8

I inherited a bit of mess and am preparing to redo our IP addressing scheme and also split our network into multiple VLANs.

Possibly something like:

  • 10.1.10.0/24 VLAN 10 VOIP
  • 10.1.20.0/24 VLAN 20 Users
  • 10.1.30.0/24 VLAN 30 Management

The address scheme isn't really the question and the above is just an example.

What I have not been able to get my head around is this:

How do I access all VLANs from my Macbook?

I had to hit the ground running with this so I haven't had time yet for a proper course of study (will start on my CCNA soon). The problem with learning by total immersion is that there are often holes in my knowledge.

I gather that there are 3 options:

  1. Add multiple aliases to my laptop NIC and do VLAN trunking on the port the NIC is connected to. That is still pretty fuzzy to me.

  2. Connect to a layer 3 switch and route between the VLANs. Our switches are all layer 2/3 (static layer 3 routes) but I can add a full layer 3 switch if need be.

  3. Connect my laptop NIC to a router and route based on subnet. Something like a Cisco 2811 or 2821 with an multi-port ethernet card.

With all that said, what is the proper way to do this?

Improve this question
5
  • 1
    I can't imagine anything other than option 2 being a good idea.
    – Ryan Foley
    Commented Sep 10, 2014 at 18:39
  • 1
    @RyanFoley he may deliberately choose not to route between the VLANs for one reason or the other. He still might have a need for connecting his workstation for management purposes to any of them.
    – syneticon-dj
    Commented Sep 10, 2014 at 18:57
  • @netnewb I'd be interested to see a diagram of your network (sanitized, of course). There are a few ways this could go without knowing anything about your network. I suspect it's much simpler than you think.
    – Ryan Foley
    Commented Sep 10, 2014 at 19:19
  • @RyanFoley I added some extra detail to the end of the question.
    – netnewb
    Commented Sep 10, 2014 at 20:05
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 3, 2021 at 18:59

4 Answers 4

Reset to default
8

Add multiple aliases to my laptop NIC and do VLAN trunking on the port the NIC is connected to

Your keywords here are "tagged VLAN". You might set up a switch port as a tagged member of all three VLANs and set up virtual interfaces using the VLAN tag identifiers in your Mac OS X instance, basically leaving you with three virtual interfaces in three virtual networks.

If you ever wanted intercommunication between the three networks, this is not what you should do.

Connect to a layer 3 switch and route between the VLANs.

To nit-pick, you would not be able to access "the VLANs" in this case. Your IP packets would be routed to the destinations in these VLANs (and given that routing is set up correctly on the receivers, their response packets would be routed back), but you would not get any of the non-IP or broadcast traffic from these networks as long as you are not directly a member.

This is the preferable option if you plan on interconnecting the networks anyway

Connect my laptop NIC to a router and route based on subnet.

This is not really different from your previous option aside from the fact that you are not using virtual interfaces configured for a VLAN membership (this is what an L3 switch actually is about) but physical interfaces tying up physical Ethernet ports. If you can avoid this, please do.

what is the proper way to do this?

There is no proper way. You do what you need to do.

  • If you are separating the networks in order to keep them separate and to completely prevent inter-network communications, you should not interconnect them by a router in the next step.
  • If you are just doing this to break up your broadcast domains in smaller pieces or in order to be able to control the kind of traffic they are exchanging (segmentation), choose a router (or L3 switch) capable of setting IP filters (mostly called ACLs in Cisco's implementation) according to your needs.
  • If your laptop needs broadcast or non-IP traffic from these networks, you would need to connect it to a port configured as a member (either tagged or untagged) as the router would not forward this kind of traffic to another network.

Choose your poison.

Improve this answer
2

Obligatory Answer for a Windows Workstation

(I've never seen such a setup on a Mac, but it might help to know what works on windows.)

I assume you require access to each of the VLANs to perform network administration tasks on those VLANs.

NIC and Driver with VLAN Support

I have had success using Intel mobile adapters that support VLANs on Windows desktop OSes. In that case, the Intel driver adds a special VLANs tab to the properties dialog box.

enter image description here

In that dialog box you can create different virtual network adapters for each VLAN, which you can enable and disable to switch between the VLANs.

VMs are your Friend

I found switching between VLANs on a single OS to be rather cumbersome for everything but the most basic administration tasks. Inevitably you'll end up in a troubleshooting task where you need simultaneous positive connections to multiple VLANs. The challenge in doing that on a single operating system is that you'll end up with multiple possible paths for your packets -- one for each VLAN. In general, controlling to which network adapter (and therefore VLAN) an application on a single OS sends its packets is difficult or impossible to control. On the other hand, if you have multiple VMs, you can enable exactly one network adapter corresponding to the VLAN to which you want to connect. Then you have certainty over which VLAN everything on that entire VM is using.

I've done some pretty elaborate network troubleshooting from a single pane of glass that way. Actually, that link is also a great example of the uncertainty of which network adapter an application (in that case Chrome) ended up sending its packets. Without VMs, you will severely limit your ability to troubleshoot.

Improve this answer
1
  • 1
    While multihoming in general and VLAN interfaces in particular have been inherently troublesome on Windows hosts in the past (at least before Windows 8 / Server 2012), many other OSes do offer quite sophisticated ways to deal with routing, even multipath and asymmetric, due to their history and origins.
    – syneticon-dj
    Commented Sep 10, 2014 at 19:29
0

I wish I could simply add a comment instead of propose this as an answer, but I don't have that ability yet.

I will suggest to you that if you there are no firewall or ACL issues preventing you from accessing one VLAN from another, and that there are routes in your layer 3 switches to provide for that to happen, then all you have to do is trunk those VLAN down to your ethernet drop that your MacBook uses. If you are connecting over 802.11 then simply make sure that the same restrictions I mentioned earlier aren't in place. I do not see any reason you would need to subscribe to multiple IP addresses on your macbook to allow this to happen.

In fact the situation I describe above is exactly what I is being done from the PC I am typing this on.

Wish this were a comment only, but I do hope it helps.

Regards

Improve this answer
0

Options 2 seems to be pratical and optimized

Configure switch virtual Interface (SVI) in layer3 switch with VLAN 10, VLAN 20 ,VLAN 30, and configure intervlan routing "ip routing " to ensure communication between vlans VLAN 10 ,VLAN 20 ,VLAN 30 further connect layer 2 switch layer3 switch with interface trunk allowing all vlan to pass from link connectiing layer3 switch and layer2 switch ,

Connect macbook nic to layer2 switch configuring access -port allowing ANY vlans as per requirement. Allocate static ip address to nic adapter ip address ,subnetmask and gateway. And then you should be able to access all three VLANs from macbook as per your requirement..

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.