Hello,
I’ve been trying to get the VLAN on my network up and running for over two weeks now, see the following diagram. The only place where my VLAN works is through CAPsMan and then on the ports in the main router where the end devices are directly connected. The HAP gets the correct IP in the DHCP client but no longer sends it on to the end devices. These devices have the address 192.168.1.xxx. What did I forget in the configuration?
Firstly, there is no need of L3 VLAN configuration (no interface vlan, dhcp-client, etc.) on the hAP ac^2 unless one of the VLANs is a management one. Secondly, I don’t see any bridge at all on the hAP (unless it’s not shown in the config). Another problem I notice is that the ports on the RB5009 which are part of the VLAN configuration are also not in a bridge (unless it’s not shown in the config). Instead, the VLANs are bridge members which shouldn’t be the case. Remove them instantaneously. Also, on which of the hAP ac^2s is the config?
In order everything to work, I’ll post an example config:
For me your missing some glue.
All smart devices should get an IP address on a managment vlan, or at least a trusted vlan like home vlan.
Also I would separate out media devices, from home camera device, from guest wifi, from iot devices, from home trusted vlan
Please, does anyone else have any other ideas?
I added VLAN88 as management. The middle hap is set up exactly as advised by TheCat12, but now it gives the IP address 192.168.88.xxx. I don’t know what interface to set for the VLAN, when the Bridge-LAN shouldn’t be there.
At router 5009
First go to interfaces and create 3 new interfaces with the names vlan10, vlan20 and vlan30 that will belong to the same bridge as the ethernet ports
Create addresses, dhcp pools, networks and dhcp servers for EACH of these new itnerfaces.
Then:
At bridge ports >> ports 2,3,4 are trunk ports so you should assign each port as pvid 1 and admit only vlan tagged and ingress filtering yes.
At bridge ports >> ports 5,6,7 are access ports so you should assign to each port as pvid the corresponding vlan id that you want (port 5 pvid 30 and ports 6 and 7 pvid 10) and admit only untagged and priority tagged and ingress filtering yes.
Now you will assign each vlan id with what you want to do at each interface:
At bridge vlan >> add for each vlan you will create an entry at vlan table as follow:
vlan 10, bridge the bridge that you have at 5009, and tagged the bridge of 5009 and all the trunk ports that vlan 10 will use to pass to other devices so 3,4 while untagged the access ports so 6,7
vlan 20 bridge the same bridge as above, tagged the bridge, and ports 2 while untagged nothing
vlan 30 bridge the same bridge as above, tagged the bridge, and ports 2,3,4 while untagged port 5
Now at hap ac2 no 1
At bridge ports >>
ports 2 and 3 are access ports for vlan 10 so give to each of them pvid 10 and admit only untagged and priority tagged, ingress filtering yes.
Port 5 is an access port for vlan30 so pvid 30 and untagged and priority tagged and ingress filtering yes.
At bridge vlan>>
vlan 10: vlan id 10, tagged the bridge and untagged the ports 2 and 3
vlan 30: vlan id 30, tagged the bridge and untagged the port 5
At hap ac2 number 2
port 2 are access port for vlan 10 so give pvid 10 and admit only untagged and priority tagged, ingress filtering yes.
Port 5 is an access port for vlan30 so pvid 30 and untagged and priority tagged and ingress filtering yes.
At bridge vlan>>
vlan 10: vlan id 10, tagged the bridge and untagged the port 2
vlan 30: vlan id 30, tagged the bridge and untagged the port 5
After you have finished all of that enable vlan filtering to the bridge of the router and haps
After I turn on bridge filtering, HAP becomes unavailable. I would rather expect that the VLAN setting takes place in the switch and not in the bridge, in order to use the HW chip.
If you want the hap also to acquire an ip address and you to be able to connect through web interface then you should add the bridge of the hap as Untagged interface to the vlan that you want through this to access the hap… if it is vlan 10 then you should go to bridge>vlan on the hap and add the bridge to the untagged interfaces in order to acquire an IP from the DHCP server
Sorry for the late response but a better practice would be a management VLAN as you tried to do it the first time. I’ll repost a full and refurbished variant of my config to include a MGMT VLAN where ether8 on the RB5009 and ether2 on the lower hAP would be access ports for it:
