vlans sharing broadband connection

[aldouy]

we have a problem configuring vlans on baseline switch 3CBLSG16 (2916-SFP Plus). We want to define 2 vlans that can share an internet conenction but separated eachother. that means that both departments should share internet but should not share any other information. we tried to do that creating 2 vlans with a common port for the internet router. One of the vlans with tagged ports and the other with untagged ports. this do not work. can you help us.

[Luckycharms]

For this to work the Broadband device you are connecting the Baseline swith to needs to be configurable by you (not owned by service provider) and also support VLAN's and understand tagging.



So the answer is the following. If you are sending 2 VLAN's over the same port to your Broadaband device. The Baseline switch is adding bytes with an ID number in it based that VLAN's ID number. The Broadband device is probably going to drop those packets since it does not know what to do with them. When the broadband device sends packets to the Baseline they are more than likely being sent without those extra bytes which the baseline switch will then send out on the "Default" VLAN



To understand more read on



The VLAN that comes on the switch from factory is usually called the "Default" VLAN. Then as you add new VLAN's each one gets an ID number so only when the switch sends a packet down a link with 2 or more VLAN's on it. The switch will add bytes to the packets with that number in them.



On any given port you can have 1 and only 1 VLAN that the switch does not add the extra bytes to. Thats called the "un tagged" vlan for that port. All the other VLAN's on the same physical port must have bytes added to each packet with an ID number. These are the "Taggged" VLAN's for that port.



Here is where it gets ticky. Switches and Ports obviously both send and receive packets.



So first lets talk about what happens when a Switch receives (ingress) a "Tagged" packet on a particular port. It first looks to see if the packet has extra bytes in it. If it does then it looks at the ID number in those bytes. It does a lookup to see if it matches the ID number of a VLAN ID number it was configured for lets call it VLAN Green. If there is a match, it then looks up the list of ports the have that Green VLAN on them and then sends the packet out (egress). This also holds true for a packet it received without these extra bytes.



Now lets look at what happens when a switch now needs to sends a packet it received. The switch already decided what VLAN the packet belonged to. Now it does a look up of the list of ports configured by the admin of the switch for that Green VLAN. If the port the packet needs to go out is a "Tagged" port for that Green VLAN. The switch adds those extra bytes to it with that ID number in them and sends it out. If the port the packet needs to go out is "Untagged" for that VLAN. It does NOT add those extra bytes and sends it out.



Lastly lets talk about what happens in the worst case scanario and that is when a Switch receives a packet on a port with extra bytes and a VLAN ID number the switch itself was not configured for. For security reasons most low end switches or devices that don't or are not configured for VLAN will simply drop that packet. On more expensive switches and devices that do understand and can be cofnugred for VLAN. There are additional configurations that can me more selective before dropping packets.

[mohd_suhaimie]

as i know, base line only support 1 interface vlan that is default (vlan 1 interface)



if u have 2 another vlan of user eg vlan 2 and vlan 3,



u need 1 firewall that can support tagg port.



than can create interface vlan 2 and vlan 3 at the firewall. After configure address using the interface under firewall rules , allow the ip range that allow to internet