We got a Linksys LGS552p switch (, and a TZ400 Firewall ( behind an "AT&T Modem", but we have external an IP address for the TZ400.

I need to setup VLANs: 90 for workstations, 20 for servers and 50 for voice. I've setup the VLANs in the SonicWALL under X0 which is the LAN interface.

x0 ---> VLAN 90 --->, in linksys.

enter image description here

I've configured the Linksys VLAN 90 and connected port 12 to a PC with a static IP address of, but I can't ping anywhere. If the PC has 192.168.50.xx, it can ping all subnets and the Internet.

enter image description here

enter image description here

enter image description here

Am I missing any hardware to route between the VLANs? Where should I start with first to troubleshoot?

  • The only member in VLAN90 is port GE12 tagged? Than it can't go anywhere. You need to configure all VLANs on both switch and firewall, configure a trunk between them (one VLAN untagged, all others tagged) and configure the endpoint ports as untagged in their respective VLAN. – Zac67 Aug 10 '17 at 20:11
  • Yes, I only added one port for testing and added only Vlan90 to that port to test. I configured all VLANS on the switch and the Firewall. can you please explain: "one VLAN untagged, all others tagged) and configure the endpoint ports as untagged in their respective VLAN" – Jason Yousef Aug 10 '17 at 20:21
  • In order to let the VLANs communicate across the trunk the need to be active on the interface. The frames need to be distinguished, so they need to be tagged. One of the VLANs may remain untagged on both sides or you can tag all of them. – Zac67 Aug 10 '17 at 20:49
  • Thanks Zac, i'm only trying to connect port 12 to test, so port 12 should be tagged of Vlan90 and untagged of Vlan1? – Jason Yousef Aug 11 '17 at 21:15
  • No. An access interface should be untagged. You only tag on trunk interfaces, and that would be the interface to the router. – Ron Maupin Aug 11 '17 at 22:37

VLANs are layer-2 constructs that logically divide a switch into multiple, virtual switches. Normally, you put a different layer-3 network on each layer-2 VLAN. Traffic from a VLAN must pass through a router in order to reach a different VLAN. You must consider the layer-2 and layer-3 aspects when setting up different VLANs.

For layer-2:

As Zac67 points out, you need a trunk from the router to the switch. Trunks with multiple VLANs must tag the frames in order for the devices on each end to distinguish which frames are for which VLANs. You can have a single VLAN with no tags, called the native VLAN. The devices will assume that any untagged frames belong to that VLAN. On some devices, the native VLAN must be VLAN 1, and that is normally the default untagged VLAN. On the switch access interfaces, you do not tag the frames, regardless of the VLAN. Most hosts do not understand frame tags, and because the tags add four bytes to the frame header, the tagged frames are dropped as damaged.

For layer-3:

The gateway for a network must be in the same network as the source network. A gateway is the host, usually a router, on a network to which traffic destined for other networks is sent. If the gateway is on a different network, you would need a gateway to reach the gateway. Each VLAN will have its own gateway address configured on the router in the same network as the network for the corresponding VLAN.

| improve this answer | |
  • Thanks Ron, The switch is L2, I see an option to change it to L3, i'm sorry excuse my ignorance, I'm a database developer which handling the new network migration ! – Jason Yousef Aug 11 '17 at 21:13
  • If the switch is layer-2, then you want to trunk to the router, otherwise, you can route your LAN networks on the switch as layer-3 and have a routed link to the router. – Ron Maupin Aug 11 '17 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.