Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 17 replies
  • Subscribers 27 subscribers
  • Views 7074 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VLAN Tagging with a Cisco SG200 series switch

Starclassic

This is a peculiar one, as I have had this Cisco SG200-26 switch working with a Juniper SRX110HA-V2.

Topology is pretty straightforward: Three VLANS (IDs 3, 4 and 5) are required. The XG86 has these three VLANs configured on LAN port 1 (Port 1.3, 1.4 and 1.5). LAN port 1 is connected to port 24 of SG200, with port 24 configured as a Trunk with Tagged modes for VLAN IDs 3, 4 and 5 accordingly.

The only device that seems to function is the only one that can support tagging (its port is configured as Trunk - Tagged for VLAN ID 5). All other devices are not capable of supporting VLAN tagging, so their ports are set up as Trunk with Untagged mode for VLAN ID 3 or 4 (as required). In the very least, all the untagged devices do receive their address assignments from their respective DHCP servers (configured in the XG, not external) but that's where it ends.

If I plug a computer directly into Port 3 of the XG, which I have configured with a static IP belonging to the VLAN 3 group, I can ping all three VLAN gateways/interfaces but not any of the VLAN 3 devices themselves. However, I am able to ping the VLAN 5 device I mentioned.

I'm using the same Firewall rules as the VLAN 5 zone, so I know it can't be the rules since the same parameters work for the VLAN 5 tagged device.

As I mentioned at the start, this switch configuration definitely works with the Juniper but it seems that the XG only seems to work for the one device capable of VLAN tagging.

So the question is, which one is breaking protocol concerning 802.1q? Is it the XG or the SG200? I'm inclined to blame the XG86 for this, given that is the only thing that has changed here.  I've sought out all the experts' videos on YouTube showing how easy it is to set up VLANs (and I agree they are easy) but there's something horribly wrong here.

I am running the latest version SFOS (17.5.6).

All help appreciated!



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    do you have an IP address assigned to the physical port on the XG that you are using for there VLAN interface?

    Ian

  • 0 in reply to rfcat_vk

    Absolutely. The XG wouldn't let me set up my VLANs without it.

    My port setup in the XG is:

    Port 1: 192.168.101.1
    Port 1.3: 192.168.1.1
    Port 1.4: 192.168.2.1
    Port 1.5: 192.168.5.1

    Interface port on SG200: Trunk with four VLANs configured on it - ID 1 (untagged), IDs 3, 4 and 5 (tagged)

    What other details would help with this? I understand from a post of yours a few months ago that you have this working with four VLANs on your Netgear switch. Is your Netgear set up similar to mine, in that PCs and other non-tagging type devices are set up on Access ports? To save you from seeking out more information on the SG200 switch, it is just a layer 2 managed switch, which helped keep things nice and simple when I put all this together with the old SRX appliance.

  • 0 in reply to rfcat_vk

    Here is my VoIP outgoing firewall rule.

  • 0 in reply to rfcat_vk

    Thank you for your screenshots. Looks like our firewalls are very similar, with the major difference in my case being that I haven't applied any DSCP value at the moment. Otherwise, agreed, I have not set up any gateways in the Firewall rules for anything that doesn't go to WAN.

    You mentioned that routes also need to be set up. This is probably what is missing and where my ignorance is at.

    So are you saying that I need to set up static routes? I did give that a shot but the problem was that with the static routes, it asks me to set up a gateway IP and that can't be the same as the interface IP.

    So, for example, if I attempt to set up a static route for 192.168.2.0/24, it is pointed to interface Port 1.4 (being VLAN 4 for the .2 subnet) but then on its insistence for the gateway IP, I can't set that to be the interface itself (being 192.168.2.1). Is this where I should be setting up those routes you're referring to? Or are you talking about Policy Based Routes?

  • 0 in reply to Starclassic

    Hi Tony,

    no, you do not need routes, I was wondering if you had set them up if you expected to be able to send traffic out of your other VLANs eg you are connected to VLAN2 but you want to use VLAN3's gateway. If VLAN3's gateway was a different external interface then yes I could see that , but you would use a firewall rule to allow specific traffic out VLAN3's gateway when you are connected to VLAN2.

    I access my other VLANs, but only the internal devices, I do not try to use their gateway.

    Ian

  • 0 in reply to rfcat_vk

    Thank goodness for that, as that was the initial impression I was under from the tutorial videos I have looked up.

    OK, so with no routes and only firewall policies which are similarly set up to yours, your Netgear switch seems to be happy with your XG whereas my Cisco SG200 is not. How have you configured your Netgear? Are your ports for non-VLAN aware devices simply configured as Access ports, pointing to the respective PVID?

  • 0 in reply to Starclassic

    Hi Tony,

    you assume correctly.

    The below are two od the VLAN screens shots from the main Netgear managed switch.

    22 is basically infrastructure (most of it)

    100 is general LAN devices

    111 is VoIP network

    1023 is IoT network.

     

    Ian

  • 0 in reply to rfcat_vk

    I'm at a complete loss then. It seems I'm doing everything exactly the same as you, albeit on a different make and model switch, which works just fine with my old Juniper.

    I might have to see if I can borrow another managed switch from someone to determine what is going on.

  • 0 in reply to Starclassic

    Hi Tony,

    I see part of your problem when i reread you regional post in detail is with the way you are testing. Port 3 on the XG will need a seperate address range not part of VLAN 3 range. You will need a firewall rule to allow the traffic from port 3 to VLAN3.

    Ian

  • 0 in reply to rfcat_vk

    Thing is, I'm only using Port 3 as a means of accessing the XG management, not so much to use it to communicate through to the other networks. The fact that it is able to ping through to the other VLANs is strange behaviour though, since I haven't set up any rules for that to happen.

    Oddly enough, where I know that I can get the XG's built-in ping test to perform tests from specified interfaces, it doesn't seem to work at all. I attempted to perform a ping test from Port 1.5 in the interface list, since I know my VLAN-aware device on VLAN5 can access it, and the ping test to the WAN failed (even to 8.8.8.8). Yet, my VLAN-aware device actually does get through.

    Something doesn't seem right with that XG tool. Same goes with the Policy Test tool, of which none of my tests register a hit with any of my firewall rules.

    This is becoming a disappointing exercise so far, in that it's either showing my lack of intelligence or this product is just not as intuitive as it was purported to be.

  • 0 in reply to Starclassic

    Hi Tony,

    the XG is far from intuitive, we are all hoping v18 will improve that.

    Ping, I am unable to ping 8.8.8.8 from any of my internal interface, VLAN or physical.

    Is your switch a level 2 or level 3 VLAN?

    Ian

  • +1 in reply to Starclassic

    What a mission! In the end, I decided to factory reset and start fresh, taking it all one step at a time, as opposed to preparing it all offline before plugging it in to test.

    Set it up exactly the same way as I had it in the beginning of this saga and kept an eye on the network with each step, from setting up the VLANs through to establishing the firewall rules. We're all good now. I'm once again impressed with the XG, now that I'm beginning to learn the quirks.

    Case closed. Thanks for your help, rf.

Reply
  • +1 in reply to Starclassic

    What a mission! In the end, I decided to factory reset and start fresh, taking it all one step at a time, as opposed to preparing it all offline before plugging it in to test.

    Set it up exactly the same way as I had it in the beginning of this saga and kept an eye on the network with each step, from setting up the VLANs through to establishing the firewall rules. We're all good now. I'm once again impressed with the XG, now that I'm beginning to learn the quirks.

    Case closed. Thanks for your help, rf.

Children
No Data