vLAN configuration question

Hello Experts

I have a client that is asking for something I do not know if it's possible - I know the easy way, but this seems to be stuck in the mud like a nasty mule.

Default vLAN - all data equipment (gateway, servers, printers)
vLAN 2 - VoIP
vLAN 3 - WiFi

PaloAlto firewall - EdgeSwitch48 (ES-48-750W) all linked with 10gb GBIC's (unknown if trunked or just uplinks)

The client refuses to use the L3 of the switches to setup the vLAN's and ONLY wants the firewall to do the routing of IP traffic between the vLAN's - the issue seems to be a lack of routing as I can not ping from a device hard coded on either vLAN to the other vLAN.

All ports are included & untagged in vLAN 1, and included & tagged in vLAN 2 - I could care less about vLAN 3's function, but it is not working either.

The DHCP server with additional scope for VoIP is setup with OPT 43 settings

So, the question is; Can this be done well without using the IP Routing functions of the L3 switches?
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Aaron TomoskyDirector of Solutions ConsultingCommented:
I've done this with sonicwall in a pinch, not Palo Alto but I'd think it would work.

Did you setup the Palo Alto with ip addresses in each vlan and are devices on those vlans using that address as a gateway?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Running.all traffic through the Palo Alto is completely reasonable. The connection between the switch and firewall needs to be set for 802.1q trunking on both the switch and firewall, unless you want to run a separate connection from the switch to the firewall for each VLAN.
durango099Author Commented:
Speaking the dreadful word "assume" - I believe the client did, as the gateway for vLAN 2 is different than that of vLAN 1

Since the client is unwilling to allow me access to get into the Palo Alto or EdgeSwitch I can only assume.
Craig BeckCommented:
All ports are included & untagged in vLAN 1, and included & tagged in vLAN 2

So do the VoIP devices actually use 802.1Q?  Do you configure a VLAN ID on the phone or via DHCP using an option?

Test routing by making it as simple as possible.  Configure one port untagged on VLAN1 and one port untagged on VLAN2.  Connect a PC to each port and see if you can talk between them.  If you can you just have a tagging issue.
Aaron TomoskyDirector of Solutions ConsultingCommented:
Each vlan should have its own gateway in the subnet of the vlan. Personally I try to always use a /24 with .1 as the gateway. That ip is the interface of the vlan on the device doing the layer 3. So whether is the switch or the firewall doesn't really change much in how it's setup, just which device you add these interfaces too
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.