5

I have a Juniper EX4300 switch that is connected to a firewall which in turn connects to the WAN. I have an Aruba 7010 Controller that I would like to connect to the Juniper switch. On the Juniper switch I have 4 VLANS that each correspond to a single subnet in the following format:

  • VLAN Name - VLAN ID - IP RANGE
  • UserLAN - 1 - 172.0.0.1/22
  • Guest - 2 - 172.0.4.1/22
  • UserWiFi - 3 - 172.0.8.1/22
  • DevLAN - 4 - 172.0.12.1/22

I have connected the Aruba Controller to port ge-0/0/10 on the Juniper switch and configured that port as a trunk port with the native VLAN being UserLAN and the member VLANs as the rest of the VLANs. Juniper port ge-0/0/0 is also configured as a trunk port on the UserLAN VLAN and connects to my firewall that has an IP of 172.0.0.2/22. I can ping public addresses such as 8.8.8.8 from all devices and I have inter-VLAN communication working but I just wanted to ask if this is the correct way to configure these devices? I also wanted to know if this configuration can support using the same VLANs across the Juniper and Aruba devices. From the Aruba documentation they say you must create the same VLANs with the same name and IDs on both devices, but I cannot remove VLAN ID 1 on the Aruba device. Any thoughts?

  • Please share your configuration(s). – Jordan Head Jun 24 '15 at 3:33
  • @JordanHead I will get them tomorrow. – Matthew Sanabria Jun 24 '15 at 3:51
  • 1
    "Correct" is a matter of opinion, but as it "works for you", put a check in that box. Depending on the AP configuration, you should be able to setup multiple SSIDs for each of the networks. – Ricky Beam Jun 24 '15 at 5:11
  • Agreed. I am working on getting the configuration. Been a little busy. – Matthew Sanabria Jun 24 '15 at 21:17
1

The way you connected the Controller is technically correct. By using DOT1Q VLAN tags you allow traffic within VLAN 1,2,3,4 to be sent from and to your Controller.

Keep in mind that it might not be necessary to allow all VLANs on the port to the controller (e.g. UserLAN, DevLAN) because you might only need Guest and UserWIFI for WLAN.

Only allowing certain VLANs on a Trunk is called VLAN pruning which can enhance network security and stability.

1

VLAN "Names" are locally significant to devices and different devices will allow different length strings to name them, so no need for them to match (although it helps when troubleshooting if they are at least similar).

As long as your VLAN 1 is native on the Aruba port and matches the correct subnet on your firewall, this topology should work just fine.

As a general rule though, I tend to avoid using VLAN 1 on any device in the network, due to various vendor-specific quirks that it often comes with.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.