Setting up vlan's on small network + ping question

Toggle sidebar Toggle sidebar
Y

yacpro13

Distinguished
Jul 30, 2008
35
0
18,530
I am in the process of fixing up our small company network - still in the planning phase. About 20 clients total.

The network will only consist of a layer 2 switch and a router.
I have two main groups of computers connected to the switch : Group A and Group B.
Group A and Group B have to talk to each other, but only Group A has to have internet access.

I was planning on setting up 3 vlans on the switch - one for group A, one for group B, and one for the internet.

Now in setting this up, the port on the switch which connects to the router will be part of the 'internet' vlan, and the 'group A' vlan. The ports connecting the Group A computers will be members of all vlans, and the ports connecting group B computers will be members of the 'group A' and 'group B' vlans only.
This means that Group B is isolated from the router, and therefore there is no dhcp for these computers.

Question 1) i want to use a single subnet, say 192.168.10.x. Since there is no dhcp for group B, I assume I will have to manually set static IP addresses (outside the dhcp range) via windows for each computer for this to work, correct?

Question 2) this question is more related to how a switch works. Assuming I attempt pinging by ip from one computer on group B to a second computer on group B, would it work?
Both of these computers are only connected to a layer 2 switch. From what I read, layer 2 switches do not use ips at all - only MAC addresses. So does that meant that I cannot ping an ip if there is no router on the network?


My understanding was that, even if the arp table is empty, once the ping by ip reaches the switch, the switch would broadcast to the entire vlan group B, and then add the ip-Mac entry in the arp table. All future ping of that ip would then not need to be broadcast because the MAC address for that ip is now known.

Is my understanding correct? Thanks for your help.
 
Solution
B
That is exactly how ping works and in fact all layer 2 ip communication. The first thing a PC does is issue a ARP for the gateway IP if it exists. Next if it needs to talk to any address outside its subnet it just stuffs the destination IP in the packet and put in the mac of the gateway and lets the gateway deal with it. If the ip is within its subnet then it issues a ARP for the mac. After that it just sends the traffic to the mac address.

The switch is even more stupid it has no concept of ip or arp or anything. It just looks at the source mac address of any packet coming in and keeps track of what mac addresses it saw on what port. It then takes the destination mac address and tries to find a matching port. If it find it...
Sort by date Sort by votes
B

bill001g

Titan
Aug 9, 2012
28,322
2,755
125,640
What you are describing is actually a very advanced form of vlans that is only supported on very high end switching equipment. It is called private vlans and restricts traffic between devices that are on the same subnet. This is generally done with a very special firewall.

I will therefore look at the more common design.

I suspect have not used vlans much since you can not really assign a port to multiple vlans at the same time. You can but then you must use vlan tags to keep them separate

So you are either going to need a router or a layer 3 switch to make this work. The design is the same in either case but I will assume a layer 3 switch to avoid the extra complexity.

You define 3 vlans

say 192.168.10.x for vlan 10 for group A
192.168.11.x for vlan 11 for group b
and let say vlan 12 that you let learn a IP address from the router. Lets just say the router assigned 192.168.12.99 to your PC with a defualt gateway of 192.168.12.1

You then assign the interfaces on the switch 192.168.10.1 and 192.168.11.1 for their corresponding vlans and define dhcp scopes for the proper pools.

This will in effect let the device on both vlans talk to each other as well as the internet vlan. The routing will all work...of course the intenret router must also know about these networks.

To get your final requirement you need to put in a filter rule for all ports on vlan 11 that says they can only send data to 192.168.10.x ip. How exactly you do this varies a bit from brand to brand but all have the ability.

Now if you intended to do this with consumer grade switches and routers it is going to be much harder. dd-wrt can do a lot of this and many partially smart layer 2 switch can do vlan tagging but it is not real well documented so you will have to learn a lot about these platforms to get it configured.

 
Upvote 0 Downvote
Y

yacpro13

Distinguished
Jul 30, 2008
35
0
18,530
Hi Bill,
you are right in that I haven't really ever implemented vlans before.

The switch I have is a Trendnet TEG-448WS Layer 2 Switch, which allows mapping of its ports to vlans. There are 3 options: untag/tag/not member - I'm working on creating the switch vlans right now.

At this very second, I have about 20 devices connected to the switch - and that's it. No router, no internet, just a switch and PCs.
I manually set ip addresses (all same subnet) on each computer in Windows.

When I ping from one computer to another....it works!
So for example, "ping 192.168.0.50" works. I thought it would, but everything I read online says a switch is not IP aware. So in this case, how does the ping work? Is it because of arp (ie. the switch broadcasts the ping to all ports, then determines what computer responds and saves the ip-MAC in the ap table)?

I mean so far so good - I just want to really udnerstand what is going on for it to all work.

Thanks.
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,322
2,755
125,640
That is exactly how ping works and in fact all layer 2 ip communication. The first thing a PC does is issue a ARP for the gateway IP if it exists. Next if it needs to talk to any address outside its subnet it just stuffs the destination IP in the packet and put in the mac of the gateway and lets the gateway deal with it. If the ip is within its subnet then it issues a ARP for the mac. After that it just sends the traffic to the mac address.

The switch is even more stupid it has no concept of ip or arp or anything. It just looks at the source mac address of any packet coming in and keeps track of what mac addresses it saw on what port. It then takes the destination mac address and tries to find a matching port. If it find it sends it to that port if not it sends copies to all active ports. The switch could care less what is in that packet past the mac address. You have to remember there are actually protocols other than IP that could be in a packet you just don't see things like IPX much anymore.

You need to think of vlans as completely separate switches in the same physical box. You just end up with more very stupid devices if you have a layer 2 switch. It has no ability to move data between the switches.
 
Upvote 0 Downvote
Solution
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom