3

On a SonicWALL TZ105, I have a LAN with the IP address of 172.16.20.1 & netmask of 255.255.255.0. I defined a VLAN with the IP address of 172.16.21.1 & a netmask of 255.255.255.0. Both are on physical port X0.

I already have many PCs on the LAN pointing to gateway 172.16.20.1, but when I tried to add a PC to the VLAN pointing to gateway 172.16.21.1, it doesn't work. I can't even ping 172.16.21.1 from the VLAN PC and it can't access anything.

All the PCs are on the same managed switch (D-Link DES-3028) which supports VLANs. I even defined ports that connect to the SonicWALL and the VLAN PC as VLAN trunks, but the VLAN simply doesn't work.

How does one debug VLAN problems? I am simply hitting a brick wall here.

Improve this question

2 Answers 2

Reset to default
4

Well, you normally don't make the port that the PC "on the VLAN" connects to a trunk, and that's probably the bulk of your problem. So the PC isn't actually ON the VLAN, regardless of what you set its IP address to.

The PC conection port should be set to be a member of the VLAN, the VLAN should be that port's PVID, and the VLAN should go untagged out the port, and tag anything coming in untagged from that port. Normally you also want to remove that port from the "default" VLAN, or the VLAN your LAN runs on if you use a non-default VLAN for that purpose.

An untagged, PVID'd port on the VLAN in question is the usual way that VLAN problems are debugged. In your case, that should also solve the problem, assuming the SonicWall and its port are set up right. In more extensive setups, you make sure that the "plain untagged port on the VLAN" works as expected and then you can run down problems with things that used tagged/trunked ports, knowing that if the VLAN gets to the switch you tested the untagged port on, it was working there.

So, your LAN is on VLAN1, untagged, the SonicWall port from the switch should have VLAN1 as the PVID untagged, but also have/be on VLAN12, tagged. The PC-on-the-VLAN12 port should be removed from VLAN1, have VLAN12 as it's PVID and be untagged and on VLAN12. The PC does not need to know anything about what VLAN it is on.

Improve this answer
7
  • Thanks, I got rid of the VLAN trunking since I am dealing with a single switch. My LAN is VLAN1 and vlan is VLAN12. Right now VLAN1 ports are not tagging, VLAN12 port is tagging. Image: i68.tinypic.com/flatye.jpg
    – Sharath
    Nov 19, 2015 at 7:16
  • But my problem is not yet solved. The IP address defined for the VLAN12 on Sonicwall is 172.16.21.1, and I am using this as my default gateway on the PC. I can't even ping this address from the PC.
    – Sharath
    Nov 19, 2015 at 7:18
  • This is my first attempt at vlan-ing. How do I tell the Win8.1 PC that it is part of VLAN12, is there some settings in the Ethernet properties?
    – Sharath
    Nov 19, 2015 at 9:49
  • 3
    @Sharath - read and comprehend what I've already said twice in the answer - the PC port SHOULD NOT BE TAGGED. It should be PVID and Untagged on VLAN 12. The sonicwall port should be PVID and Untagged on VLAN1 (it probably is) and a member and Tagged on VLAN 12 - The PC does not need to know anything about what VLAN it is on. You are making this harder than it is by barking up the wrong tree - only something like the sonicwall that's trying to be on two VLANs at the same times needs any knowledge of tagging.
    – Ecnerwal
    Nov 19, 2015 at 12:13
  • 1
    Yeaah! Finally worked. I didn't know I needed to mark sonicwall port. Thanks to you I found the right tree to bark at... :-) I am not really a network engineer, but I end up wearing that hat some times.
    – Sharath
    Nov 19, 2015 at 15:44
1

The PC is a host device on a single vlan, that means no need for tagging...Also remember when you have a workstation such as the one in this scenario, located in user vlan (lets say desktop vlan10) connected to one interface with no other vlans on the interface except for your desktop vlan you don't need tagging. It would be a simple access port, not trunked or tagged...PC network cards are not generally capable of deciphering VLAN tags or the other info you would see in a tagged vlan packet. You would use a trunk with tagging if you had multiple vlans running onto a network segment connected to that interface...However you do not, so no need.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.