Trying to understand how to work with VLANs and Omada Controller

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Trying to understand how to work with VLANs and Omada Controller

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Trying to understand how to work with VLANs and Omada Controller
Trying to understand how to work with VLANs and Omada Controller
2022-09-26 19:30:18 - last edited 2022-09-26 19:40:07
Model: OC200  
Hardware Version: V5
Firmware Version: 5.5.7

Hello community, 

sorry I know that a lot of threads already existing about VLANs, but I cannot fully understand in my specific case how to proceed. We would like to move from our current setup with 2x TL-ER6120 v3.0 Router and Netgear / TP-Link switch to our new Setup with 

  1. 1x TP-Link OC200 Omada 
  2. 1x ER7206 
  3. 2x TL-SG3428 
  4. 1x TP-Link TL-SX3016F 16-Port 10GE

We need to get the setup fit for our infrastructure, this means we have 3 root server 1x storage and 2x hypervisior running. All root servers are on the same network and working fine. We already created 2x interfaces with different IP subnet (10.1.11.0/24 and 192.168.0.0/24) in the omada controller. After that we have restrict the networks with ACL that a communication between the two subnets is not possible which is fine.  Also give the VMs the VLAN from subnet 1 and 2 is working and the VM is getting the right IP address from router and internet is also working fine.

Now we try to create different VLANs on subnet 1 and 2 and assign the VMs with the VLAN, but we get this setup not running. This means the VMs get no IP address and did not have an internet connection. What we need to do that this will be possible? And is it possible that the router give the VM based on the VLAN tag a IP adress from the right subnet, this means when I create VLAN 200 which is a VLAN from Subnet 2 the VM should get a IP address from 192.168.0.XX instead of 10.1.11.XX which is the default network. We have created the port 17 as tagged port where we route the interfaces and VLANs.

One more security question: currently we testing the setup in our office:

FritzBox (with own internal Network) -> 1x ER7206 -> TL-SG3428 -> Hypervisor -> VMs. Inside the VM I can not ping from subnet 1 to subnet 2 but I can ping all devices from the FritzBox network. Is this issue coming from the fritzbox or is there a setup issue on controller / router?

 

Many thanks in advanced

 

  0      
  0      
#1
Options
5 Reply
Re:Trying to understand how to work with VLANs and Omada Controller
2022-09-27 07:06:43

  @Cij 

 

Not sure if I understand you correctly. But when you create "subnet" on the controller, you also give it a VLAN ID. For example we create "test subnet" VLAN100.

Then the system will also create a profile automatically, called "test subet". In this profile, the test subnet(VLAN100) is untag. There is also an existing "All" profile, in this profile VLAN100 is tagged, while main network LAN is untag.

 

Then on the switch port you can choose the Profile. If you want this port to be VLAN 100 tagged, you should choose profile All;

If you want this port to be VLAN 100 untag, you should choose profile "test subnet".

 

See this example:

How to configure Multi-Networks & Multi-SSIDs on Omada SDN Controller

 

  0  
  0  
#2
Options
Re:Trying to understand how to work with VLANs and Omada Controller
2022-09-27 08:54:16

  @Somnus Thanks for your help and answer. I try to explain a bit more and hope you will understand my issue: 

 

Image 1 show you my test setup about the network and some explanations:

Image 2 show you my Subnet and VLAN setup: 

 

So my question is: 

  1. After creation of the VLAN1001: I get no internet connection inside the VM. I have created the profile VLAN and have tagged all Subnet and also the VLAN on port 17 which is connected with the root server -> hypervisior -> virtual switch -> VM. In our current setup the assignment of the VLAN to a VM is working fine without any issue. In the new setup the internet connection is not working. My question, why I get no Internet connection with crated VLANs, how can I get the VM connected with VLAN only to the internet, this means without creating a new subnet? 
  2. Can I create a VLAN and assign it to a VM, the VM should automatically understand the VLAN is from Subnet2 and get a IP addresse from Subnet2 192.168.0.XX but can not communicate with the other servers in Subnet2 only with the VMs which assigned the same VLAN.

 

Is this generally working with my idea or do I need create for each VM groupe a own subnet what would be a lot of work instead of using VLANs only? Sorry for the big input I hope you can follow my problem and understand now better my questions

 

Thank you very much! 

 

  0  
  0  
#3
Options
Re:Trying to understand how to work with VLANs and Omada Controller
2022-09-28 04:23:39

  @Cij 

 

I think I understand your requirement now, but I don't think it is possible on Controller mode. Basically what you want is similar as this example:

 

Source

 

So VLAN 2 and VLAN 3 are in the same subnet, but cannot communicate with each other.

 

To reach this we have to configure the router in standalone mode, because we need to get VLAN1000 or VLAN2000 Untag from the router. In controller mode, we cannot modify the router port PVID, and it is always in VLAN1 default VLAN.

 

 

There is another solution, that is not use VLAN to stop communication between your devices, but use ACL. That means all VM devices will be in the same VLAN/subnet like VLAN2000. However you can limit the traffic according to devices' IP or MAC address.

  0  
  0  
#4
Options
Re:Trying to understand how to work with VLANs and Omada Controller
2022-09-28 07:17:28

  @Somnus 

 

Understood thanks, is there any plan from you side to add this feature to manage VLAN / PVID from controller mode. Because that was one of the reasons why we bought the new setup, so we can manage all central. But if that is not possible and will not be, we can honestly stay with the old setup. We have experience and it works perfectly. What I find now really too bad that such a standard setting does not go over the controller.

  0  
  0  
#5
Options
Re:Trying to understand how to work with VLANs and Omada Controller
2022-09-29 03:53:09

  @Cij 

 

I think you can send this requirement to Request&Suggestion block.

  0  
  0  
#6
Options

Information

Helpful: 0

Views: 744

Replies: 5