22
Votes

[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets

 
22
Votes

[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets

17 Reply
Re:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets
2024-04-02 02:40:15

Sounds like this one is hard set to use an Omada controller. I also don't want to leave native VLAN untagged in some cases. Help tip says if receiving untagged frame it inserts the tag and forwards frame to native VLAN. This seems to be the case using a Ubiquiti AP since I cannot tag it without some trouble. Other scenario where I have an ESXi host connected to multiple VLANs, I want to tag the native VLAN also. As a workaround, I've create some VLANs labelled VOID that isn't connecting to anything but would like to remove that altogether. 

 

I am trying out the docker Omada image but probably going to roll this one out and not bother with the controller for now. Any future option to allow some flexibility here? 

#12
Options
RE:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets
2024-09-24 17:32:49
Most definitely needed! We Need to be able to properly trunk using only tagged vlans!!
#13
Options
RE:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets
2024-09-27 14:33:02
definitely voting for this. even the super basic easy-smart switches can do this.
#14
Options
RE:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets
2024-10-07 16:11:39
Native VLAN has no utility in full marked VLAN network, in this case this is a security issues
#15
Options
Re:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets-Solution
2024-10-14 08:56:46 - last edited 2024-10-21 01:54:19

Hi @JoeSea and others,

JoeSea wrote

Add to Omada control the ability to tag the native VLAN.

Add to Omada the option to ignore untagged packets received on a port or unselect native network from the untagged setting.

Regarding the native VLAN, it is forced to do this as it is an industry standard. We have no intention to change this. Native VLAN has been explained on the page and it is unequivocally untagged.

 

About the ignore untagged packets on the port which may cause security concerns, you can still use the CLI template to enable it Acceptable Frame Types. We will consider optimizing this in future firmware updates.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update!Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
#16
Options
Re:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets
2024-10-19 16:20:24

To configure this, do we just need to add the following commans per ports in the CLI template like this ?

 

#
interface gigabitEthernet 1/0/41
  switchport acceptable frame all

 

#
interface gigabitEthernet 1/0/43
  switchport acceptable frame tagged

#
interface gigabitEthernet 1/0/45
  switchport acceptable frame tagged

#
interface gigabitEthernet 1/0/47
  switchport acceptable frame tagged
 

 

---OR---

 

Do we have to include all the applicable port parameters like this?

 

#
interface gigabitEthernet 1/0/41
  switchport general allowed vlan 6-7 tagged
  switchport acceptable frame all
  lldp med-status
  loopback-detection config process-mode port-based recovery-mode auto
  loopback-detection

#
interface gigabitEthernet 1/0/43
  switchport general allowed vlan 10-11 tagged
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  lldp med-status
  loopback-detection config process-mode port-based recovery-mode auto
  loopback-detection

#
interface gigabitEthernet 1/0/45
  switchport general allowed vlan 100,1000 tagged
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  lldp med-status
  loopback-detection config process-mode port-based recovery-mode auto
  loopback-detection

#
interface gigabitEthernet 1/0/47
  switchport general allowed vlan 1010-1011 tagged
  switchport general allowed vlan 1020 tagged
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  lldp med-status
  loopback-detection config process-mode port-based recovery-mode auto
  loopback-detection

#17
Options
Re:[Request] Omada - VLAN tagging of Native Network - Ignore untagged packets-Solution
2024-10-20 11:27:38 - last edited 2024-10-21 01:53:01

For anyone wondering, i got this working perfectly with the below CLI template applied to core switch

 

Now i have multiple uplink ports to my gateway without any faff!

 

Step 1

- Uplug all links to gateway except a port carrying management vlan ONLY

 

Step 2

 - create and apply switch profiles to the ports you want as uplinks to your gateway

 

Port 39 is VLAN 1 (management) uplink, set as VLAN 1 native/untagged only using a normal switch profile

Port 41 are tagged only uplink for VLANs 6-7, with an initial switch profile of 1 native, 6,7 tagged, set in GUI

Port 43 are tagged only uplink for VLANs 10-11 with an initial switch profile of 1 native, 10,11 tagged, set in GUI

Port 45 are tagged only uplink for VLANs 100-1000 with an initial switch profile of 1 native, 100,1000 tagged, set in GUI

Port 47 are tagged only uplink for VLANs 1010-1020 with an initial switch profile of 1 native, 1010,1011,1020 tagged, set in GUI

 

After the switch profiles were applied, i added and activated the following CLI template on my core switch.

 

Step 3

- CLI Template

 

The below template removes VLAN 1 (my management vlan which is untagged and native on the gateway ports) for all the uplink ports I want to carry tagged vlans only, and sets them as tagged only ports on the switch.


*****CLI TEMPLEATE*****

 

#
interface gigabitEthernet 1/0/41
  no switchport general allowed vlan 1
  switchport acceptable frame all
  switchport check ingress

#
interface gigabitEthernet 1/0/43
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  switchport check ingress

#
interface gigabitEthernet 1/0/45
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  switchport check ingress

#
interface gigabitEthernet 1/0/47
  no switchport general allowed vlan 1
  switchport acceptable frame tagged
  switchport check ingress

 

***** END TEMPLATE *****

 

Recommended Solution
#18
Options