We have a unsecure ISP connection, which have to go through 3 powerconnect 2716 switche, to get to the server, but on the 3 switches there is a lot of clients.
Then we got the idea that we could use vlan, so none of the clients where is on the 3 switche can use the unsecure connection from our ISP but only the secure connection from the server.
How can we do this, we have really tried a lot of things.
- pick 2 ports on each switch to be 'unsecured'. (for example ports 1 and 2)
- put these ports in a different different untagged vlan (for example vlan 100)
- set the port vlan of these 2 ports to be vlan 100 also.
- connect switches like this: internet->switch 1 port 1, switch 1 port 2-> switch 2 port 1, switch 2 port 2 -> switch 3 port 1, switch 3 port2 -> server unsecured network interface
- this will connect your unsecured internet to your server.
- you could now also connect the switches like this: switch 1 port 16 -> switch 2 port 15, switch 2 port 16 -> switch 3 port 15, switch 3 port 16 -> server SECURED network interface
- this will connect all your clients to the secure interface of the server.
- you will have to run some kind of routing firewall on your server and configure it to route between the network interfaces if the clients are going to be able to access the internet through it
Sure. You can use a single port to connect the switches. Here is an example using vlans 100 and 80:
- There are 2 vlans 100 for internet access, 80 for secured lan
- set switch 1 port 1 to be untagged in vlan 100 and port vlan to 100 and set switch 1 port 16 to be tagged in vlan 100 and 80, set all other ports to be untagged in vlan 80 and port vlan of 80
- on switches 2 and 3 set ports 15 and 16 to be tagged in vlans 100 and 80, set all other ports to be untagged in vlan 80 and port vlan of 80
- connect switches like this: internet->switch 1 port 1, switch 1 port 16-> switch 2 port 15, switch 2 port 16 -> switch 3 port 15, switch 3 port 16 -> server network interface.
- configure server to accept tagged packets in vlans 100 and 80.
- you will have to run some kind of routing firewall on your server and configure it to route between the vlans if the clients are going to be able to access the internet through it
Unfortuanately, this switch is only manageable on vlan 1. To answer your question, you cannot change all your PVIDs to 80/100 and still be able to manage the switch. You will have to have at least one port that is a member of vlan 1 for management.
bh1633
909 Posts
503
0
Posted June 18th, 2009 14:00
at a high level,
- pick 2 ports on each switch to be 'unsecured'. (for example ports 1 and 2)
- put these ports in a different different untagged vlan (for example vlan 100)
- set the port vlan of these 2 ports to be vlan 100 also.
- connect switches like this: internet->switch 1 port 1, switch 1 port 2-> switch 2 port 1, switch 2 port 2 -> switch 3 port 1, switch 3 port2 -> server unsecured network interface
- this will connect your unsecured internet to your server.
- you could now also connect the switches like this: switch 1 port 16 -> switch 2 port 15, switch 2 port 16 -> switch 3 port 15, switch 3 port 16 -> server SECURED network interface
- this will connect all your clients to the secure interface of the server.
- you will have to run some kind of routing firewall on your server and configure it to route between the network interfaces if the clients are going to be able to access the internet through it