How do I set up VLANs to separate traffic on Procurve 1800-24G???

[sierradump]

I am brand new to the Procurve series of switch, and new to VLANs altogether.

I have 3 subnets on my network that I want to keep private from each other (LAN, iSCSI, DMZ).

I would like to somehow use my Procurve 1800-24G to segragate these three subnets using VLANs.

THIS IS WHAT I AM LOOKING FOR:

Ports: 1-8 = LAN (192.168.1.x)
Ports: 9-16 = iSCSI (192.168.10.x)
Ports: 17-24 = DMZ (192.168.100.x)

What I want is, for example, any device plugged into the DMZ ports (17-24) to be able to talk to any other device plugged into the DMZ ports (17-24), BUT NOT be able to talk to anything on the LAN or iSCSI ports (1-16).

Can someone break it down step by step for me? I would really appreciate it!

I see the VLAN section on my switch but I don't know what I am doing? I created 2 VLANs for a total of 3 including the default VLAN that came with the switch (1(LAN), 10(iSCSI), and 100(DMZ)) and added the corresponding ports that I want to group together to each of those VLANS - But I don't know what to do next?

I don't understand the TAGGED and UNTAGGED stuff, the ingress filtering, or the PVID?

If anyone could give me step by step instructions I would be very grateful!

Thanks!

[Trevor Commulynx]

http://cdn.procurve.com/training/Manuals/1800-MgmtCfg-June2007-59916275.pdf

Page 2-24 is the best place to start. you dont need to tag any of the ports unless you want to uplink to another switch with that same vlans.

[sierradump]

Thanks for the link... Unfortunatley I have read that section about 20x and I am still baffled...

Here is what I have done so far:

Setup 2 additional VLANs, 10 and 100 (for a total of 3)...

I now have 3 VLANs numbered, 1, 10, and 100.


VLAN 1 has ports 1-8 as members
VLAN 10 has ports 9-16 as members
VLAN 100 has ports 17-24 as members

Under port config, I have set the PVID on each port for the VLAN (1,10,100) I want it to belong to...

But for the rest of the settings under VLAN Port Config such as VLAN Aware, Tagged / ALL etc... I don't know what I need to do?

Do I need to change any of those port settings?

Again I am just trying to separate each group of ports (1-8, 9-16, 17-24) from seeing each other - essentially setting up 3 private switches...

[Trevor Commulynx]

No, that is all you need to do. a quick test is to put two devices with an address on the same IP network number into ports that are members of seperate vlans and test a ping between. repeat on alternate ports to test all ports are isolated.

Trev.

[sierradump]

COOL! That test worked! I can't see them.

Now I want to coplicate things just a little bit...

On my DMZ VLAN 100 (ports 17-24) I have my NIC, with IP 192.168.100.1, from my firewall plugged into port 17. I want to allow VLAN ID of 100, 101, 102, 103, 104 to pass through any port (17-24) to any other port...

Basically I have 3 VM ESX hosts that "tag" packets for VLANs plugged into ports 18, 19, and 20 (but may add 4 more later) and I need them to send VLAN traffic to any of those 8 ports...

What do I need to do on the switch to accomplish this????????

THANKS!