2

ok for the last week I've tried racking my head around this... I have a SRW208P with 802.1q support, and a virtual endian appliance.

I would like to be able to have 3 vlans having everything routed through the endian appliance..

i.e. The Virtual server has 2 bridged NIC's to the switch. This is where I'm getting confused .. On the 8 port switch I've got the 3 vlans set up ok (all being untagged as they are not going to be vlan aware), it's the port I'm connecting the endian firewall to the switch I'm having trouble with (second nic goes to the adsl modem and NAT'd) Is it meant to be a trunk, "Genereal" or "Access" then untagged or tagged?

the end goal is to have vlan traffic routing through the single NIC and have endian route vlan traffic according to the rules.

Any one have any ideas on the cisco small business stuff?

Thanks

Improve this question
1
  • Does each VLAN have a gateway, or are they completely isolated? If you want all VLANs to be routed out, does your gateway (ADSL modem/router) support VLAN tagging (802.1q)? When you say routed through the Endian appliance, do you mean that it behaves as a router or is it a passthrough/bridging/transparent firewall?
    – nearora
    Jun 1, 2012 at 1:16

3 Answers 3

Reset to default
1

If you have 802.1q set up on your server then the port connecting to the server needs to be tagging the VLAN's and would be a trunk. The connection to your ADSL modem would be an access/untagged port belonging to one of the VLAN's you're sending to the server.

Improve this answer
4
  • exactly what I've been trying with no luck! :( any suggestions?
    – Rhys Evans
    May 31, 2012 at 22:00
  • the trunk has the default vlan 1 untagged?
    – Rhys Evans
    May 31, 2012 at 22:01
  • Can you explain in detail what the actual problem you're having is? What can reach what? What does work? What doesn't work?
    – David Schwartz
    Jun 1, 2012 at 1:33
  • Thanks for everyones replies!! I was using a VM firewall after a bit of reading I found out people had lots of problems with this! Couldn't find a solution :(. dead line fast approached had to just add a NIC for each vlan .. oh well client is happy! as they don't care as long as it works!
    – Rhys Evans
    Jun 6, 2012 at 23:18
1

Setting up the trunk should be something like the following,

conf t
interface fastethernet 0/1 (or whatever your port is)
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan all (or list your vlans, seperated by a comma)

If you can let us know the make/model of the device your using and provide the config it would help further investigate if this doesn't work

Improve this answer
0

So you have a port with three VLANs conneected to a firewall so that the firewall can arbitrate access to / between the VLANs. This is a good thing.

The firewall is smart, and trusted, and you're dealing with multiple VLANs on a single port. Typically this indicates that you should use "trunk" mode, and that all of the VLANs should be tagged on that port. The firewall will then be configured to tag all packets on that interface, do its duty, and everything will be both hunky and dory.

Access mode is appropriate if you are using a single port, have a single VLAN associated with it, and the device connected to that port is dumb and / or untrusted. Usually access mode ports are untagged.

General is a bit more middle-of-the-road. It permits you to have a default VLAN that is untagged (untagged packets are automatically assigned to that VLAN) as well as tagged VLANs associated with it. It really isn't a great choice unless you need it, in which case you don't have a choice.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .