VLAN On USG 40W

ice2921
ice2921 Posts: 7
First Anniversary First Comment
edited April 2021 in Security

Hello,

I have a simple question but for some reason I cant get it to work. Basically I have a usg40w firewall and I need to have two separate networks. I have LAN 1 working on interface P2 of the firewall, and now I need to add a second, separate network. I was hoping to use VLANs for this as I only have one switch between the two networks, meaning both of the firewall LAN interfaces are plugged into ports on the switch. My question is what is the best way to have achieve this? Do I pass the VLAN from the firewall to the switch or the other way around. I apologize if I am over complicating this.

Accepted Solution

All Replies

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,426  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @ice2921

    You can create a Vlan interface base on port 2 of USG40W, in this way, traffic can be separated into two network.

    For USG, it just only need to create a Vlan interface, most settings is on switch.

    Are you using zyxel's switch? Let me know if you encounter any issue on vlan settings of switch.


    Create a Vlan interface on “CONFIGURATION > Network > Interface > VLAN”


  • ice2921
    ice2921 Posts: 7
    First Anniversary First Comment

    Thats what I thought that I did and I believe my switch is configured correctly. Below is my current configuration on the USG:

    On my switch I noticed that when i plug in my laptop to the port I configured for VLAN 200 it gets an ip address on the 192.168.2.X network.




  • PeterUK
    PeterUK Posts: 2,651  Guru Member
    First Anniversary 10 Comments Friend Collector First Answer

    Do you have a VLAN switch or is it just Unmanaged?

    When you connect your laptop to the port where VLAN200 is you will get 192.168.2.X because your laptop NIC is not set with a VLAN200 it is running untagged.

  • ice2921
    ice2921 Posts: 7
    First Anniversary First Comment

    switch is managed - hp procurve 2810-48g. Should I change the switch to tagged? Right now its untagged.

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,426  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @ice2921

    You can capture packets on USG Vlan200 interface. 

    Assume the switch set up correctly, you should be able to see the packets coming to USG vlan200 interface.

    Packet trace CLI

    Router> packet-trace interface vlan200 extension-filter -e -n

Security Highlight