2

My understanding of VLANs may need improved, but isn't the idea that you can run multiple LANs at layer 2 level over the same router if VLANs are setup correctly on the SG300? If so, I fail to see how that can be enabled for my incredibly trivial use case:

I have two separate LANs with separate DHCP servers (and separate IP ranges).

To simplify my hardware setup, I've purchased an SG300 router, thinking I can assign each port on that router to be part of one or several VLANs (just one in my case). But I seem to be getting the options wrong?

Can some patient soul please explain how I can configure two ports (let's assume GE1 and GE2 for the purpose of this exercise) to emulate what used to be LAN 1 and make that be in one VLAN so that none of the traffic in that VLAN is seen on any of the other ports, and DHCP clients connected behind port GE2 are seeing their DHCP requests answered by the server which is on GE1?

Using the web config screens, I've added a new VLAN with ID 10, then went into the port to VLAN screen and set GE1 and GE2 to tagged for VLAN 10, and to forbidden for the default VLAN 1.

While that resulted in me no longer being able to see the SG300 management interface when on VLAN 10, it doesn't seem to work for the DHCP clients on GE2: They never get their queries answered by the server on GE1, nor can they ping/see anything that's on GE1 (after setting the IP manually). "No route to host" results when trying that.

Plugging the same two cables that go into the SG300 into an unmanaged switch (as before), it works no problem.

Is perhaps the IP range of relevance? The SG300's management interface IP is on 192.168.0.1. VLAN 10 is 192.168.10.xx VLAN 20 is 192.168.0.xx (same as VLAN 1 - is that gonna bite when I set up VLAN 20?)

Improve this question

1 Answer 1

Reset to default
2

You only tag VLANs on trunk interfaces. The tags are for the switches (or a switch-to-router link) on each end of the trunk link to be able to separate the frames back to the correct VLANs.

On Access interfaces (what you want for your end-devices, like your hosts or servers), you want to assign the interfaces to the the VLAN, but you do not want to tag the frames because most end-devices do not understand frame tags.

In order for traffic to pass between the VLANs, you must route (with a router or routing in a layer-3 switch) the traffic. You can also place restrictions between the VLANs in your router by using access lists.

Improve this answer
6
  • Thank you, that makes a lot of sense. So I need to configure GE1 and GE2 as Access interfaces?
    – Balthasar
    Commented May 30, 2018 at 23:45
  • I've now configured GE1 and GE2 as General interfaces with Admit All, set the Administrative PVID to 10 (the VLAN ID), and in the "Port to VLAN" screen set the two ports for VLAN ID 10 to untagged (all others are "Excluded" for VLAN ID 10), and ticked the PVID checkbox. That seems to work now.
    – Balthasar
    Commented May 31, 2018 at 0:03
  • If this answered your question, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin ♦
    Commented May 31, 2018 at 1:19
  • Sure - however, clarifying my followup questions would be appreciated and would have led to a much quicker acceptance.
    – Balthasar
    Commented May 31, 2018 at 1:24
  • Do you mean the last paragraph? That is unclear because you didn't give us the full network address and mask for each VLAN. You will have a problem if the VLAN networks overlap, and you are trying to route them. Routers route packets between networks, so each network interface must be in a separate, non-overlapping network.
    – Ron Maupin ♦
    Commented May 31, 2018 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.