VLAN - basics for a newbie [Solved]

[PM_13]

Hi,

I just started with VLAN and can use some help with basics. Here is my pfSense configuration:

WAN
LAN-1
LAN-2
LAN-3
LAN-5 (runs a static IP subnet of 192.168.5.0)

On LAN-5 I created an interface 55VLAN (tag: 55) and enabled it with DHCP server

I am using a 8-port Trendnet managed switch, on this device I did following:

1. Port-1 of managed switch is connected to LAN-5 of pfSense with cable
2. On switch created a VLAN with tag 55 using Port-2 of the switch
3. Added Port-1 to VLAN55 (as Static tagged)
4. Added Port-2 to VLAN55 (as Static Untagged)

The good news is that above arrangement is working fine & client machine connected to Port-2 of switch got a 192.168.55.x DHCP lease......bravo 2020 was not a lost cause after all

Now my question where I am getting confused due lack of in-depth knowledge.
If I create another VLAN on switch say 33VLAN and use Port-1 as Static Tagged and Port-3 as Static Untagged.

Question: Is there a way for packets that are coming from switch port-3 (with tags 33) to be transferred from LAN-5 port of PfSense to LAN-3 port where I could run another VLAN with 33 tag?

I tried it but it did not work and I just want to know two things:

1. Is this even doable?
2. If yes then few pointers would be welcome!!

Thanks!!

[JKnott]

@pm_13

Traffic will not pass between VLANs, unless appropriate routing has been set up. You'd have to configure pfsense to route between 1 & 5.

[PM_13]

@jknott Thanks for your input.

Please see this topology that I think will solve the problem for my home network:

🔒 Log in to view

Right now it is not working for me but based on my rudimentary understanding of VLANs, this topology should be working. Please correct me if I am wrong with my assumption or have incorrect understanding of VLANs.

Apologies for the handwritten diagram but I was struggling to explain it in words.

[PM_13]

I got the above topology to work so got my answer!!

VLANs are great, suddenly network topology seems more practical than even before

[johnpoz]

You should move one of the managed switches to where you have that unmanaged switch... It's fine to use a dumb switch downstream of a managed switch when all devices on the dumb switch are in the same vlan.

I would not do it how you have it..

[PM_13]

@johnpoz thanks for excellent suggestion. It would also nip the problem in bud i.e how to confine IoTs to its own LAN.

As I am configuring VLANs is there a good way to document details? I am not a network guy and just curious what professionals use to manage documentation for the network.

Thanks for again for a very useful tip, have a great new year and happy 2021!!!

[johnpoz]

I would draw up your network with all the details on it. Even if its just a hand drawing like you have posted.

You can get really fancy with something like visio.. I should really post up a pic of one of works DCs lan diagrams ;) have to pull out all the details before I could post it - but could be an interesting look for some.. But there are plenty of different software packages to help you maintain an diagram for from free to thousands of dollars.

For IP management there are many different tools.. With differing budgets.. We use BT Diamond IP to manage IP space in the DC and different customers networks. But could be as simple as notepad doc..

For my home network there really isn't much documentation because its only 8 vlans and all the ports in my managed switched are labeled in the switch software, etc. And keep in simple for vlan IDs where they match up with the 3 octet of the IP space being used.. For example one of my vlans is 192.168.6/24 - guess what the vlan ID is ;) 6

If you really want to get fancy, you might want to look at something like https://github.com/netbox-community/netbox

And its FREE ;)

[PM_13]

@johnpoz Excellent tip!!!

"For example one of my vlans is 192.168.6/24 - guess what the vlan ID is ;) 6"

I am convinced that I will forget the VLAN IDs (even more so if it works properly) but I will likely have IP subnets etched in my brain so using subnet seems like a practical way to remember VLAN ID.

Thanks!

[bingo600]

@johnpoz said in VLAN - basics for a newbie [Solved]:

If you really want to get fancy, you might want to look at something like https://github.com/netbox-community/netbox

And its FREE ;)

Nice one ...

[PM_13]

Since starting this thread, I have become little mature

The challenge with handwritten topology is that anytime you change details it might mean starting from scratch. The links are useful and I am amazed that there are services making money offering IP management, well make sense when you are running a large network.

I found that writing things in a spreadsheet (not Word) is good enough for small networks like a home lan. It is easy to use a cell as a port (for diagram) with option to color code and use the zoom or resize feature to type in notes or tables!!!

[bingo600]

@pm_13

I'we been glaring at Dia , for a non Visio package
https://wiki.gnome.org/Apps/Dia

Seems to be usable , but nothing beats Visio.

Untested by me :
Shapes for libreoffice
https://www.vrt.com.au/downloads/vrt-network-equipment

Prob ends up costing a few $
https://www.lucidchart.com/pages/visio-linux-alternative

Another
https://opensource.com/life/14/6/tools-diagramming-fedora

[bingo600]

5 minutes in dia
It does have some usefull shapes that we all know.

🔒 Log in to view

[PM_13]

@bingo600 Is this GNS UI?

If so then I overlooked it as an option and might be worth reviewing again.
Thanks

[bingo600]

@pm_13

Nope

It's dia (diagram writer) - on a linux Mint
https://wiki.gnome.org/Apps/Dia

apt install dia

[johnpoz]

@pm_13 said in VLAN - basics for a newbie [Solved]:

I am amazed that there are services making money offering IP management

When you have 1000's of networks to manage, yeah you really need something other than a spreadsheet ;).

There are many an options for sure - many are pretty freaking pricey if you ask me ;)

If you have a windows 2016 server in your network - MS added IPAM..

If just wanting ipam - another pretty well rounded tool for free is https://www.gestioip.net/

[cburbs]

@pm_13 For drawings you could also try the following.
https://online.visual-paradigm.com
https://app.diagrams.net/

[PM_13]

@cburbs , @johnpoz & @bingo600 for all the suggestions!

I ended up using LibreOffice Draw, the start was clunky but once I got the hang of its drawing toolbar it became a breeze. Also realized that by documenting details, it took that extra level of time and scrutiny made me think through the topology functionally and not use my standard "do first then think later" approach

It is also easy to edit and make changes so for a free solution and a simple network like mine it worked out great, here is a blurred screenshot for your delight!!!

🔒 Log in to view