Basic VLAN help

[stevenahmet]

Hi,

I've got 4 x ERS5510-48T's stacked together (running 6.3.2.011) on Level 5 of our building.
I've got 2 x ERS5510-48T's stacked together (running 6.3.2.011) on Level 6 of our building.

They are connected together by an MLT using ports 47-48 on both switches.

Up until now, it's all been one (default) VLAN, with a 10.5.0.0/16 network.

We have purchased another company and we are bringing in their computers/servers etc. We want to keep them logically separated for now and we will look at merging them in early next year. They are currently using 192.168.100.0/24.

I wanted to put them on a separate VLAN and have them connect to a separate port on our Watchguard firewall.

I've done all the reading I can, but when it comes to putting it all together, I'm lost.

At the moment I'm just testing with one computer.

Created VLAN 20 on the switch.
Assigned VLAN 20 to port 9 and removed VLAN 1 from this port. This port is directly connected to the port on our Watchguard.
Assigned VLAN 20 to port 24 and removed VLAN 1 from this port. This port is connected to a computer. Computer is 192.168.100.254/24 with a gateway of 192.168.100.1.

I've created an interface on the Watchguard which is assigned to VLAN 20, with an IP address of 192.168.100.1. (I'm still not sure if I've configured this right yet - I will probably need to chat to people on the Watchguard forums for this).

At the moment, from the Watchguard, I can't ping the computer, and from the computer, I can't ping the Watchguard.

I just wanted to check if there was something basic I might've missed on the Nortel side, and to double-check how the ports should be configured in terms of tagged/untagged etc.

Worse case scenario is that everyone will be on the same broadcast domain until I can work it out, but I'm hoping I can get it working before they get in, (this weekend).

Any assistance is greatly appreciated.
Thanks.

Steve

[Paul L]

as a test make VLAN 20 the mgmt vlan and assign it an ip address of 192.168.100.5.  see if you can ping around.

[stevenahmet]

Thanks Paul. I actually got this to work. I think it was because I had the switch port that was connected to the firewall as untagged. Once I set it to tagged, everything came up. Possibly I may not have had the PVID set correctly either. Everything has been so chaotic at the moment, that my testing was not as methodical as I would've liked.

I have another question though. In regards to the switch stack I have on Level 6. There will be a couple of users who will need to be in VLAN 20. How do I configure the ports for the MLT between floors. Should they be members of both VLAN's? Should they be tagged/untagged?

Thanks.

Steve

[Paul L]

You will need to tag the MLT ports.  Then add VLAN 20 to those ports.


vlan ports <port range> tagging tagall
vlan members add 20 <port range>

[stevenahmet]

Thanks for your help Paul. It's all working great.