VLAN Seperation

VCS
VCS Posts: 19  Freshman Member
First Comment Third Anniversary
in Switch

At this moment I have a GS1900 which I use between the router and the ISP (WAN).

Port 1 is connected to the WAN containing ethernet traffic as weel as VLAN 4 for IPTV. Port 2 is connected to my router.

What I want is the the ISP comes in on P1, distribute to P2 (router) and send all vlan 4 traffiic to port 2 till 8 .

Other ports 9 till 24 are in use for local lan (VLAN 100)

But somehow I see DHCP traffic comes in from a mac address (which is inside local LAN) what I'm not expecting.

Port 1 is from the ISP port 2 is going to the Router (WAN Side)

image.png

From router back to LAN segment on port 21:

image.png
image.png
image.png

image.png

VLAN 100 : Local LAN segment

image.png

What's is wrong. I would not expect to see any DHCP (broadcasts) from my local LAN devices.

As you can see in the wireshark. IP address 192.168.0.3 is my local LAN but still receives this on Port 1 (I mirrored port 1 and 2 to 10).

image.png

What I'm doing wrong?

Johan

Accepted Solution

  • VCS
    VCS Posts: 19  Freshman Member
    First Comment Third Anniversary
    Answer ✓

    I thanks the issue is solved as pvid 1 was stille connected to port 10 which causes local lan traffic also arrives at port 10.

«1

All Replies

  • PeterUK
    PeterUK Posts: 3,262  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 28

    So what if you set Accept frame type on ports 1 and 2 to tag only?

    Because VLAN 4 have ports 0-8 tag and untag you will see broadcasts traffic

    If you can't do the above you need two more port in a VLAN to only allow a given MAC out to your ISP.

    or maybe you need to set VLAN4 port 1 to forbidden? not sure what VLAN2 is doing or maybe you only need to untag port 1 and 2 and forbidden the rest?

    .

    a drawing of your setup might help

  • VCS
    VCS Posts: 19  Freshman Member
    First Comment Third Anniversary
    edited September 28

    I want to have Routed IPTV as well as seperate port special for IPTV. IPTV uses VLAN ID =4 in my case.

    So, ISP comes in on P1 (P2 should get everything form P1) P3 till P8 only VLAN ID 4 for IPTV setup BOX.

    Port 9 till port 23 is for my local LAN.

    image.png

    So the router is hooked up twice to the switch but are in seperate VLANs so they should not interfere with each other. Now is the case that I see a DHCP request from PC (lets say Port 8) coming in on Port 1. Which should not be allowed. Vigor Is my router. Port 2 from the switch is connected to the WAN port of the router.

  • PeterUK
    PeterUK Posts: 3,262  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 28

    so is VLAN4 on the base port WAN of your router? is your ISP tag or untag

  • VCS
    VCS Posts: 19  Freshman Member
    First Comment Third Anniversary

    Sorry, forgot to mention.

    From the ISP I'm getting untagged Internet and tagged VLAN ID 4 for IPTV (2 streams , 1 internet orther IPTV).

    On my router I have configured a Virtual WAN with VLAN ID =4 :

    image.png

    If I look at the MAC table of Port 2, I do see 2 MAC addresses, which I would excpect, one for internet and the other for IPTV with VLAN ID = 4.

    image.png

    On Port 1 one I see 3, 2 for VLAN ID 4 what I also expect and one for the router.

    What I do not understand is why I see a DHCP request coming from a MAC address which is a device on the LAN network (VLAN ID 100).

    I hope it's clear what I how my setup works?

  • PeterUK
    PeterUK Posts: 3,262  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 29

    So does it happen on port 2 (not port 1) you see the DHCP requests from VLAN100 going out the WAN?

  • VCS
    VCS Posts: 19  Freshman Member
    First Comment Third Anniversary

    I see the request coming in on Port 2 (WAN side router). I would also expect to see a request being send out via port 1 (Internet) which would be a duplicate, right? . Because I mirror port 1 and 2.

    image.png

    The source mac is from the router.

    I'm getting from the ISP the ack coming from port 1

    image.png

    All of this looks like okay, only on teh GS1900 I see that the LAN Segment uses vlan ID 1 and not 100 but stil. VLAN 1 and VLAN 100 are not part of port 1 till 8.

    I'm using wireshark on an USB Gig Ethernet with a 169.254.168.254 IP address (default) and I see that a device on the LAN segment is sending a request and the router (192.168.0.1) send a offer (see the 2 below pictures). I would not expect this.

    image.png
    image.png

    Any explaination?

  • PeterUK
    PeterUK Posts: 3,262  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary
    edited September 29

    From what I can tell the switch is not at fault looks to be the router you are using not sure why its doing this.

    You could see if removing VLAN 4 on router stops it.


  • VCS
    VCS Posts: 19  Freshman Member
    First Comment Third Anniversary

    I have removed VLAN ID 4 on Port 2 (Forbidden) and rebooted the router after the change. But still see DHCP request coming from a LAN device which should not be possible.

    image.png

  • PeterUK
    PeterUK Posts: 3,262  Guru Member
    100 Answers 2500 Comments Friend Collector Seventh Anniversary

    Thats because its coming from your router

    If you was to mirror port 2 for ingress only you see its from your router at least thats what I think is happening.

  • Zyxel_Melen
    Zyxel_Melen Posts: 2,254  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @VCS,

    All of this looks like okay, only on teh GS1900 I see that the LAN Segment uses vlan ID 1 and not 100 but stil. VLAN 1 and VLAN 100 are not part of port 1 till 8.

    This is because the PVID you set is 1 but not 100. Since the clients' packets are untagged, the switch port VLAN ID is needed to classify the clients belonging to which VLAN.

    Could you check the MAC table on GS1900 for this MAC address "70:26:05:67:d2:43" to locate which port this client belongs to?

    Zyxel Melen

    Engage in the Community, become an MVP, and win exclusive prizes!


Categories

Switch Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）