Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 421
  • Last Modified:

Need help with a VLAN

Hello,

I have a main network closet with a Netgear 12 port fiber switch.  From that switch, I have a fiber connection to 6 cottages.  In each cottage, port 1-4 each has an Aruba AP-105 connected to it.  Port 5 is the trunk port back to the main network closet, ports 6-24 is VLAN 12 which is the guest network, and 25-48 is VLAN 11 which is the private network.  VLAN 1 is the default management VLAN.  VLAN 11 is 192.168.1.0 and VLAN 12 is 192.168.2.0.

Here is the issue: When I originally set this up, All of the Aruba's could find each other and it auto creates a mesh network.  I went onsite today, and the AP's are pulling a 192.168.2.0 IP as they should, but I can only access/ping the AP's if I'm on VLAN 11 with an IP of 192.168.1.0.  And each AP is acting on it's own.  I can login to each of them individually, but they are not finding each other, probably because of my misconfiguration in the VLAN somewhere.

Ports 1-4 are tagged for VLAN 11 and 12 and VLAN 1 is Untagged, which is default and it won't let me change that.
0
Sean Rhudy
Asked:
Sean Rhudy
  • 11
  • 8
1 Solution
 
giltjrCommented:
What do the routing tables on the Netgear look like?

Can the AP's ping each other on VLAN 11?
0
 
Sean RhudyPresidentAuthor Commented:
The Aruba's don't have a ping tool, so I'm not sure... Here is the route table

Default      0.0.0.0                       0.0.0.0                                                          192.168.11.1       1
Static      192.168.1.0      255.255.255.0      Local      VLAN 11      0.0.0.0      1
Static      192.168.2.0      255.255.255.0      Local      VLAN 12      0.0.0.0      1
Static      192.168.11.0      255.255.255.0      Local      VLAN 1      0.0.0.0      1
0
 
giltjrCommented:
Does the Netgear have IP addersses in each of the VLAN's?

Can you look at the routing tables in the Aruba?  Do they look correct?
0
Microsoft Certification Exam 74-409

VeeamĀ® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
Sean RhudyPresidentAuthor Commented:
It does not, it only has an IP in VLAN 11.

I don't believe I can view the routing table in the Aruba, but I will research that.
0
 
Sean RhudyPresidentAuthor Commented:
I'm trying to figure out if the settings in the AP or the VLAN settings in the switches are the issue.  In the AP, I have the option to change the "Uplink Management VLAN" which is set to default: 0 and in the "wired port profile" I can change the mode to trunk or access and can set the native VLAN.
0
 
Sean RhudyPresidentAuthor Commented:
I have an SSID for VLAN 11 and an SSID for VLAN 12, and both are pulling the correct IP range through DHCP.  The PVID setting on the ports that the AP's are connected to are set to 12, so the AP's themselves are pulling the correct IP's.
0
 
giltjrCommented:
So the switch only has an IP address in VLAN11.

Is there another device that has an IP address in VLAN1 and VLAN11 or in VLAN12 and VLAN11?

What I'm trying to figure out is how is traffic in VLAN1 or VLAN12 would get routed to VLAN11.  Since the switch does not have an IP address in VLAN1 or VLAN12 it can route traffic to/from VLAN11.  Do you understand what I'm saying?
0
 
Sean RhudyPresidentAuthor Commented:
We don't want traffic to be routed between VLAN's.
0
 
Sean RhudyPresidentAuthor Commented:
Can't we Tag VLAN 11 and 12 on port 1-4 on the switches but have a PVID of VLAN 12, then shouldn't they all be able to see each other?
0
 
Sean RhudyPresidentAuthor Commented:
For example, If I connect to the SSID for VLAN11, I can ping and access devices across all cottages.
0
 
giltjrCommented:
--> We don't want traffic to be routed between VLAN's.

Then "... but I can only access/ping the AP's if I'm on VLAN 11 with an IP of 192.168.1.0. " make sense.  You should only be able to ping them if you are on the same VLAN if you are not routing.

If you are not routing between VLAN/IP subnets then you can only ping a device when you are on the same VLAN/IP Subnet.
0
 
giltjrCommented:
--> Can't we Tag VLAN 11 and 12 on port 1-4 on the switches but have a PVID of VLAN 12, then shouldn't they all be able to see each other?

No.  To talk to an IP address that is NOT on the same IP subnet as you, you must route the traffic.  Without routing, they can't talk to each other.
0
 
Sean RhudyPresidentAuthor Commented:
"the AP's are pulling a 192.168.2.0 IP as they should, but I can only access/ping the AP's if I'm on VLAN 11 with an IP of 192.168.1.0.  And each AP is acting on it's own"

See above comment.  192.168.2.0 is VLAN 12...which is what the AP's are on.  I CAN access them from VLAN 11, NOT VLAN 12.  

"--> Can't we Tag VLAN 11 and 12 on port 1-4 on the switches but have a PVID of VLAN 12, then shouldn't they all be able to see each other?"

When I say that they should all be able to see each other...I mean all of the AP's that are on VLAN 12.
0
 
giltjrCommented:
Make sure I have this right:

VLAN1 = 192.168.11.0/24 Management -- I will call this ".11"
VLAN11 = 192.168.1.0/24 Private -- I will call this ".1"
VLAN12 = 192.168.2.0/24 Guest -- I will call this ".2"

You said that the AP's are pulling IP address 192.168.2.0/24,.  I am assuming you mean the guests that connect to the AP's wirelessly get addresses within this range.  Not  the actuall AP's.

Since you VLAN11 and VLAN12 being tagged to the AP's and the guests get ".2" I  assumed that the AP's themselves are getting addresses on ".1".  Because you should NEVER assign an AP an address within the same subnet that guests connect on.   It also makes sense that the AP's would be on ".1" since you can only ping them when they are on ".1".

Do the AP's have a cli where you can pull a text config file?  If so can you clean up any private information and post here.
0
 
Sean RhudyPresidentAuthor Commented:
No, the AP's themselves are pulling a .2 address, and the port they are plugged into has a PVID of VLAN12, but I can only access them when my laptop is on VLAN11.
0
 
giltjrCommented:
Things are not making sense to me.  What model Netgear switch do you have?

You stated that Netgear switch ports that the AP are connected to have VLAN 11 and 12  tagged and VLAN 1 untagged.

Then you stated that the ports they are connected to has PVID of VLAN 12.  Typically PVID's are untagged as they are the default VLAN for all untagged frames.   You can't have two untagged VLAN's on a port and you definitely can't have two default VLAN's on a port.
0
 
Sean RhudyPresidentAuthor Commented:
The issue was that I had the port untagged in the switch side, but tagged in the AP's config.  Once I changed the AP config, everything came up.
0
 
giltjrCommented:
Glad you figured it out.

However

1) A little clearer description of your setup may have help resolve this sooner.

 2) Obviously somebody changed something or this would have never been working.
0
 
Sean RhudyPresidentAuthor Commented:
Solution
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

  • 11
  • 8
Tackle projects and never again get stuck behind a technical roadblock.
Join Now