@Dougie175 

 

right here, you are trying to set a port profile for the IoT vlan, but you still have it wrong

 

 

For an access port, where the switch port is being used to connect a device straight into a vlan, the desired vlan should be untagged & native with no tagged or other untagged entries on the port

Here, you are setting the untagged entry to the vlan1, hence why the devices are still getting an IP in vlan 1

 

It should read

 

Native Network : IoT

tagged Networks: --blank--

Untagged BNetworks: IoT

 

 

A brief reminder

All switch-to-switch and switch-to-router ports should either use ALL, or a custom profile with 1 untagged vlan (in your case, "Secure") and the remaining vlans as TAGGED

 

All access ports - ports going toa. single device (or a dumb switch hosting devices all in the same vlan) should have the desired vlan as NATIVE and UNTAGGED, nothing in tagged at all, and no other untagged networks either (in most cases, and this applies to you)

 

 

Here are screenshots from mine for you to compare

 

Network:

 

Switch Profile for my switch-to-switch and switch-to-router links (my equivalent but customised version of "All")

 

A switch profile that puts a port right onto a specific vlan

 

Port profiles on a SG2008P

 

 

 

Port profiles on a ES205G switch.  Client IPs wont be shown on devices connected to this switch, but will still work and get an IP

 

 

  @Dougie175 

 

Also, if you are using an ES208 switch for your IOT devices, these switches dont show the IP address of connected devices - but the devices do actually have an IP.  Its just not shown in controller.  There is some kind of fix for this on the horizon i believe.

  @Dougie175 

 

i just posted some screenshots in my last post, you may not have seen them as you were replying at the same time i think.

 

The last thing to check, even if it has been mentioned before

 

Make sure all vlans are allocated to every router port (that you need if multiple switches connected).  Leave the router port PVID on 1.  The rest of the networks will be tagged, and need to be tagged so they traverse the ALL port profile link to the switch correctly.  Make sure all switch-to-switch link ports are using the ALL profile, and that every switch, if its at the end of the chain, has its uplink port also using ALL

 

And lastly, make sure you are setting DHCP to the right IP (you probably are, it wont let you get it radically wrong, but make sure the gateway UP for each vlan is actually going to the router IP for that vlan)

  @Dougie175 

 

Other things to check - 

 

- Have you set any switch ACLs that might be bocking a vlan to itself? this will prevent clients in that vlan getting an IP and communicating

- Same as above but for an EAP ACL, which would effect wifi clients

- if you have a gateway ACL that block a vlan to the Gateway Management Page, only select TCP protocol for this otherwise stuff goes weird

- Have you enabled IP-MAC binding and selected the option to only allow the listed MACs to connect (which woukld block anything not in the list)

- Same for general MAC filtering

  @Dougie175 

 

i sent you a message last night, take a look

 

Its hard to say whats going on here, this all seems right.  There could be some small details or configuration you have made somewhere interfering with DHCP, there are a few more things to check i think before we go down the factory reset / re-adopt route

 

 

What happens if you configure a device with a static IP on a vlan (not needing DHCP), set a switch port to the same vlan, and connect - does the device have connectivity ?