SOLVED: Network segmentation failure

Follow

Nav

• August 23, 2022 20:07
• Edited

Hi, 

I am trying to set up VLANs on my Firewalla Gold, but it doesn't seem to be working.

I have port 4 connected to the ISP, Port 2 is wired to a TP-Link Omada switch. The AP is connected to the switch, as are some wired devices. I have multiple SSIDs on the AP, the goal is to set up a different VLAN for IOT devices and a different one for home computers. But I cannot get any devices to connect if I turn on VLAN to SSID mapping on the AP.
Best I can tell is the devices authenticate to the AP but then cannot obtain an IP address. If I remove the VLAN mapping from the SSID, then devices are able to connect and function normally.


My firewalla configuration is below:

And the SSID configuration is:

0

• 

  Firewalla

  • August 23, 2022 17:07

  try connect AP directly to firewalla without the switch and see if it works or not. Make sure the AP port connecting is a TAGGED port

  0

  Comment actions Permalink
• 

  Nav

  • August 23, 2022 17:21

  I will try that, but since I have multiple APs, I can't wire them all directly to the Firewalla. 
  
  Also, just to be sure, by tagged did you mean it is the blue checked port for the VLAN in the GUI?

   

  0

  Comment actions Permalink
• 

  Firewalla

  • August 23, 2022 17:39

  TAGGED means the port will carry all VLAN traffic. (it is also called trunk mode).

  The reason for you to try one AP is to ensure the configuration is correct. Meaning 

  1. Your switch port connecting to firewalla gold need to be in TAGGED or TRUNK 

  2. I think your switch AP connecting to should be in TAGGED or TRUNK

  3. Your port on the AP connecting to the switch need to be in TAGGED or TRUNK

   

  0

  Comment actions Permalink
• 

  Nav

  • August 23, 2022 17:50

  Thank you! How do I confirm that the port is TAGGED?

  0

  Comment actions Permalink
• 

  Nav

  • August 23, 2022 18:34
  • Edited

  I think I figured it out, and it was indeed the switch configuration - your last comment made me look to see if I needed additional configuration on the switch. It turns out that I also needed to create the same VLAN ID in the switch configuration (i.e. it was not enough to just add it as a mapping on the AP), which was only obvious when I logged into the web UI for Omada rather than the app. Thank you for your help!

  1

  Comment actions Permalink

Please sign in to leave a comment.