Help with VLANs on Cisco SG300 with Netgear FV336G

[ekhoo]

Hi,

I have 4 SG300-28P switches in L3 mode.

They are connected to a Netgear FV336G Dual WAN router which provides 3 networks (VLAN1, VLAN 30 and VLAN 40), it has 3 different DHCP scopes for each VLAN. VLAN1 = 192.168.101.x, VLAN 30 = 192.168.30.x and VLAN 40 = 192.168.40.x.

I have 6 WAP321 with 3 networks (SSID) corresponding to the 3 VLANS. I can access only VLAN 1 so I can get DHCP 101.x but not the other 2 VLANS. All switch ports currently are set to Trunk. The switches are connected via 2x1G LAG Links. Also set to trunk mode. When I directly connect to the Router, I can create a VLAN interface (30 or 40 for example) and that will pickup the IP address as needed.

Anything I'm missing out in the config?

See attached diagram that may help explain better what I'm saying above. Port connected to Router is also configured as Trunk. (yeah, the diagram states 4 VLANs... right now, only 3).

 

[chadster766]

Make sure your trunk ports and LAGs are all untagged VLAN1 and tagged VLAN30,40.

The AP's need to be on a trunk port and their LAN configured for VLAN1. The AP SSID can then be tagged VLAN30 or 40 as needed.

 

[coxhaus]

If you followed my example as I replied under my thread you need to change the router's port to be an access port so the L3 switch will do the VLAN routing since each VLAN has a different IP network. This means all DHCP needs to run off the L3 switch not the router. And there needs to be a routing statement on the router for each network (VLAN) other than the base (default)network which the router resides in connecting to the L3 switch.

You also need to strip all VLANs from the router. No where in my example did I setup a VLAN on the router.

http://www.snbforums.com/threads/ho...co-sg300-28-layer-3-switch.26964/#post-203931

PS
This will work at layer 3 we just need to adjust your configs.

 

[coxhaus]

The beauty of the layer3 switch is it runs and controls the local network. The router is no longer needed except to open and close the front door to the internet. You should be able to unplug the router and the local network runs fine without internet access. ALL sharing and not sharing still works locally without the router.

 

[ekhoo]

Thanks chadster766 and coxhous. Will try that on Monday and report back my findings. In a previous building, I had a similar config except each VLAN had separate routers (access port 1P for VLAN 1 and accessport 10T for VLAN10) so I didn't get this single router problem...

 

[ekhoo]

chadster 766 got it. I always thought trunks carried all VLANs and did not require them to be tagged.
Right now (I'm doing this at home and not at the production site) what I have is:
Netgear FV318 (single WAN router vs dual-WAN) - Port 1 carries VLAN1, VLAN10 and VLAN20.
SG300-10PP switch - Port 1, 9 and 10 are configured as Trunk 1UP, 10T and 20T, all other ports are Trunk 1UP.
SG300 Port 10 connects to Netgear Port 1.
SG300 Port 9 connects to Cisco WAP371 (3 SSIDs, VLAN1, VLAN10 and VLAN20).

Laptop to SG300 Port 1,2,3,4 etc get 192.168.1.x DHCP (VLAN1). Configure Virtual Interface with VLAN20 and I get 192.168.20.x.
Using Wireless SSID2 - VLAN10, I get the 192.168.10.x network. For LAN ports that need to be specific VLAN, I change them to access ports and only tag the specific VLAN, i.e. Port 3 for VLAN10 is Access 10T, 1F, 20F.

Looks like on the production site, I need to tag the trunks and the LAG ports used for inter-switch connections, i.e. on the SG300-28 Port 27-28 LAG1 needs to be also 1UP, 30T, 40T. Thanks a million guys.

 

[coxhaus]

If you are going to use trunks to the router why use a layer3 switch? All you need is a layer 2 switch. You will have a faster network if you let the layer3 switch handle the local VLAN routing rather than the router. A layer 3 switch can always switch faster than a router if for no other reason than their backplane is bigger.

PS
I don't see how people don't understand this.

 

[chadster766]

If you are going to use trunks to the router why use a layer3 switch? All you need is a layer 2 switch. You will have a faster network if you let the layer3 switch handle the local VLAN routing rather than the router. A layer 3 switch can always switch faster than a router if for no other reason than their backplane is bigger.

PS
I don't see how people don't understand this.

Yes you are right; but Layer 2 is a good place to start.

I do recommend that Layer 3 be enabled on all switches capable of it when first added to the network. This is a good idea because the configurations are typically deleted when Layer 3 is enabled. I've learned this the hard way

Having Layer 3 enabled doesn't hurt anything, it's can just be unused until implemented.

Layer 3 switch routing does add some complexity to the network and really complicates NLB. NLB Multicast Mac Addresses in the Cisco SG series are impossible.

 

[coxhaus]

I think working at layer 2 is developing bad habits when you are building networks. You build much better infrastructure using layer 3 especially if your are going to grow your network.

Right now with a gig internet pipe the routers cannot keep up. You add routing for the internal network and you incur more lag time on the router. It is now time to start letting the switches handle the local networks and save the router for the internet.

PS
Good to know about multicast. I can't think of a reason I will use it at home so I may be alright. The Cisco SG300 switches are not as good as the pro Cisco switches but they are more affordable for small networks. I think almost any layer 3 switch is better than a layer 2 switch so it is what we have. It sure would be nice to run protocol routing between the router and the switch so you don't have to input all those static route statements. Maybe the next generation will have protocol routing.

 

[ekhoo]

Well, what I could do is make 3 access ports - VLAN1, VLAN30 and VLAN40 on the production switch and assigned each one to a dedicated router port. That will work too I think. Total users is about 30 on 2 networks. Guests might reach 400-500 (it's a public venue) so I might let the switch do the DHCP/routing for that in the near future.

WAN Links are 20mbps and 10mbps, the router is doing the NLB.

Thanks guys - yeah, one step at a time.

 

[coxhaus]

If you don't want to use the switch for DHCP, Microsoft makes an excellent DHCP server which will scale very well. You need to turn on DHCP RELAY on the switch pointing to the Microsoft DHCP server. This will allow multiple networks to forward DHCP requests to one IP address. Under Microsoft DHCP server you setup multiple scopes one for each network(VLAN).

What you are going to find out is it becomes very easy to change routers in the future as there is no DHCP on the router. The router just becomes a front door to the internet. You will be able to change routers in a matter minutes because you only have one IP address to worry about which is the router's IP address.

 

[ekhoo]

Thanks Coxhaus. What you've suggested is quite good and I think it'll be something I'll do in the near future. At the moment, I prefer to have more appliances than servers since they don't have any support staff onsite if anything goes wrong. Switches tend to last kind of forever.

I am however going to set my home network the same way as you did since I do have my switch on L3 mode and will be able to have a the guest network on a separate VLAN.

 

[oletuv]

PS
Good to know about multicast. I can't think of a reason I will use it at home so I may be alright.

Should not multicast be enabled on video VLANs, e.g. IPTV ?

 

[coxhaus]

Should not multicast be enabled on video VLANs, e.g. IPTV ?

Multicast is used for when broadcasting to multiple people same program same time to like a school class room. For a single video stream to a single point no need to use multicast. Multicast saves bandwidth if you are going to have 30 people watch the same program at the same time so there would be 1 video stream to 30 people.

 

[oletuv]

Multicast is used for when broadcasting to multiple people same program same time to like a school class room. For a single video stream to a single point no need to use multicast. Multicast saves bandwidth if you are going to have 30 people watch the same program at the same time so there would be 1 video stream to 30 people.

This excellent example made me understand how multicast works. Thank you very much, coxhaus.

Ole