Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

ok for the last week I've tried racking my head around this... I have a SRW208P with 802.1q support, and a virtual endian appliance.

I would like to be able to have 3 vlans having everything routed through the endian appliance..

i.e. The Virtual server has 2 bridged NIC's to the switch. This is where I'm getting confused .. On the 8 port switch I've got the 3 vlans set up ok (all being untagged as they are not going to be vlan aware), it's the port I'm connecting the endian firewall to the switch I'm having trouble with (second nic goes to the adsl modem and NAT'd) Is it meant to be a trunk, "Genereal" or "Access" then untagged or tagged?

the end goal is to have vlan traffic routing through the single NIC and have endian route vlan traffic according to the rules.

Any one have any ideas on the cisco small business stuff?

Thanks

share|improve this question
    
Does each VLAN have a gateway, or are they completely isolated? If you want all VLANs to be routed out, does your gateway (ADSL modem/router) support VLAN tagging (802.1q)? When you say routed through the Endian appliance, do you mean that it behaves as a router or is it a passthrough/bridging/transparent firewall? –  nearora Jun 1 '12 at 1:16
add comment

3 Answers

If you have 802.1q set up on your server then the port connecting to the server needs to be tagging the VLAN's and would be a trunk. The connection to your ADSL modem would be an access/untagged port belonging to one of the VLAN's you're sending to the server.

share|improve this answer
    
exactly what I've been trying with no luck! :( any suggestions? –  Aceth May 31 '12 at 22:00
    
the trunk has the default vlan 1 untagged? –  Aceth May 31 '12 at 22:01
    
Can you explain in detail what the actual problem you're having is? What can reach what? What does work? What doesn't work? –  David Schwartz Jun 1 '12 at 1:33
    
Thanks for everyones replies!! I was using a VM firewall after a bit of reading I found out people had lots of problems with this! Couldn't find a solution :(. dead line fast approached had to just add a NIC for each vlan .. oh well client is happy! as they don't care as long as it works! –  Aceth Jun 6 '12 at 23:18
add comment

Setting up the trunk should be something like the following,

conf t
interface fastethernet 0/1 (or whatever your port is)
switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan all (or list your vlans, seperated by a comma)

If you can let us know the make/model of the device your using and provide the config it would help further investigate if this doesn't work

share|improve this answer
add comment

So you have a port with three VLANs conneected to a firewall so that the firewall can arbitrate access to / between the VLANs. This is a good thing.

The firewall is smart, and trusted, and you're dealing with multiple VLANs on a single port. Typically this indicates that you should use "trunk" mode, and that all of the VLANs should be tagged on that port. The firewall will then be configured to tag all packets on that interface, do its duty, and everything will be both hunky and dory.

Access mode is appropriate if you are using a single port, have a single VLAN associated with it, and the device connected to that port is dumb and / or untrusted. Usually access mode ports are untagged.

General is a bit more middle-of-the-road. It permits you to have a default VLAN that is untagged (untagged packets are automatically assigned to that VLAN) as well as tagged VLANs associated with it. It really isn't a great choice unless you need it, in which case you don't have a choice.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.