Multiple VLAN Configuration Between NETGEAR Firewalls and Switches

Objective:  To show how you arrange Internet access for multiple VLANs

VLAN-Definition
VLANs are logical subgroups within a Local Area Network (LAN), which combine user stations, and network devices into a single unit, regardless of the physical LAN segment to which they are attached. VLANs allow network traffic to flow more efficiently within subgroups. VLANs use software to reduce the amount of time it takes for network changes, additions, and moves to be implemented.

Notes when setting-up VLANs

1. A VLAN does not have a minimum number of ports
2. VLANs work at the OSI Layer 2
3. A VLAN can be created per unit, device or via logical connection/combination
4. Broadcast and Multicast traffic is transmitted only in the VLAN in which traffic is generated.
5. To allow traffic between VLANs a device working at protocol level (Layer 3) is required

Equipment used:

1. A router that supports Vlans. SRX5308 is used here.   FVS318N, and FVS336 also support.
2. A Layer 2 switch  that supports Vlans. GS724T is used in the example.
3. 2x PC's
4. Modem with internet connection.
5. Various Ethernet patch cables.

Objective: To show how different Vlans on a switch can access internet, but not access devices on the other Vlan. In this article, a Vlan aware router is used. InterVlan routing is not enabled.

 

 

Set up of the SRX5308 Router

1. On both devices, example Vlans 12 and 22 are created.
2. The following screenshots show the Router configuration:
3. This is the initial screenshot, with the default Vlan 1.

 

4. For example, you create Vlan 12 as shown. Select 'Add', and fill in as follows:

 

5. I have picked the 192.168.12.xx subnet for convenience. DHCP pool values are for demonstration use. Hit 'Apply' at the base of your screen. Note that I have ticked Port 1.
6. I similarly created Vlan 22.

7. Note that 'Inter Vlan routing' is unchecked.

 

Switch Settings:

1. I connected switch to Router, and plugged PC into  any of the spare ports. I chose port 20.
2. Running 'Smart Control centre'  allowed Discovery of the Switch Management IP,  192.168.1.110 in this instance.

 

3. Enter the web interface on the 192.168.1.110 address.

 

4. Switching >> Vlan >> Basic Configuration. Enter Vlan 12 and name, and hit 'Add'. Similarly I created  Vlan 22 as shown.
5. Next stage is port assignment.
6. I am connecting Port 1 of Router, to Port 1 of switch. This is labeled as 'T'  for  the trunk port, as it is carrying traffic for more than one Vlan.

 

7. In this example, I am assigning ports 3,4,5,6 as 'U' or untagged members of Vlan 12.
8. Below shows that ports 10,11,12,13 are  untagged members of Vlan 22.

 

9. Note that all of these untagged ports are taken out of default Vlan 1.

 

10. The next stage is to set the PVID's.  This means that egress packets leaving that port are tagged to that Vlan number.
11. Again ports,3,4,5,6 are set to a PVID of 12,  and ports 10,11,12,13 have a PVID of 22.
12. PVID does not apply to Trunk ports.

 

13. Switching >> Vlan > Advanced > Port PVID Configuration
14. Enter the new PVID value in the box at the top, and check the ports to be aligned as shown.
15. Similarly repeat for Vlan 22, as shown.
    
16. Testing and Verification:

In the photo below, the yellow cable is linking port 1 of router to Port 1 of Switch.

Dark blue cable on left --   in port 4,goes to PC in Vlan 12.

Green cable   --   in port 10, goes to PC in Vlan 22.

Light blue cable-- to modem, on to DSL line.

Dark blue cable on right --    On Port 21 for Switch management on Vlan 1

 

 

17. PC's in both Vlans can access internet.
18. I am displaying the Ping readings from both PC's.
19. Here is the PC in Vlan 12. It can ping the management address of Vlan 22 which is based on the router.
20. Note that it cannot ping the PC in Vlan 22, ( 192.168.22.20).

 

21. Here is the Ping data for the other PC.

 

 

22. 'Color f1' is a command which changes to Navy text on a white  background.
23. Note the same situation in reverse. The PC at 22.20 can ping the other Vlans management address (22.1 ) here, which was routed through by the SRX5308 router.
24. The PC in the other Vlan ( 12.20 ), plugged into the same switch, in this example cannot be reached.