I have a very simple LAN to about 30 users. On this LAN I would like to setup a Demo Enviroment with is seperated and trying to do so through VLAN.

We have a Zyxel USG 50 Firewall. This has the following ports: p1 WAN1 (not in use p2 WAN2 (ISP) p3 LAN (192.168.1.x no DHCP) P4 LAN2 (192.168.2.x with DHCP)

If I connect our 'demo' servers NIC to P4 of Zyxel I get an IP on server 2012R2 and can access Internet. e.g. all is well.

I need the server on a VLAN because I have 2 other servers which need to be on this segment and approx 5 printers.

So for that reason: in our server rack I have a 24P HP (SS = serverswitch) in our switch rack I have a 24P HP (RS = Rack Switch)

My idear would be the following: demoserver --> port 10 on SS --> Port 4 on RS --> P4 Zyxel (internet access)

My problem is how to handle the different VLAN settings: I can take server NIC (ESXi) and set on VLAN10 but then what to do on the serverswitch, rackswitch ... when do I trunk on which switch, should I use PVID or not?

Hope this makes sense and you can help me out ...

  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 16:24

2 Answers 2


Pay attention that if you are going to use different VLANs on ESXi (i.e. some of your VMs should belong to one VLAN and some to another), port 10 on SS should be a trunking to allow tags to go through.

If ESXi should only use one VLAN instead, port 10 on SS should be an access port. Consequently, also port 4 on RS should be an access port, if you are connecting port 10 on SS to port 4 on RS.

To achieve inter-VLAN routing, if needed, the switch interface going to the router should be a trunking interface.


Start from your Zyxel and work your way down to the virtual. Pick a VLAN and new subnet to add to the firewall: you don't need to burn more physical ports if you are implementing a VLAN to facilitate the switch connection anyway. Then on the RS add that vlan to the trunk going to the Zyxel and the trunk going to the SS. You shouldn't be altering native vlan tagging (the PVID) for this change (and probably shouldn't be using it at all but that is for a different StackExchange discussion). Then move to the SS: add the new vlan to the trunk from the RS to the SS and the trunk on the SS going to the ESXi host with the demo server on it. Finally, set up a new virtual switch in ESXi with that vlan tag and add the demo server to it. Test by pinging the firewall from the demo VM. This should conclude your change.

Remember that your firewall might not be already configured to block intra-lan traffic (from the existing LAN segment to this new one you set up) so you are not fully protected (if full protection from production traffic is the goal) until you set up a rule dropping any traffic between the new vlan subnet and the existing one(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.