Comment

by:Webcc
ID: 39819938
Ok got it working.  Thought that VLAN1 should only be used for management?
The VLANs added to the trunk ports need to match between the L2 switches and L3 I assume and tagged?
Can I deliver DHCP from the Sonicwall to the VLANs this way?

Thanks
0
 
LVL 37

Expert Comment

by:bbao
ID: 39820046
> Can I deliver DHCP from the Sonicwall to the VLANs this way?

i don't think SonicWALL supports DHCP services across multiple subnets (VLANs) through a single physical port. :(
0
 
LVL 26

Expert Comment

by:Soulja
ID: 39820424
It would be ideal if you can run dhcp from the switch or a server.
0
 

Author Comment

by:Webcc
ID: 39820595
What about the last two questions:

1.  Thought that VLAN1 should only be used for management?

2. Do the ports on the L2 switches that connect to the L3 trunk ports also have to be set as trunk ports and are they all tagged?

Thank you!
0
 
LVL 26

Expert Comment

by:Soulja
ID: 39820877

1.  Thought that VLAN1 should only be used for management?


Not a big deal to use that vlan, but if it really bothers you, you could use a separate network between the switch and firewall such as

- creating a new vlan interface on the switch. Assign that access port to that vlan and chaning the firewall ip address to be in that vlan. It could be a small /30 network.
-Option 2: change the port connecting to the firewall into a routed port assign an different ip not part of your vlans and change the ip on the firewall to be part of that same subnet. It can be a /30 also.

2. Do the ports on the L2 switches that connect to the L3 trunk ports also have to be set as trunk ports and are they all tagged?


Yes you want those to be trunks also.
0

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Arrow Electronics was searching for a KVM  (Keyboard/Video/Mouse) switch that could display on one single monitor the current status of all units being tested on the rack.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question