Potential subnetting issue with VLAN's and stuck, could use some help/education.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Potential subnetting issue with VLAN's and stuck, could use some help/education.

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Potential subnetting issue with VLAN's and stuck, could use some help/education.
Potential subnetting issue with VLAN's and stuck, could use some help/education.
2023-06-28 04:54:44 - last edited 2023-06-29 02:59:25
Model: ER8411  
Hardware Version: V1
Firmware Version: 1.0.4

Hey all,

 

I'm new here but I'll try to keep this as short as possible with relevant info. I'm hoping this is simply a "You're dumb, here's why this isn't working" thing.

 

I came from a Fortinet environment which had a very different mentality and functionality; it was a pretty neat firewall but I'm new to Omada and trying to figure things out myself and running into bizarre issues.

 

My network is pretty simple:
Internet > ER8411 > SG3210-XHP-M2 > EAP670

I do have a software Omada Controller with everything adopted, but other than the VLAN's outlined below, and the AP SSID's, it's stright default. (No ACL's, etc.)

Attached to the switch, I have a bunch of Proxmox servers with VLAN-aware VM's/CT's.

 

I have 5 VLAN's:

VLAN 1 - LAN (192.168.0.1/24)

VLAN 20 - Servers LAN (192.168.3.1/24)

VLAN 30 - Home LAN (10.1.30.1/24)

VLAN 40 - IoT LAN (10.1.40.1/24)
VLAN 50 - Guest LAN (10.1.50.1/24, with guest isolation)

Here's where the weirdness happens.

 

My admin PC is attached to the switch, gets a 192.168.0.x IP just fine. I can ping devices in the IoT VLAN, the Home VLAN, and the LAN VLAN. What I CANNOT do is ping anything in VLAN 20 which is the Servers VLAN.

 

Without changing my switch port, I manually change my PC's IP to something in the 192.168.3.x range, and suddenly I can ping and access the Server hosts just fine (Which are 192.168.3.200-205) but I lose internet, and can no longer ping anything in the other VLANs.

I've also noticed that the servers themselves also have no internet. They won't even ping the gateway 192.168.3.1 which was configured in the VLAN exactly the same as all other VLANs. There's nothing 'unique' about it other than the fact that it shares the first 2 octets of the admin IP Address. It's just like everything in that IP range has no route to any hosts whatsoever, other than each other. (A 192.168.3.200 server can ping and access every other server in the same subnet and same VLAN, but no internet nor gateway access, though the gateway CAN be accessed from the administrator VLAN)

 

I would initially go to "Oh, it's just subnetting issues" except everything is 255.255.255.0 (/24) so, to my mind, it shoudn't matter whatsoever that the first two octets are the same in the LAN/Management LAN. 

 

I haven't tried (yet) to create a different VLAN as a test in the 192.168.99.1 range and assign a VM to it to see if I can ping it or not. I may also consider doing a 192.10.1.1 or something with a wider scope as a test to see where things stop working... But that's where I've gotten so far.

 

Is there something in particular that is obviously 'wrong' with my thinking here? What am I missing?
I had the exact same setup with the Fortinet and everything worked just fine, but I realize it was more of a firewall and had NAT between VLAN's so it was a bit different.

 

I hope this is a clear enough explanation, and might be able to nudge me in the right direction where I'm going wrong.

 

  0      
  0      
#1
Options
1 Accepted Solution
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education. -Solution
2023-06-28 17:39:09 - last edited 2023-06-29 02:59:25

Okay, I think I've got it figured out.

 

Proxmox was throwing me for a loop. The server hosts have the ability to handle VLAN's natively (or choose not to) but it's more than a simple 'flicking the switch'.

 

The VLAN configurations were correct and after more testing, I was able to figure out what was going on.

 

The server hosts THEMSELVES need to be VLAN aware, and configured to send/receive tags to exist within a particular VLAN.

 

What was happening:
The trunk LAN was able to see the servers but only in the 192.168.3.x subnet range. (Changing my IP would let me see them)

When I assigned them to the VLAN, the hosts themselves were sort of able to just ignore the VLAN settings and continue on their merry way.

 

I had to actually change the networking configuration in the proxmox server networking to tell them "Yes, you need to handle the VLAN tags", and suddenly they started appearing as I would expect them to.

 

There's still no internet connectivity yet, but that's a different battle I'm facing.

 

At any rate, it seems it isn't a router issue whatsoever and my understanding of the VLAN config seems to remain shaky but generally understood.

Recommended Solution
  0  
  0  
#5
Options
5 Reply
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education.
2023-06-28 07:02:16

  @SoloAdminEh 

 

make sure that you have enabled vlan on the ER8411, there are many ports on it and it is easy to forget to check vlan on the ports you need.
so my recommendation is check all VLANs make sure all vlans are set on the pore you need on the ER8411

 

  0  
  0  
#2
Options
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education.
2023-06-28 14:05:22

  @MR.S 

 

Thanks for your insight.

 

Both the 8411 and the SG3210-XHP are fully configured and all other VLAN's work.
 

The 8411 only has a WAN connection to the internet, and a single uplink to the SG3210 on the 10G LAN Port. Everything is routed through the switch.

(Also, they're not running in standalone mode, they're all configured by the central controller.)

 

Wouldn't the other VLAN's also fail if I had not set this up how you're suggesting?

  0  
  0  
#3
Options
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education.
2023-06-28 14:11:10

  @SoloAdminEh 

 

the story didn't say anything about how you connected to the ER8411, but if everything goes from one port on the ER8411 to the switch, you just have to make sure that the vlan that has problems is also marked on that port on the ER8411. so why it doesn't work then I don't know, I myself have an ER8411 with multiple vlans, all these work as they should, can you send a screenshot of how the problem vlan is configured?

 

  0  
  0  
#4
Options
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education. -Solution
2023-06-28 17:39:09 - last edited 2023-06-29 02:59:25

Okay, I think I've got it figured out.

 

Proxmox was throwing me for a loop. The server hosts have the ability to handle VLAN's natively (or choose not to) but it's more than a simple 'flicking the switch'.

 

The VLAN configurations were correct and after more testing, I was able to figure out what was going on.

 

The server hosts THEMSELVES need to be VLAN aware, and configured to send/receive tags to exist within a particular VLAN.

 

What was happening:
The trunk LAN was able to see the servers but only in the 192.168.3.x subnet range. (Changing my IP would let me see them)

When I assigned them to the VLAN, the hosts themselves were sort of able to just ignore the VLAN settings and continue on their merry way.

 

I had to actually change the networking configuration in the proxmox server networking to tell them "Yes, you need to handle the VLAN tags", and suddenly they started appearing as I would expect them to.

 

There's still no internet connectivity yet, but that's a different battle I'm facing.

 

At any rate, it seems it isn't a router issue whatsoever and my understanding of the VLAN config seems to remain shaky but generally understood.

Recommended Solution
  0  
  0  
#5
Options
Re:Potential subnetting issue with VLAN's and stuck, could use some help/education.
2023-06-28 17:54:41 - last edited 2023-06-28 17:55:29

  @SoloAdminEh 

 

Glad you figured it out :-) vlan is not that complicated on Omada but it can be a challenge on some devices that are not so easy to configure that Omada is :-)

 

  0  
  0  
#6
Options

Information

Helpful: 0

Views: 634

Replies: 5

Related Articles