-1

My topology is pretty simple although dumb, I'm thinking in fixing it later.

The goal:

Pretty straightforward,

Short Version:

I want to create a VLAN for my guest wifi so people connecting to this WiFi don't have access to my server.

Long Version:

I originally had setup two WiFi networks, one for the guests and one for my internal network. Now what I want is to separate them so I don't want people connecting to my guest wifi be able to access computers or my servers connected on my internal network. The solution as I have been doing the research is to create a VLAN for just the guest network so that way it will be isolated.

My setup:

I have 2 gateways connected to my switch (ports 1 and 2)

enter image description here

Palo Alto Gateway is the gateway that has the DHCP server for my internal network and Unifi Security Gateway is the one containing the DHCP server for my guest network (I know, I should have 1 gateway only but I just want to be able to create this fix fast by just adding another gateway and VLAN for just the guests for now).

Now, the problem is the tagging those ports in the switch. As you can see here in the configuration of the VLANs inside of the switch:

enter image description here

This configuration works, but I don't know why. In my opinion it should be Tagged for port 2 in VLAN 99 and Excluded in the default VLAN but, if I do that I can connect to the guest WiFi but I can't get an Ip address so the DHCP server on the Unifi gateway fails. Can anybody help me with this one? Thank you!

1

1 Answer 1

1

Think of the data entering and exiting from the perspective of each port. Data entering the port, that is untagged, will be associated with the “untagged” vLAN. Data entering the port that is tagged, will be associated with any “tagged” vLANs of the same ID. Data that exits the port will be tagged or untagged for a particular vLAN depending on its setting.

Tagged means the packet is wrapped in a vLAN identifier. Untagged means the data is just a standard packet. Devices don’t understand vLAN tags unless specifically configured to do so, so they will ignore tagged packets.

Your two gateways don’t “talk” vLANs. So, you’ve placed both on different logical networks by associating each port (1 & 2) to a different vLAN in “untagged” mode. If you tagged data going to your unifi gateway it would ignore the data because the gateway isn’t configured to “speak” vLAN 99.

You’ve configured your WAP ports to use both networks. vLAN 1 will be untagged. vLAN 99 will be tagged so you must have configured the WAPs to associate vLAN 99 with a different SSID. Although, if they expect to communicate with the unifi security controller over the default LAN it’s possible this configuration should be reversed. I.e. vLAN 99 should be untagged, and vLAN 1 should be tagged. As it is now, when they boot up they will pull an IP from your vLAN 1.

The untagged vLAN associated with each port is also known as the default vLAN. In other words, any device plugged in to that port will, by default, use the default vLAN because all packets it sends and receives are untagged and it will ignore any tagged packets.

Trunk ports send and receive only tagged data. It is designed to pass all traffic to another device that understands all the vLANs, like another switch. Although, it would not be uncommon to put WAPs on a trunk port, if multiple SSIDs are used on multiple networks.

Excluded ports simply block all traffic tagged with a particular vLAN ID.

I’m not sure if this is what you are looking for, but it seems you are looking for an explanation of why, rather than a recommendation of how.

The behavior you described is expected.

One last note, vLAN 1 port 2 should be Excluded. Just like vLAN 99 port 1 is Excluded. This makes sure each gateway will only see the traffic intended for that gateway.

4
  • Ok thank you for the explanation, and what it should be for port 2 on VLAN 99, Untagged or Tagged?
    – VaTo
    Dec 30, 2017 at 2:51
  • @VaTo untagged, just like it is Dec 30, 2017 at 2:52
  • Ok thank you, let me apply those settings and I will accept your answer, thank you for the help!
    – VaTo
    Dec 30, 2017 at 2:54
  • If is working with the current configuration, would I even need to bother changing it?
    – VaTo
    Dec 31, 2017 at 3:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .