1

I am having trouble making the HP V1910 Switch split into two distinct switches. My goal is to have most of the switch be on the internal network, and a few ports at the end be in a DMZ zone.

I am new to VLANs so any help would be appreciated.

Here is my setup so far:

VLAN 0001

Untagged Membership:

GE1/0/1-GE1/0/40, GE1/0/49-GE1/0/52

VLAN 0002 DMZ

Untagged Membership:

GE1/0/41-GE1/0/48

My assumption is that there should be an uplink/internet cable per block of ports. Under this assumption I have one of the ports on the left with a cable directly to my SonicWall Firewall, on the DMZ block I have a cable going into a DMZ port on the SonicWall Firewall. I would think that this would keep the two separated, but it may be the case that I need a cable directly from the Comcast Modem/Router into the second block. Or, lastly, it could be that I should only be using one uplink cable at all. I honestly don't know. When reading other posts, no one seems to mention this part specifically but for someone such as myself I need these little details.

Continuing with the Switch, I also created a second VLAN Interface. It uses DHCP and has generated an IP address, and only does so when I plug in that DMZ cable from the SonicWall. If that cable isn't plugged in it doesn't appear to generate one, which makes me think this is a step in the right direction. Unfortunately I cannot access the internet through any of the DMZ ports on the switch.

I want to clarify that I'm only trying to split a single switch, not connect multiple switches together, in case that wasn't clear.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 18:16
1

The way you have assigned the VLANs to the switch ports makes the 1910 behave like two separate switches. You need to connect one of the DMZ ports to your firewall.

Alternatively, you could configure a single, VLAN trunk port with both VLANs active (both tagged or one untagged, one tagged) and connect it to a firewall port. Then, that firewall port needs to be configured in the exact same way.

When the IP interface you've bound to the second VLAN is set to DHCP it requires a DHCP server (the Sonicwall) to assign an IP address to it.

In any way, the DMZ port needs to be configured on the firewall. You'll need an internal IP address/subnet plus firewall rules to allow a connected device Internet access. Additionally, you'd probably want rules to allow internal devices to access the DMZ (or allow DMZ devices access to the internal network, but that isn't the point of a DMZ).

Since the 1910 is capable of routing and you probably wouldn't want an unfiltered connection between the internal network and the DMZ, make sure that routing on the 1910 is deactivated.

EDIT after comment: The manual isn't exactly clear on that but I think to remove routing capability from a VLAN you need to remove the VLAN interface (in parallel to removing the IP address on the larger HPE switches):

For hosts of different VLANs to communicate, you must use a router or Layer 3 switch to perform layer 3 forwarding. To achieve this, VLAN interfaces are used.
VLAN interfaces are virtual interfaces used for Layer 3 communication between different VLANs. They do not exist as physical entities on devices. For each VLAN, you can create one VLAN interface. You can assign the VLAN interface an IP address and specify it as the gateway of the VLAN to forward the traffic destined for an IP subnet different from that of the VLAN.

In reverse: when a VLAN interface doesn't exist the switch can't route. The VLAN will still work as a separate L2 segment and of course, you can route elsewhere (set the default gateway to the Sonicwall).

| improve this answer | |
  • If I understood that, you're saying my VLANs are currently set up correctly. I do have a cable going from a DMZ port in my Firewall to one of the ports in the DMZ VLAN. Next, you're saying I need to disable DHCP for the second VLAN Interface. Looking at my options, I can change it from DHCP to BOOTP or Manual. Not sure how that part would work. I'll also point out that the DHCP service is currently disabled, in case that helps. – user3779582 Jan 22 '18 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.