0

I have a situation with my VLAN's and cannot see the light:

In order to simplify i will talk about 2 VLAN's instead of 10+. In a L2 switch i have VLAN 100 and VLAN 200. Using 802.1Q VLAN:

  • VLAN 1 (all ports System-VLAN - Management VLAN).
  • VLAN 100 (port 4,6 - connected to computers & port 15 connected to router).
  • VLAN 200 (port 10,12 - connected to computers & port 15 connected to router).

The ports are configured as:

  • ports 4,6 (general untagged - PVID 100)
  • ports 10,12 (general untagged - PVID 200)
  • port 15 (general untagged - PVID 1).

The result is correct: i have internet in all ports and cannot communicate between VLANs. Ping from port 1 to port 4,6 or 10,12. No communication between port4,6 - 10-12. And yes i have ping betweeen 4,5 and 10-12. So right now everything is ok.

My PROBLEM IS: - I connect a pc (10.20.30.187) in port10 (VLAN 200) and launch wireshark looking for ICMP. - A laptop (10.20.30.190) is connected in port 4 (VLAN 100) and i launch a ping to 8.8.8.8. --> In the PC in VLAN 200 i can see all packets being sent from 8.8.8.8 to the the laptop (10.20.30.187). I cannot see the packets being sent from PC, since the source in IN another VLAN, but the internet responses can be seen.

Since all VLAN are passing through VLAN 15 and the router does not understand VLAN', can i separate this traffic FROM internet to VLAN's, and avoid this situation? I've been thinking on ACL but nothing comes to my mind. It's been a couple days...I even tried a "stupid" thing like creating an extended ACL denying traffic from PC IP to LAPTOP IP, but of course, the SOURCE IP is 8.8.8.8.

So is there any ideas from you guys?

I've been checking this forum (some examples: VLANS and Public/Private Traffic VLAN sending data to ports it shouldnt have to Tagged Packets on native VLAN General Port 802.1q VLAN echo replies do not include VLAN ID) and of course many other but nobody seems to have this situation, or already know how to solve it, so no need to ask. Hope you can give me a solution.

Many thanks. Best regards Portuguevos.

First of all thanks for yours answer.

So the only way to separate the traffic from internet to any VLAN is to use a Router with VLAN. But is there any other possibility? Maybe ACL? I want to learn this since is something i like, but i have been searching and cannot find something similar. And not use a router with VLAN, since is something i do not have at my home ;-)

Just in case let me re explain the situation: I must say that the description of my VLANs are not the actual scenario. Until now i've been using VLANs to separate traffic between departments. Recently a colleague used a L2 switch to distribute several Internet connections with public IPs to severall offices. So in a 24 port L2 switch he is using port 24 connected to a router (do not have specific information on this device) where he receives around 20 public IP from an ISP. So he creates VLAN 20 with port 2 +24. Vlan 20 port 3+24 and so on. Whenever an office of his building needs internet connection, he deploys a ethernet cable from port 2 or 3 or 4 , etc to a router installed in the office. So each office has is own internet and supposly nobody can see each other. So he believes everything is separated. This idea was strange and new to me so i build a little scenario at my home. I have a SG3216 TP-Link switch, one ADSL (port 15 - 192.168.100.0/24) and one 4G router (port 16 - 192.168.200.0/24). I have VLAN 100 port 4,6,15,16 (general untaged) and vlan 200 with ports 10,12,15,16 (general untagged). The VLANs are working correctly. There is no traffic between VLANs, but all of them have internet. (I've checked using IP's on same range in differente VLANs, and there is no communication). But the thing is using Wireshark i can capture all traffic from the internet to whatever VLAN. I cannot capture traffic from other VLANs to internet.

If someone have an idea on what to use in order to avoid seeing DATA from internet to a VLAN not yours, i appreciate. Many thanks.

Community
  • 1
Portuguevos
  • 21
  • 1
  • 3

1 Answers1

0

You need a router which can take in VLAN tagged traffic and can route between the VLAN networks. Then you set up the router port in the switch to tagged VLAN mode and assign the VLANs you want over there.

Another option is to add an Ethernet interface for every network in your router, and connect those to switch ports which are then in their own networks.

There is no other way to properly implement VLAN networks than these two.

Tero Kilkanen
  • 34,499
  • 3
  • 38
  • 58
  • Hi Tero.Thanks for your answer. In my case i do not have a router that understands VLAN. But even if i had, a question arises in my head: I have more than 10 public IP's so i would use 1port of the router, and conected that port to my switch port 15, so that internet access stays in the same way.. So since i'm using one same port that has all VLANS, i believe using a wireshark, again i would see all traffic from internet to my switch. I mean the issue i have would be the same, right? – Portuguevos Sep 13 '16 at 11:04
  • Traffic in all VLANs will go tagged through that single port, so naturally Wireshark will be able to see all the traffic if you run it on the physical main interface. If you run it on the individual VLAN interfaces, then you will only see the traffic for that particular VLAN. You need multiple physical ports if you want to restrict visibility on the main interface. – Tero Kilkanen Sep 13 '16 at 12:59
  • And what about Provate VLAN? If my L2 switch has this feature, maybe i could separate all traffic with no problem? – Portuguevos Sep 15 '16 at 14:42
  • There is no way. You need to study how ethernet, VLANs and IP networking work in general and you will understand why. – Tero Kilkanen Sep 15 '16 at 15:29