0

I have a Cisco access point that tags VLAN traffic depending on RADIUS rules. Are the VLANs actually enforced over the dumb switch? For example, if I plugged my laptop into the dumb switch, would I be able to sniff every VLAN's traffic?

I have noticed that I am not able to ping a computer on a separate subnet, but I'm not sure if it is because I'm on the physical network (no tag) and it is on the VLAN or if I am just unable to ping due to the subnet separation.

Thanks in advance!

2 Answers 2

2

I actually seem to have answered my own question. The dumb switch passes VLAN traffic without stripping the tag. This allows the "smart" APs plugged into the switch to operate correctly, and prevent any crossover between the physical interface and restricted VLANs on the public SSIDs.

I apologize for the lack of information in the first post - it was done on a whim as a study break late at night.

Thanks for the responses!

1

Without a VLAN capable (managed) switch, you aren't going to be able to achieve your goal. You need to be able build a VLAN between your Internet pipe and your WLAN. To do this, you are going to have to have a firewall with VLANing capability
-or- another physical port on the firewall and assign the VLAN to the switch port the firewall is plugged into...
As far as whether your "dumb" switch will respect the VLAN tagging, it won't. The most it can do is not remove the tagging. Can you give us the exact model of it so we can look it up for you?
Even if it does not remove the tagging, it's not going to actually VLAN the traffic for you...

PS. If you register on Serverfault with the same ID you used on SO, it should let you edit your posts. Right now, you are showing up as UnKnown.

You must log in to answer this question.