EAP245 VLAN Problems
This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Hi All,
I fear the solution is staring me in the face but I am a little stuck so here goes.
I recently replaced my WA701ND AP for an EAP245 after it died. The WA701 had 2 SSIDs with associated vlans to provide serperation. The AP was connected to a TPLink SG2109 which was then in turn connected to another TPLink SG switch (16 Port Switch) for onwards connection to a firewall and router. The vlans are split out on the 16 port switch and presented to the firewall on two individaul interfaces. The firewall acts as a dhcp server for each vlan and controls traffic flow. A third interface on the firewall connects the ADSL router to the internet. The setup worked really well until i replaced the WA701 with the EAP.
I am using the EAP in stand alone mode with no controller. I have configured it with the same SSID and VLAN details and wired it into the network in the same way. I can connect to the AP but do not get any DHCP assigned addresses, if i put in a manual address this does not route. If I remove the VLAN assignment for the SSIDs within the AP then i get dhcp addresses assigned and everything works, however both SSIDs are now on VLAN 20 as per diagram which provides no seperatation.
Heres a view on the setup - can some one help to fix this problem?
Thx
BOOM! obvious when you think it about - just stopped thinking about it!!
Following your advice I have gone back to basics to ensure that the access ports are exactly one member of one vlan + untagged and the PVIDs align.
Everything is now working as it should - a big thank you for you help 
I tried what you have suggest and it made no difference.
Given the installationa is a good few years old - I have spent the last few hours redoing all the settings, tracing all the cables to ensure everything is plugged together as 'I think it should be' and I have also factory reset the switches. I have updated the diagram as you were correct there are a couple of typos and have provided the 16 port switch config as well for the VLANs.
Here is what I have found out:
- On the 8port switch I have to bind VLAN 1 to ALL ports else I cannot connect to any services on the main 16Port switch when jacking into the ports
- VLAN20 and VLAN100 are tagged accoding to the 8Port switch table, if they are not tagged then nothing works - setting the untag frame to pass or drop makes no difference
- Assigning any PVID value to any of the ports makes no difference - also - setting the 'egress frame' to pass or drop also makes no difference for any port...
- On the 16Port switch I need to bind ports 5,14 & 15 to VLAN 1 to enable the 8Port switch to utilse services connected to the main 16Port switch
- VLAN20 and VLAN100 are tagged accoding to the 16Port Switch table, if they are not tagged then nothing works when hjacking directly into the ports - setting the untag frame to pass or drop makes no difference
- Assigning any PVID value to any of the ports makes no difference - also - setting the 'egress frame' to pass or drop also makes no difference for any port...
- The EAP245 does not connect with this setup for any SSID tagged with either VLAN 20 or 100, or any other VLAN id - no DHCP or routing.
- If I disable the VLAN tagging for an SSID (system sets it to zero) then it connects by default to VLAN 20 and it works; incidentally I have set the PVID, VLAN to everything but VLAN20 and removed all reference to VLAN20 on this port and it still defaults to VLAN20 in this case?!?!?!
I understood your thinking in your response and it makes logical sense, but when applied it does not seem to work for my setup ?!?!?
I welcome any additonal thinking on this!
Here is the updated diagram for both switches and includes the additional settings etc, btw you asked what the 'egree frame' is here is the help file from TPLink on their definition:
Egress Frame The solution to the egress frame."Drop Tag" indicates drop the tag header before sending the frame."Add Tag" indicates add the tag header before sending the frame."Unmodify" indicates do not modify the tag header before sending the frame.');
sorry, I'm not used to this particular switches, I even could not find specs or datasheets for them on the TP-Link website. Are this older switches?
I use business-class JetStream switches only and they don't have the notion of »add«, »drop« or »unmodify« egress rules. Frames in a managed switch are always tagged, no matter whether the arrive or leave the switch untagged. So, to force untagged frames on egress in a JetStream switch, a port is just an untagged member of the corresponding VLAN. If frames should carry the tag on egress, they are defined to be a tagged member of a VLAN.
I still don't get what »unmodify« means compared with »add«, since every frame inside the switch always has a tag and it can be either removed (untagged port = drop) or left intact (tagged port = add? unmodify? I don't know.).
This is the topology I use for VLAN-tagged Multi-SSIDs:
Try to implement this in your TL-SG2xWEB switches. Replace the router's trunk port P3 shown above by the two ports your firewall provides, e.g. your VLAN network starts at the main switch (not in the router/firewall as shown above) and will eventually become terminated either in the secondary switch (for unatgged frames) or in the EAP (for tagged frames).
Note that I don't use a »Default VLAN« or »Native VLAN« which was introduced an eternity ago to help with migration of non-VLAN-aware devices in VLAN-aware networks. My networks are always using VLAN-tagged frames from the router to the connected device ot at least to the switch's access port (which is defined as »a port which is member of exactly one VLAN and has egress rule untag«). Thus, inside my VLAN networks there is no such thing as an untagged frame.
You can use Default VLAN 1 if you want. But then I would assign the main SSID to this VLAN 1, too, and only assign the second SSID you want to isolate from the main network to VLAN 100. Else you have three networks (1, 20, 100) on two firewall ports – maybe this is the cause of your DHCP problem.
The new Jetstreams have arrived, T2500G-10TS & T2600G-28TS they are in and configured and the EAP is talking nicely now with multi SSIDs over VLANs - success!!! In my last post I was suspecting that the switches where the source of the problem but could not prove it, it seems that the original 8 port websmart switch was causing the vlan issues, upto yesterday when I switched it out it had frozen at least a dozen times since the weekend, i guessing it has a PSU fault - with hindsight its the right move to swap out the devices.
One step forward and half a step back....
The network is up and running, wifi access is working but theres a couple of new challenges specific to VLAN2 - the other VLAN is working correctly - I think the problems are switch config related - here is what is happening;
- When connected to Switch 1 VLAN2, I can connect to devices on both Switch 1 and Switch 2 VLAN 2 - and vice versa - this is correct behaviour, onto the problems...
- I connect to Switch 1 VLAN2 and manage it via IP BUT cannot connect to or manage Switch 2 - but when I connect to VLAN 1 on Switch 1 I can manage both devices.
- I can connect to Switch 2 VLAN2 and manage it Switch 2 via IP - I can also manage both devices via IP on VLAN1
- When connected via the AccessPoint I can access devices on Switch 2 but cannot access devices on Switch 1 (VLAN 2).
I think its how I have configured the tag/ untag on the vlans - but I cant figure out?!?!?!
Thoughts welcomed
I have taken the oppurtunity to update the network heres the updated diagram
BOOM! obvious when you think it about - just stopped thinking about it!!
Following your advice I have gone back to basics to ensure that the access ports are exactly one member of one vlan + untagged and the PVIDs align.
Everything is now working as it should - a big thank you for you help