Configuring Sonicwall to route VLAN traffic to internet

Question

I have a Sonicwall NSA 2400 that had its configuration reset and I'm having trouble reconfiguring it.

The Sonicwall's WAN port (X1) connects to the internet. Its LAN port (X0) connects to a 3Com 4500G switch (Layer 3 enabled) which I connected (trunked?) to another 3Com 4500 switch.

The switches designate 3 VLAN's:

VLAN1 - Data VLAN - Not used for much, if anything

VLAN2 - Voice VLAN - The VoIP phones are connected here. Computers are connected to network through their phones.

VLAN4094 - Routing VLAN - Seems to be used to route network traffic out to the internet (?)

3Com 4500G

This is the switch directly connected to the Sonicwall NSA 2400

4500G Configuration

#
 sysname #############
#
 dhcp relay server-group 0 ip 192.168.10.4
 dhcp relay server-group 0 ip 192.168.11.10
#
 domain default enable system
#
 local-server nas-ip 127.0.0.1 key 3com
#
 telnet server enable
#
 undo cluster enable
#
igmp-snooping
#
vlan 1
 description Data VLAN
 igmp-snooping enable
#
vlan 11
 description Voice VLAN
#
vlan 4094
 description Routing VLAN
#               
radius scheme system
 server-type extended
 primary authentication 127.0.0.1 1645
 primary accounting 127.0.0.1 1646
 user-name-format without-domain
#               
domain system   
 access-limit disable
 state active   
 idle-cut disable
 self-service-url disable
#               
local-user admin
 service-type telnet terminal
 level 3        
local-user manager
 password simple manager
 service-type telnet terminal
 level 2        
local-user monitor
 password simple monitor
 service-type telnet terminal
 level 1        
#               
interface NULL0 
#               
interface Vlan-interface1
 ip address 192.168.10.1 255.255.255.0
 dhcp select relay
 dhcp relay server-select 0
#               
interface Vlan-interface11
 ip address 192.168.11.1 255.255.255.0
 dhcp select relay
 dhcp relay server-select 0
#               
interface Vlan-interface4094
 ip address 192.168.255.2 255.255.255.0
 rip poison-reverse
 rip version 2 multicast
#               
interface GigabitEthernet1/0/1
 port access vlan 4094
 broadcast-suppression pps 3000
 undo jumboframe enable
 description Uplink to SonicWALL
 stp edged-port enable
#               
interface GigabitEthernet1/0/2
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/3
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/4
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/5
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/6
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/7
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/8
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/9
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/10
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/11
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/12
 port link-type trunk
 port trunk permit vlan all
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/13
 port access vlan 11
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/14
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/15
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/16
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/17
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/18
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/19
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/20
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/21
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/22
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/23
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/24
 port link-type trunk
 port trunk permit vlan all
 broadcast-suppression pps 3000
 undo jumboframe enable
 stp edged-port enable
#               
interface GigabitEthernet1/0/25
 broadcast-suppression pps 3000
 undo jumboframe enable
 shutdown       
 stp edged-port enable
#               
interface GigabitEthernet1/0/26
 broadcast-suppression pps 3000
 undo jumboframe enable
 shutdown       
 stp edged-port enable
#               
interface GigabitEthernet1/0/27
 broadcast-suppression pps 3000
 undo jumboframe enable
 shutdown       
 stp edged-port enable
#               
interface GigabitEthernet1/0/28
 broadcast-suppression pps 3000
 undo jumboframe enable
 shutdown       
 stp edged-port enable
#               
rip 1           
 undo summary   
 version 2      
 network 192.168.10.0
 network 192.168.11.0
 network 192.168.255.0
 import-route direct
#               
 snmp-agent     
 snmp-agent local-engineid 8000002B0300247310B641
 snmp-agent community read public
 snmp-agent community write private
 snmp-agent sys-info version all
#               
 dhcp enable    
#               
user-interface aux 0
 authentication-mode scheme
user-interface vty 0 4
 authentication-mode scheme
#               
return

4500G Routing Table

Routing Tables: Public
        Destinations : 8        Routes : 8

Destination/Mask    Proto  Pre  Cost         NextHop         Interface

127.0.0.0/8         Direct 0    0            127.0.0.1       InLoop0
127.0.0.1/32        Direct 0    0            127.0.0.1       InLoop0
192.168.10.0/24     Direct 0    0            192.168.10.1    Vlan1
192.168.10.1/32     Direct 0    0            127.0.0.1       InLoop0
192.168.11.0/24     Direct 0    0            192.168.11.1    Vlan11
192.168.11.1/32     Direct 0    0            127.0.0.1       InLoop0
192.168.255.0/24    Direct 0    0            192.168.255.2   Vlan4094
192.168.255.2/32    Direct 0    0            127.0.0.1       InLoop0

3Com 4500

This is the switch where the VoIP system is connected

4500 configuration

#
 sysname ############
#
 local-server nas-ip 127.0.0.1 key 3com
#
 igmp-snooping enable
#
radius scheme system
#
domain system
#
local-user admin
 service-type ssh telnet terminal
 level 3
local-user manager
 password simple manager
 service-type ssh telnet terminal
 level 2
local-user monitor
 password simple monitor
 service-type ssh telnet terminal
 level 1
#                                         
acl number 4999                           
 rule 0 deny dest 0000-0000-0000 ffff-ffff-ffff
#                                         
vlan 1                                    
 igmp-snooping enable                     
#                                         
vlan 11                                   
 description Voice VLAN                   
#                                         
vlan 4094                                 
 description Routing VLAN                 
#                                         
interface Vlan-interface1                 
 description Data vlan                    
#                                         
interface Vlan-interface4094              
 ip address 192.168.255.3 255.255.255.0   
#                                         
interface Aux1/0/0                        
#                                         
interface Ethernet1/0/1                   
 poe enable                               
 stp edged-port enable                    
 broadcast-suppression pps 3000           
 port access vlan 11                      
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/2                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/3                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/4                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/5                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/6                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/7                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/8                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/9                   
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/10                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/11                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/12                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/13                  
 poe enable                               
 stp edged-port enable                    
 broadcast-suppression pps 3000           
 port access vlan 11                      
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/14                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/15                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/16                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/17                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/18                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/19                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/20                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/21                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/22                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/23                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface Ethernet1/0/24                  
 poe enable                               
 stp edged-port enable                    
 port link-type hybrid                    
 port hybrid vlan 11 tagged               
 port hybrid vlan 1 untagged              
 broadcast-suppression pps 3000           
 packet-filter inbound link-group 4999 rule 0
#                                         
interface GigabitEthernet1/0/25           
 port link-type trunk                     
 port trunk permit vlan all               
 shutdown                                 
#                                         
interface GigabitEthernet1/0/26           
 port link-type trunk                     
 port trunk permit vlan all               
 shutdown                                 
#                                         
interface GigabitEthernet1/0/27           
 port link-type trunk                     
 port trunk permit vlan all               
#                                         
interface GigabitEthernet1/0/28           
 port link-type trunk                     
 port trunk permit vlan all               
#                                         
 undo xrn-fabric authentication-mode      
#                                         
interface NULL0                           
#                                         
 voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000 description Siemens AG phone
 voice vlan mac-address 0004-0d00-0000 mask ffff-ff00-0000 description Avaya phone
 voice vlan mac-address 0013-1900-0000 mask ffff-ff00-0000 description Cisco 7960 phone
 voice vlan mac-address 0015-2b00-0000 mask ffff-ff00-0000 description Cisco 7940 phone
 voice vlan mac-address 0060-b900-0000 mask ffff-ff00-0000 description Philips and NEC AG phone
#                                         
 ip route-static 0.0.0.0 0.0.0.0 192.168.255.2 preference 60
#                                         
 snmp-agent                               
 snmp-agent local-engineid 8000002B00247373B0406877
 snmp-agent community read public         
 snmp-agent community write private       
 snmp-agent sys-info version all          
#                                         
user-interface aux 0 7                    
 authentication-mode scheme               
 screen-length 22                         
user-interface vty 0 4                    
 authentication-mode scheme               
#                                         
return

4500 routing table

Routing Table: public net
Destination/Mask   Protocol Pre  Cost        Nexthop         Interface
0.0.0.0/0          STATIC   60   0           192.168.255.2   Vlan-interface4094
127.0.0.0/8        DIRECT   0    0           127.0.0.1       InLoopBack0
127.0.0.1/32       DIRECT   0    0           127.0.0.1       InLoopBack0
192.168.255.0/24   DIRECT   0    0           192.168.255.3   Vlan-interface4094
192.168.255.3/32   DIRECT   0    0           127.0.0.1       InLoopBack0

Current state of Sonicwall

The Sonicwall is connected to the internet successfully.
The Sonicwall's LAN port (X0) is configured with:
```
IP: 192.168.255.1
Mask: 255.255.255.0
```

Two sub-interfaces have been configured on the LAN port (X0)

X0:V1
IP: 192.168.10.1
Mask: 255.255.255.0

XO:V11
IP: 192.168.11.1
Mask: 255.255.255.0

DHCP is enabled on the Sonicwall with each X0 interface having a range within its subnet
A static IP has been assigned to the 4500G switch (not sure if this is needed): 192.168.255.2

Things tried with Sonicwall

XO sub-interface IP addresses set to DHCP relay server IP addresses found in 4500G switch config: 192.168.10.4 and 192.168.11.10, respectively.
Setting ARP entries in Sonicwall to intercept packets sent to VLAN interfaces and route them to Sonicwall gateway

What I'd like to accomplish

I'd like to get VLAN11 connected to the internet (VLAN1 also if possible). I'm hoping the phone system will continue to work once that is accomplished.

I'd like to keep the switch settings as they are, because they should still be configured the way they were when the network was functional.

It may be fairly obvious by now, but I'm quite a novice a VLANs and Firewalls. Does anyone have any advice on how to get my VLANs connected to the internet?

score 1 · Answer 1 · answered Oct 09 '12 at 17:47

I got it working.

First of all, it was a hardware problem

I had a cheap-o Linksys switch plugged into the LAN (X0) port of the Sonicwall. The 3Com 4500G switch and my laptop were connected to cheap-o switch. That way the switch and my laptop could both be connected to the LAN (X0) port on the Sonicwall.

Turns out the 3Com switch was plugged into a bad port on the cheap-o switch, making the software settings impossible to properly test. I switched the 3Com to another port on the cheap-o switch.

Then I just had to set up the routes

On the Sonicwall, I configured two routes, so that any traffic destined for VLAN 1 or VLAN 11 IP addresses is routed through VLAN 4094.

Then, on the 3Com switch, I set up a static route to the Sonicwall IP, effectively telling the switch to send traffic to the Sonicwall if it didn't know where else to send it.

With this combination in place, traffic began to flow correctly up, down, and across the network.

Note: Instead of setting up the static route on the switch, I could have enabled RIP on the Sonicwall and broadcast the Sonicwall IP to the 3Com switch as a default route. It would end up in the same place on the switches routing table, supposedly doing the same thing. I might enable RIP and disable the current static route eventually, but it's working for now so I'm going to leave it alone for a while.