Setting up the switch vlan

MR308w

Hi all,

Totally new to the world of networks and after 2 weeks of struggling i am at the point to give up and ask for help.

Running a OPNsense router baremetal with the router self in vlan1, I did try to put the switch and access points in vlan 20, and than 3 other vlans (30,40 and 50).

Most of my rules and a diagram of the network that i tryed to draw:

Every possibility i did try when setting up the vlans on the switch I get locked out.

Today i tryed to simplify it by setting router, switch and the 3 access points on vlan1 but get the same results.

My switch is the XMG1915-18EP that got 2 places to set vlan options.

In the first vlan setup page i got the options normal, fixed and forbidden and the possibility for tx tagging each port. The other page is with pvid, trunk and ingress check.

Did try so many different approaches that I thought was right but seems like something is missing. After clicking apply when Alan's are created and setting the trunk and pvid's i get locked out and the pheriphicals receive a 196 address what i don't use.

If you could put me in the right direction i would be very grateful.

Thanks in advance

Zyxel_Melen

Hi @MR308w

In the first vlan setup page i got the options normal, fixed and forbidden and the possibility for tx tagging each port.

This part is to set up the static VLAN table, and the egress behavior for each VLAN and ports.

The other page is with pvid, trunk and ingress check.

This part is to set up the ingress behavior.

• The pvid setting is for the incoming packets without VLAN tag.
• Trunk setting is for switch to handle/forward the unknown/non-static VLAN packets.
• Ingress check setting is for accept the packets from any VLAN that this port is not a member.

Hint:

• The port to network device like AP and OPNSense, need to be tagging.
• The port to end device like PC, need to be untagging/unselect tagging and set PVID to the VLAN you want to assign, like VLAN 20.

For more details, you may reference this FAQ:

Tutorial of Switch VLAN Configuration (V4.80 and newer) — Zyxel Community

Zyxel_Melen

Some steps you can reference:

Connect your PC directly to a port on the switch (e.g., Port 1) and log into the Web GUI (default is 192.168.1.1 or via setup.zyxel).

Part A: Create the Static VLAN Groups

Go to SWITCHING > VLAN > VLAN Setup > Static VLAN and click Add/Edit to create each VLAN:

VLAN 10 (MGMT):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Ports 6, 7, 8 (APs): Set to Fixed and uncheck Tx Tagging (Untagged).
• Click Apply.

VLAN 20 (HOME):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Ports 1, 2, 3 (PC/NAS): Set to Fixed and uncheck Tx Tagging (Untagged).
• Ports 6, 7, 8 (APs): Set to Fixed and check Tx Tagging (Tagged) — needed for your SSID VLAN mapping.
• Click Apply.

VLAN 30 (IOT) & VLAN 40 (GUEST):

• Follow the same logic: Trunk/SFP Port 17 is Fixed + Tagged. AP Ports 6, 7, 8 are Fixed + Tagged. End-user device ports are Fixed + Untagged.

VLAN 50 (SURVEILLANCE):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Port 16 (NVR): Set to Fixed and uncheck Tx Tagging (Untagged).

Part B: Configure PVIDs (The "Default" Untagged VLAN)

Go to SWITCHING > VLAN > VLAN Setup > VLAN Port Setup:

• Ports 1, 2, 3: Set PVID to 20.
• Ports 6, 7, 8: Set PVID to 10 (this ensures the AP's own management traffic sits on VLAN 10).
• Ports 9, 10, 11: Set PVID to 30.
• Ports 4, 5, 12, 13, 14, 15, 18: Set PVID to 40.
• Port 16: Set PVID to 50.
• Port 17 (Uplink): Leave PVID as 1 (or matching your OPNsense native management VLAN).
• Click Apply.

Step 3: Move the Switch Management Interface to VLAN 10

Once your VLANs are defined, you can assign the switch’s management IP address to VLAN 10:

1. Go to SYSTEM > IP Setup > IP Setup and click Add/Edit.
2. Set the VID to 10.
3. Set the IP address (e.g., 172.16.10.2) and subnet mask (e.g., 255.255.255.0).
4. Click Apply.

(At this point, you will lose connection to the switch if your PC is still in Port 1. To regain access, move your PC's ethernet cable to one of the AP ports (6, 7, or 8) or configure a port temporarily on VLAN 10 to finish saving).

1. CRITICAL STEP: Once you verify you can access the switch on its new IP, click the Save button (usually a floppy disk icon in the top right corner of the GUI) to ensure settings persist after a reboot.

Zyxel_Melen

Hi @MR308w

In the first vlan setup page i got the options normal, fixed and forbidden and the possibility for tx tagging each port.

This part is to set up the static VLAN table, and the egress behavior for each VLAN and ports.

The other page is with pvid, trunk and ingress check.

This part is to set up the ingress behavior.

• The pvid setting is for the incoming packets without VLAN tag.
• Trunk setting is for switch to handle/forward the unknown/non-static VLAN packets.
• Ingress check setting is for accept the packets from any VLAN that this port is not a member.

Hint:

• The port to network device like AP and OPNSense, need to be tagging.
• The port to end device like PC, need to be untagging/unselect tagging and set PVID to the VLAN you want to assign, like VLAN 20.

For more details, you may reference this FAQ:

Tutorial of Switch VLAN Configuration (V4.80 and newer) — Zyxel Community

Zyxel_Melen

Some steps you can reference:

Connect your PC directly to a port on the switch (e.g., Port 1) and log into the Web GUI (default is 192.168.1.1 or via setup.zyxel).

Part A: Create the Static VLAN Groups

Go to SWITCHING > VLAN > VLAN Setup > Static VLAN and click Add/Edit to create each VLAN:

VLAN 10 (MGMT):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Ports 6, 7, 8 (APs): Set to Fixed and uncheck Tx Tagging (Untagged).
• Click Apply.

VLAN 20 (HOME):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Ports 1, 2, 3 (PC/NAS): Set to Fixed and uncheck Tx Tagging (Untagged).
• Ports 6, 7, 8 (APs): Set to Fixed and check Tx Tagging (Tagged) — needed for your SSID VLAN mapping.
• Click Apply.

VLAN 30 (IOT) & VLAN 40 (GUEST):

• Follow the same logic: Trunk/SFP Port 17 is Fixed + Tagged. AP Ports 6, 7, 8 are Fixed + Tagged. End-user device ports are Fixed + Untagged.

VLAN 50 (SURVEILLANCE):

• Port 17 (Uplink): Set to Fixed and check Tx Tagging (Tagged).
• Port 16 (NVR): Set to Fixed and uncheck Tx Tagging (Untagged).

Part B: Configure PVIDs (The "Default" Untagged VLAN)

Go to SWITCHING > VLAN > VLAN Setup > VLAN Port Setup:

• Ports 1, 2, 3: Set PVID to 20.
• Ports 6, 7, 8: Set PVID to 10 (this ensures the AP's own management traffic sits on VLAN 10).
• Ports 9, 10, 11: Set PVID to 30.
• Ports 4, 5, 12, 13, 14, 15, 18: Set PVID to 40.
• Port 16: Set PVID to 50.
• Port 17 (Uplink): Leave PVID as 1 (or matching your OPNsense native management VLAN).
• Click Apply.

Step 3: Move the Switch Management Interface to VLAN 10

Once your VLANs are defined, you can assign the switch’s management IP address to VLAN 10:

1. Go to SYSTEM > IP Setup > IP Setup and click Add/Edit.
2. Set the VID to 10.
3. Set the IP address (e.g., 172.16.10.2) and subnet mask (e.g., 255.255.255.0).
4. Click Apply.

(At this point, you will lose connection to the switch if your PC is still in Port 1. To regain access, move your PC's ethernet cable to one of the AP ports (6, 7, or 8) or configure a port temporarily on VLAN 10 to finish saving).

1. CRITICAL STEP: Once you verify you can access the switch on its new IP, click the Save button (usually a floppy disk icon in the top right corner of the GUI) to ensure settings persist after a reboot.

MR308w

That is almost the same I did setup earlier on my switch, I also checked port 17 to trunk in step B.

Did try it again step by step but as soon as i click apply after finishing part B i get locked out.

Didn't know to get access trough port 6 but it seems like it doesn't work not trough putting in the ip nor by using the setup.zyxel.

Then i did try to leave port 4 on pvid 1 and i got acces since it still all is on the x.x.1.x network.

I can save but as soon as i change the IP address i got locked out again without the possibility to acces on either of the ports. Also the default DHCP asking ip is impossible to remove, I only can create another one.

PeterUK

Not used OPNsense or how your setup is done so I take it from OPNsense its just one cable two the switch? you have setup Tagged VLAN subnets on OPNsense not just the one subnet?

From what I can tell OPNsense and switch are on 192.168.1.0/24 but you don't what your PC on the same subnet so that means you can't directly connect to the switch you should be able to allow your PC on 192.168.20.0/24 to route by OPNsense to switch but could be a case where that this does not work?

MR308w

Opnsense is on 176.16.1.1 and all devices are there momantary, the switch will also be on the MGMT vLAN 176.16.20.2 afterwards.

OPNsense has the 5 vLAN interfaces setup and also the DHCP server for each of the ranges, I put also Mac based Host configs for the devices i want to have a static IP.

PeterUK

If you have a spare port on your Opnsense set that up with its own subnet not tagged and connect a PC to then try to access the switch.

MR308w

Managed it in the end, it was a combination of the switch setup that I got thanks to Zyxel_Melen and 1 setting in OPNsense. Learned a lot and thanks to all that gave me help!