VLAN + 2626

[mark_648]

I have the following small network with a 2626:

Port 1-5 workstations
Port 20-23 servers
Port 24 router

I would like the workstations to see the servers but not the router
and the router to see the servers but not the workstations

this is my config:

vlan 1
name "DEFAULT_VLAN"
untagged 1-23,25-26
ip address 192.168.5.252 255.255.255.0
no untagged 24
exit
vlan 2
name "VLAN2"
untagged 24
tagged 20-23

the workstations can see the servers, but the servers can't see the router and vice-versa

have I done something wrong?

thanks
--Mark

[Ron Kinner]

Did you tell the servers about the VLANs and the tagging?

Do they even understand tagging and VLANs?

Not all of them do.

Ron

[mark_648]

thanks for your reply Ron

>Do they even understand tagging and VLANs?
the servers have Dual Intel® 82541 Gigabit Ethernet (1 nic disabled on each server) which are IEEE 802.1Q compliant.

>Did you tell the servers about the VLANs and the tagging?
now that could be where my problem is!

how do I do that? the servers are win2003.

thanks...really appreciate your help with this
--Ma

[Ron Kinner]

"VLAN Requirements:


Each VLAN will add to the load time and RAM/CPU utilization.


Each VLAN requires a unique address on a separate subnet.


There may be more than one VLAN per adapter, but WINS will only connect over the first VLAN.

In some OS's, the term 'team' is used for the virtual adapter, so there may be a team of one adapter for VLANs or there may be a regular link aggregated team of multiple adapters that also does VLANs simultaneous with a mode of link aggregation.


Installation

Microsoft Windows* 2000, XP*, and Server 2003:
In Device Manager, right click on the adapter or team that is to have the VLAN(s), and select properties. Select the VLAN tab and click New. Follow the wizard to create VLANs. Once all VLANs have been setup, go to Network and Dial-Up connections or My Network Places to setup addresses for each VLAN. "

http://support.intel.com/support/network/adapter/ans/ieeevlans.htm

Note that you will need to have two different subnets. One for VLAN 1 and one for Vlan 2. And of course the servers will require IP addresses for both subnets. The router (and thus the default gateway) must also be in the Vlan 2 subnet. (Please do not try to put a second default gateway on the servers for the VLAN 1 subnet) The way the server decides which VLAN to use for outgoing traffic is by the IP address of the destination and the routing table. It looks at the IP address and then at the routing table (netstat -an) to see what to do with it. The routing table thinks there are two separate NICs, one for VLAN 1 and 1 for VLAN 2 and the NIC goes along with the fiction. It knows there is only one network connection but it also knows that if the destination is on VLAN 1 it goes out with out a tag and if on VLAN 2 it has to have a tag.
(Incoming stuff is much easier. It just checks to see if there is a tag and strips it off and then drops the packet in the "in basket").

Too bad you don't have one of the Procurve switches (2500 series I think) with the Isolated Port Groups option. That would do what you want without having to play with the VLANs and subnets.

Ron

[Nicholas Ciarleglio]

If you would like to simply control access of between devices within the 192.198.5/24 subnet, you can use the source port filter feature of the 2600, assuming it is upgraded to version 8.x code. This will allow you to avoid configuring VLAN tagging/seperate subnets on your server NIC's, and the 2600.
I have attached the correct section of the manual for the syntax of the source port filtering command.

If you want your clients and servers to be in seperate subnets, you should create a seperate subnet on your router, and config the IP addresses of the servers in that new subnet. Then you could use ACL's to control the traffic flow between the "server" VLAN 2 and the "client" VLAN 1.