2

I'm trying to solve a problem here...

I have a gateway, a switch, and three APs with matching vlans configured with tagged SSIDs:

VLAN 1 - Default (We don't use this--no SSID)
VLAN 2 - Admin
VLAN 4 - Operations

The gateway connects to the switch on port 46 and three APs are on ports 1-3.

The switch's ports are tagged as follows:

(T=Tagged/U=Untagged)
PORT 1  - 2T 4T (PVID 2)
PORT 2  - 2T 4T (PVID 2)
PORT 3  - 2T 4T (PVID 2)
PORT 46 - 2T 4T (PVID 2)

The gateway is configured to tag all traffic on all ports except for VLAN 1.

In this configuration the users on the APs are unable to communicate with the gateway on port 46. As such, no IP addresses are being distributed.

If I change the configuration to make VLAN 2 untagged then the AP users can connect to the gateway, but they are treated as being on VLAN 2 no matter what. That would look like this:

(T=Tagged/U=Untagged)
PORT 1  - 2U 4T (PVID 2)
PORT 2  - 2U 4T (PVID 2)
PORT 3  - 2U 4T (PVID 2)
PORT 46 - 2T 4T (PVID 2)

Am I missing something here or is this a case of misbehaving equipment?

UPDATE: Here are the models of equipment:

Gateway: Linksys LRT224
Switch: Dell PC 2748
APs: Engenius EAP350

To answer the question that you must be asking... Most of this was donated to the non-profit that I'm working for so we didn't get any say in what we're using here. Just trying to make the best of it! ;-)

Improve this question
3
  • 2
    It's hard to tell without knowing what kind of equipment you have, or seeing complete configurations. But If I had to guess, your ports are not configured in trunk mode.
    – Ron Trunk
    Apr 21, 2016 at 2:34
  • 1
    Do you have an gateway ip set up for each subnet (VLAN) ?
    – reybanger
    Apr 21, 2016 at 4:59
  • The gateway is configured such that each VLAN is assigned to it's own /12
    – brodkin
    Apr 21, 2016 at 5:15

2 Answers 2

Reset to default
2

It turns out that in these models EnGenius does not utilize the vlan setting for the SSID unless client isolation is also enabled. This seems to be true in all 300 series models. In newer models client isolation and vlan isolation are separate settings.

Enabling isolation with tagged vlans on the trunk and WAP ports successfully routes the traffic.

Improve this answer
3
  • Actually, I don't think these WAPs route traffic. They are translating bridges, so they bridge traffic at layer-2, translating between Wi-Fi and ethernet. You may want to edit your answer to change, "successfully routes the traffic."
    – Ron Maupin ♦
    Apr 24, 2016 at 21:01
  • I never said that the WAPs were doing any routing, but I can add commas if you think it's confusing. I'm also open to suggestions for alternate phrasing.
    – brodkin
    Apr 28, 2016 at 1:15
  • I think the word, "routes," is incorrect in this context. That happens on the router, and it has nothing to do with the switch or WAP. I think you mean the frames (layer-2) get successfully placed in the correct VLAN. As far as I can see, you didn't make any router (layer-3, packet) changes.
    – Ron Maupin ♦
    Apr 28, 2016 at 1:22
0

I think you misunderstand VLAN tagging. Frames should be tagged on a trunk link, for example, router-to-switch or switch-to-switch, but you don't normally tag frames on access ports since most end-devices don't understand VLAN tags. You set the VLAN for the access ports, but you don't tag frames on the access ports.

VLANs are tagged on trunk links in order to distinguish the traffic for each VLAN on links where multiple VLANs are traversing, but an access link only has a single VLAN, so VLAN tags are unnecessary.

Improve this answer
5
  • In this particular case the APs are 802.1q compliant so wouldn't they need tagged frames in order to know the SSID on which they should broadcast the packets?
    – brodkin
    Apr 21, 2016 at 19:41
  • They don't necessarily need tagged VLANs. It depends on whether or not you have 802.1Q trunking enabled, and such a WAP usually requires its management address to be on the native (non-tagged) VLAN, so if your SSID is on the same VLAN/subnet as the WAP management, this could be a problem. Using multiple VLANs is useful for multiple SSIDs.
    – Ron Maupin ♦
    Apr 21, 2016 at 19:45
  • At the moment the AP's management interface is untagged, but the PVID of that port is 2 so it would be the same as one of the SSIDs. The other SSIDs have different VLANs assigned to them.
    – brodkin
    Apr 22, 2016 at 1:59
  • @BrodkinCA, based on what I glean from the manual, enabling VLAN tags for the WAP management will pass VLAN tags through the device. You can enable VLANs for the SSIDs, but the management interface needs to be on the native VLAN to not pass VLAN tags to the end-devices, most of which don't understand VLAN tags. "Management VLAN ID -Enter the VLAN ID if your network includes VLANs and if tagged packets need to pass through the Access Point. Otherwise, click No VLAN tag." If you are using the same VLAN for both management and the SSID, I think you need to disable tagging on the switch port.
    – Ron Maupin ♦
    Apr 22, 2016 at 2:12
  • I think I may figured it out... I've left the management untagged, but your comment caused me to look a little deeper into the vlan settings on the APs. There is an isolation checkbox that I had understood to be the typical wireless client isolation that prevents devices from communicating with each other on the same SSID. Further reading revealed that the vlan tags don't work unless the feature is enabled. I'll update this question once I'm able to test onsite this weekend! Thanks for pointing me in the right direction.
    – brodkin
    Apr 22, 2016 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.