5

I have a Juniper EX4300 switch that is connected to a firewall which in turn connects to the WAN. I have an Aruba 7010 Controller that I would like to connect to the Juniper switch. On the Juniper switch I have 4 VLANS that each correspond to a single subnet in the following format:

  • VLAN Name - VLAN ID - IP RANGE
  • UserLAN - 1 - 172.0.0.1/22
  • Guest - 2 - 172.0.4.1/22
  • UserWiFi - 3 - 172.0.8.1/22
  • DevLAN - 4 - 172.0.12.1/22

I have connected the Aruba Controller to port ge-0/0/10 on the Juniper switch and configured that port as a trunk port with the native VLAN being UserLAN and the member VLANs as the rest of the VLANs. Juniper port ge-0/0/0 is also configured as a trunk port on the UserLAN VLAN and connects to my firewall that has an IP of 172.0.0.2/22. I can ping public addresses such as 8.8.8.8 from all devices and I have inter-VLAN communication working but I just wanted to ask if this is the correct way to configure these devices? I also wanted to know if this configuration can support using the same VLANs across the Juniper and Aruba devices. From the Aruba documentation they say you must create the same VLANs with the same name and IDs on both devices, but I cannot remove VLAN ID 1 on the Aruba device. Any thoughts?

Improve this question
4
  • Please share your configuration(s).
    – Jordan Head
    Jun 24, 2015 at 3:33
  • @JordanHead I will get them tomorrow.
    – user16129
    Jun 24, 2015 at 3:51
  • 1
    "Correct" is a matter of opinion, but as it "works for you", put a check in that box. Depending on the AP configuration, you should be able to setup multiple SSIDs for each of the networks.
    – Ricky
    Jun 24, 2015 at 5:11
  • Agreed. I am working on getting the configuration. Been a little busy.
    – user16129
    Jun 24, 2015 at 21:17

2 Answers 2

Reset to default
1

The way you connected the Controller is technically correct. By using DOT1Q VLAN tags you allow traffic within VLAN 1,2,3,4 to be sent from and to your Controller.

Keep in mind that it might not be necessary to allow all VLANs on the port to the controller (e.g. UserLAN, DevLAN) because you might only need Guest and UserWIFI for WLAN.

Only allowing certain VLANs on a Trunk is called VLAN pruning which can enhance network security and stability.

Improve this answer
1

VLAN "Names" are locally significant to devices and different devices will allow different length strings to name them, so no need for them to match (although it helps when troubleshooting if they are at least similar).

As long as your VLAN 1 is native on the Aruba port and matches the correct subnet on your firewall, this topology should work just fine.

As a general rule though, I tend to avoid using VLAN 1 on any device in the network, due to various vendor-specific quirks that it often comes with.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.