VLAN Tagging Traffic on Cisco Switch

Question

I have a situation where I'm setting up multiple VLANS on a pfSense firewall on the same physical interface for a client.

So in pfSense, I now have VLAN 100 (employees) and VLAN 200 (students - student computer lab).

Downstream from pfSense, I have a Cisco SG200 switch, and coming off of the SG200 is the student lab (running on a Catalyst 2950. Yes, that's old, but it works, and this is a poor nonprofit we're talking about).

What I'd like to do is tag everything on the network as VLAN 100, except for the student computer lab.

Earlier today when I was on-site with the client, I went into to the old Catalyst 2950, and assigned all of its ports to access VLAN 200 (switchport mode access vlan 200) without setting up a trunk on the Catalyst or on the SG200.

Looking back on it, I now understand why internet in the lab broke. I reverted the lab back to the default VLAN1 (we're still running on a different firewall - we haven't deployed pfSense -, and the traffic is still separated physically).

So my question is, what do I need to do in order to properly deploy this scenario?

I believe the correct answer is:

• Ensure VLANs 100 and 200 are setup in pfSense, and that DHCP is operating correctly (on separate subnets)
• Setup a trunkport VLAN that allows both 100 & 200 traffic, and plug that port directly into pfSense.
• Setup a VLAN 200 trunkport on the SG200 (It's not running iOS, but if it were, the command would be switchport trunk native vlan 200), which will then plug into the Catalyst 2950.
• Setup a VLAN 200 trunkport on the Catalyst 2950 (that is plugged into the SG200 VLAN200 port with the same command - switchport trunk native vlan 200)
• Setup the rest of the ports on the old Catalyst 2950 in the lab to be access ports on VLAN200.

Is there anything that I'm missing, or do I need to tweak any of these steps, in order to properly segment the network traffic?

Answer 1

Assuming that all the equipment attached to the student lab switch (the 2950) is supposed to be on the student network, and you never have a need to put staff computers on it, it's actually much simpler than that.

Leave the 2950 alone - no configuration of VLANs. Everything runs untagged. The advantage here is when they upgrade it they can just plug in a new switch, no need to configure any VLANs on it.

On the SG200, set the port that connects the 2950 as an access port on VLAN 200. Set the rest of the ports to be access ports on VLAN 100 for the staff computers.

Set the port of the SG200 that connects to the pfsense box as a trunk with both VLANs.

Answer 2

I'm not completely understanding your question but here's my take on an answer:

1. Configure all ports connected to endpoints as access ports in the appropriate VLAN. The switch will handle forwarding/switching the traffic appropriately based on the VLAN membership of each port.

2. Configure the uplink port on the SG200 to the PFSense box as a trunk port. By default it will carry traffic for all VLAN's. If you need to restrict it to VLAN 100 and VLAN 200 then go ahead an do that (switchport trunk allowed VLAN 100, 200).

3. Configure the uplink port on the 2950 to the SG200 as a trunk port. By default it will carry traffic for all VLAN's. If you need to restrict it to VLAN 200 then go ahead an do that (switchport trunk allowed VLAN 200).

You don't need to change the native VLAN for the trunk ports in order for them to carry traffic for those VLAN's. You simply need to configure them as trunk ports (switchport mode trunk).