Wireless Clients List in DHCP Table Using Mgmt Vlan Interface

jayd691

I have a USG Flex 700, GS1920-24 HPv2, and a Mist AP-41 on my network. I have 5 Vlans with Mgmt Vlan being 1 and 10,20,40,50 as the others. Each Vlan has a corresponding SSID on the Access point.

My problem is when I connect any new wireless clients to the network, they always seem to connect under the Mgmt Interface on the firewall instead of the correct interface on the firewall corresponding to the Vlan on the switch and AP. I show 20-30 IP/MAC bindings on the interface for the mgmt instead of only 2 (switch/ap). I used to have it setup router-on-a-stick method but have enough ports that I set it up on individual ports instead for better throughput and control.

I do not have vlans setup on the firewall and have each port setup as a /24 for each of the 5 vlans. It all works ok, but it seems like it could be better if the non-mgmt clients would connect to the correct interface, it would be smoother.

What have a done wrong? Should I have used Vlans on the firewall and if so how?

Thank you,

Jay

Zyxel_Judy

Hi @jayd691 ,

Please refer to the articles below for instructions on configuring VLANs on the USG Flex 700 and GS1920-24 HPv2.

USG Flex 700:

https://community.zyxel.com/en/discussion/19397/how-to-configure-a-vlan-interface-with-dhcp-server-in-on-premise-mode-firewall

GS1920-24 HPv2:

https://community.zyxel.com/en/discussion/19489/tutorial-of-switch-vlan-configuration-v4-80

jayd691

Thank you for the assistance Zyxel_Judy.

I do know how to create the actual interface on the firewall and switch, but I am unsure of how to setup the firewall for the vlans.

1. What do I use for the base port for the vlans?
   1. Do I create a network just for the firewall itself and then use that for the base port for all the vlans?
   2. Do I need to combine the multiple ports together LAG style and then use a separate network for each base port?

These are my major issues with adding vlans on the firewall. Right now, I just use a /24 subnet as a port on the firewall which then I have connected to the corresponding vlans on the switch and the AP which is LAG to the switch router-on-a-stick style as there are only 2 ports on the AP.

PeterUK

I seem to not get how you have done this without VLANs so its down to your switch setup for the VLAN to then untag to a given port on Flex 700?

So if port 24 was the AP and ports 1-5 to Flex 700 ports
VLAN 1 ports 24 and 1 untag ports 24,1 PVID 1 ports 2-5 forbidden

VLAN10 port 24 tag port 2 untag port 2 PVID 10 ports 1, 3-5 forbidden
VLAN20 port 24 tag port 3 untag port 3 PVID 20 ports 1-2, 4-5 forbidden
and so on?

jayd691

PeterUK,

Yes, it is very close to that except I have the AP connecting via a trunk port to the switch allowing all 5 vlans. The ports to the Flex 700 from the switch are untagged for the respective vlans and all other ports on the vlan are allowed with the rest forbidden.

I would like to set it up with vlans on the Flex 700, but I am trying to find out how to set up the ip addressing for the base ports.

I would have VLAN 1,10,20,40,50 as vlans on the firewall, but am not sure what/if to use as ip addresses for the base ports on these 5 ports that will contain the vlans.

Would I use say 192.168.1.1, 192.168.1.2, 192.168.1.3, 192.168.1.4, 192.168.1.5 for the 5 base ports?

Would I use no ip address on the base ports?

If anyone could assist here in the proper setup, I would greatly appreciate it. I just purchased a Flex 500H and two Zyxel APs that I plan to use the Flex 500H as the controller for and will also need to configure that. I have been utilizing Zyxel Education and campus trying to figure this out, but I have not found what I am looking for to set this up correctly.

I can set it up the same as the 700 is, but as I mentioned previously, I would like to get rid of the issue where new nodes are listed connecting to mgmt vlan interface instead of the correct vlan interface.

Thank you.