3

To everyone who takes the time to read below, thank you very much.

I want to start this off with the very general question and then give my exact situation. I really don't understand the terminology 'tag egress packets' vs 'untag egress packets' when it comes to setting up VLANs. As far as I was always concerned, tag meant that the switch was manually enforcing a VLAN tag on every packet that came into that port (placing the tag on itself) and untag meant that it wasn't. This goes back to one of my first bosses, who told me you could only have one tagged VLAN per port. I'm pretty sure this is wrong now, but I wouldn't mind figuring out exactly what that refers to. I'm currently operating under the assumption that tag means it accepts tagged packets for that VLAN and untagged means that it accepts untagged packets and places it into that VLAN (Probably the Primary VLAN ID). Of course, that could be complete bunk.

My Situation/Problem

The network infrastructure is currently running all NetGear Prosafe switches (not my choice, but until we do the upgrade later this month, I get to work with them) as well as one NetGear router. We are using Aerohive Access points to create a Campus wireless network.

I'm basically going through, ripping out the existing SSIDs on the Aerohives and looking to replace them with a better option. The aerohives aren't the problem, I can configure them with my eyes closed.

What I do have is three VLANs I want to create, to separate three different classes of users onto three different subnets. The Aerohives will assign 2220, 1135, and 2135 based on the user and SSID used. For right now, I'm focusing on 2220 as a test case. I have configured a new DHCP scope on the DHCP server (192.168.5.0/24) and have configured every port along the path with the tag egress packets option for the new VLAN. I have also added in a special routing port (even though I have high doubts it's needed at all).

The Problem

I don't receive DHCP on the network and when I do a VLAN probe for 2220 it shows up as not having a subnet. I really just don't know enough about VLAN routing and especially these NetGears to get why the DHCP requests do not get to the DHCP server.

Clarification

For right now there are only two switches between the DHCP server and the access point. The DHCP server, being on a different subnet, likely isn't contacted directly, but I'd likely expect the following to happen.

AP > Switch 1 > Router > Switch 2 > DHCP server

Yes, the router port I setup for the new VLAN is connected to the same switch as the AP is. Ideally, for this test case, I think I would only need to configure about 3-5 ports.

Edit

After reading the below answers I tried the following and wanted to add a bit more clarification.

Switch 1 - Port 03 VLAN 3030 untagged, VLAN 2220 tagged, Primary VLAN 3030 3030 is the management interface VLAN and is needed for the AP to communicate so I can't really change the primary.

Switch 1 - Port 09 VLAN 2220 untagged, Primary VLAN 2220 This heads off to the router. I get the feeling I should be able to just tag all three VLANs on this one port eventually and have the router deal with them in trunk mode.

Router - Port 05 VLAN 2220 untagged, Primary VLAN 2220. VLAN routing interface 192.168.5.1, 255.255.255.0. DHCP helper relay is setup for the DHCP server. For reference, the DHCP server is on the 192.168.1.0/24 subnet. Note: This model of netgear does not let me configure an IP for the physical port, just for routing ports you create.

Switch 2 - Port 05 This is the Hyper V host port and where I start getting confused. We have another subnet setup exactly the same way (not created by me). The port itself has only VLAN 1 untagged and primary. So, I don't think I need anything configured on the port. I just don't know if I'm missing something or not.

DHCP still does not seem to work.

Improve this question

2 Answers 2

Reset to default
2

Basics

When you tag a VLAN on a port, it will send out the traffic on that port with the VLAN tag, when the port receives traffic it looks for the tag and places the traffic into that VLAN. You can have multiple tagged VLANs on one port (sometimes called trunk).

When you send out a VLAN untagged on a port it will not add the VLAN tag to the packet and when receiving packets without a VLAN tag it will be placed into that VLAN (on Netgear and others you have to set PVID (Primary VLAN ID))

To your problem

I think you are not far away... - Router port connected to Switch1 should have IP within VLAN 2220. - DHCP Server should have different IP from different Subnet! - Router port Connected to Switch2 should have IP in Subnet of DHCP Server - You should define a DHCP Helper on Router port connected to Switch1 so DHCP Request get forwarded to DHCP Server. Hot to do that is described here: http://kb.netgear.com/app/answers/detail/a_id/21990/~/how-do-i-configure-a-dhcp-l3-relay-using-the-web-interface-on-my-managed-switch%3F

Hope this helps you a little bit further. If not, please post a more detailed network diagram with VLAN IDs and IPs.

Improve this answer
3
  • This was a great bit of information and a lot of it definitely helped. I added in specific port configs. Being a netgear, I'm led to believe CLI is not an option so I couldn't just paste in a CLI show config. Unfortunately, a few of the things on the link you provided don't apply to my model, but I tried to look at it. Am I correct in believing that once the packet hits the router interface, VLAN 2220 is no longer considered and it just routes to the DHCP server on whatever VLAN that route is configured with?
    – Naryna
    Aug 4, 2015 at 18:52
  • Yes the DHCP request packet is normally routed to the DHCP Server which you specify in the DHCP helper.
    – Crami
    Aug 4, 2015 at 19:30
  • I want to thank you for all the help and great guides you provided. It turns out my DHCP problem was because there was a second router in the picture I did not have fore knowledge of. It turns out one of the hardware firewalls was actually acting as the primary gateway (and router) for the subnet the DHCP server was on. So, without a route configured for it, all return traffic was getting routed out to the internet. Once I configured the new route, everything worked exactly as I expected it to. I guess that's what happens when you inherit legacy networks.
    – Naryna
    Aug 5, 2015 at 15:40
2

Yes you can have packet tagged for different VLANs on the same port (more often on uplink ports that connect together two switches). This is generally referred as "trunk" mode (altough there's no such terminology on netgear switches and "trunk" has a totally different meaning on HP procurve).

To apprehend vlan tagging you have to distinguish what happens when the switch receive a packet and what will the switch decide when it will send the packet on the destination port.

A basic setup is to have a PC connected for example in VLAN 10 on a port of switch A, Port 7 and a router connected on switch B port 1 that will perform the routing for all VLAN. Switch A & B are connected together with an uplink on both ports 48.

To achieve this you have the following configuration

  • Switch A port 7 configured with PVID 10 ; VLAN 10 untaged for this port

interface 1/0/10

vlan pvid 10

vlan participation include 10

  • Switch A port 48, switch B port 48 & 1, VLAN 10 tagged

interface 1/0/48

vlan pvid 10

vlan participation include 10

vlan tagging 10

And of course the router must have a interface vlan 10 configured.

Now what happens when the PC send a packet to the router :

  1. The PC send a untagged packet. The switch receive the packet on its port 7. Since the packet is not tagged and the port is configured with PVID 10, the switch now that this packet belong to vlan 10
  2. Looking up its mac table and the destination mac in the packet the switch decide to send the packet trough port 48. It's a packet belonging to vlan 10 and the port is configured with "tagging" for this vlan. So the switch A send the packet with vlan 10 tag in the header
  3. The switch B receive the the packet tagged for vlan 10. Since it has vlan10 configured on this port (vlan participation include vlan 10) it accepts the packet and it knows it belong to vlan 10.
  4. the switch B send the packet to the router on port 1, once again tagged.
  5. the router received the packet tagged for vlan 10, since it has an interface on this vlan, it routes the packet.

Now for the response. It goes from router , sent tagged, on switch B port 1 , and travel, always tagged until it is send to the PC trough switch A port 7.

When the switch is about to send the packet trough port 7, in the configuration it has "vlan participation include 10" so it is ok , but it doesn't have "vlan tagging 10" so the packet is sent untagged. The PC receive the packet without vlan tag and process it.

So :

PVID apply only to packet received on the port

VLAN tagging apply to :

  1. packet received tagged on the port
  2. packet sent trough the port to decide if it must be sent tagged or not.

If a switch receive a packet tagged for a particular vlan but this vlan is not configured on the port the switch will discard the packet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.