Vlan1 On Primary LAN Interface

Options
1246

All Replies

  • PeterUK
    PeterUK Posts: 4,185 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    ALL VLAN on USG are tagged only.

    Why is it so hard to test with a laptop/PC with NIC set to the given VLAN on USG to get that to work?

  • PeterUK
    PeterUK Posts: 4,185 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Maybe I should explain

    A untagged packet has no VLAN tag in the packet there is no sure thing as a packet marked as a VLAN that is untagged

  • dcgtechnologies
    dcgtechnologies Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary
    edited October 12

    Peter I know this already and if you knew all this why didn’t you make it apart of your process instead of throwing things at the wall to see what sticks. I like complete processes and not parts of it. Hence the reason why I asked if this was documented anywhere and worn out with proving your process on the fly. I wasted an hour and half when doing the first part of your process to find out it did not work and I had to rollback. Put yourself in the other persons shoes for once and provide complete clarity and transparency.

    The issue lays within the routing of the Interface Vlan10 profile. It clearly worked within my internal network along with connecting all my vlans together for passing traffic internally only and did not let me get past the internal Vlan10 to get out to the internet so my switches work fine as they are doing what they have programmed into them, but now all the routing is missing in the Vlan10 profile and I do not want to go through another “testing” phase with something you think will work. That is why hooking up a laptop is a waste of time and causes me unnessary work.

    Again I am not challenging your knowledge and I do appreciate the help, but your approach is little much and well needs to be better so I do not waste anymore time in trying to see what works especially when rule sets are already there in place.

    So now we know vlans do not do routing and all they do is seperate networks / traffic. So what does the LAN1 default zone profile have for routing that the Vlan10 profile is missing. That is the question.

    Thank you.

  • PeterUK
    PeterUK Posts: 4,185 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    I suggest putting a case on

    Zyxel Support Campus EMEA

  • dcgtechnologies
    dcgtechnologies Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary

    I was planning on it anyway as you can not tell me why. Thank you.

  • Zyxel_Melen
    Zyxel_Melen Posts: 4,070 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @dcgtechnologies

    I quick read this thread, it seems like the LAN 1 interface and VLAN 10 interface using the same IP address. This will cause issue on routing part and packet forwarding part (which VLAN should the firewall tag?). Please change the LAN1 interface "Address Assignment" to unassigned.

    Zyxel Melen


  • dcgtechnologies
    dcgtechnologies Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary

    Hello…..Thank you for the information, but I just want to make sure this is for sure the correct information as I want the newly created Vlan10 interface to be the primary interface to route all traffic for all my VLANS that LAN1 used to handle. Thank you.

  • dcgtechnologies
    dcgtechnologies Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary

    To conclude this post. The LAN1 interface is on VLAN1 natively and if you create VLAN10 as an Interface it will only send tagged traffic period. It will NOT send tagged and untagged traffic. So you are limited on what you can do with this device. Cisco allows tagged and untagged traffic on there devices / switches and gives the flexibility to shutdown VLAN1 as it is a bad security practice to use the default VLAN1 for passing traffic whether it is tagged or untagged. This post can be closed.

  • PeterUK
    PeterUK Posts: 4,185 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    By all means config your switch with VLAN 10 untag all port but one set all ports to PVID to 10 but the one then you can only access that switch on that port only if you want the the switch on VLAN10 you config Management to VLAN10 then change to another port and you can access the switch again then you can change that last port to VLAN 10 with PVID 10.

    Now your network will no long use VLAN1 only VLAN 10 untagged

  • dcgtechnologies
    dcgtechnologies Posts: 56 image  Ally Member
    First Comment Friend Collector Seventh Anniversary
    edited October 23

    @PeterUK I worked with Zyxel America. It does NOT support Tagged and Untagged traffic using the VLAN10 profile and that profile only supports tagged traffic. You have to keep the VLAN1 for tagged and untagged traffic under the LAN1 profile. PERIOD. Cisco supports sending tagged and untagged traffic through the VLAN10 trunk and access ports, but Zyxel does not support this. Proven it and no need to comment further as a lot of time has been wasted on this. Thank you.