I'm converting my network from a dumb-network to a smart network with managed switches supporting vlans. I've done some work on the managed switches, though they're not installed yet. VLAN 1 is networking devices, vlan 4 is my devices, vlan 5 is my vendor and appliance devices. In support of this, I've separated out my SSID's, so the main network gets an IP on vlan 4 and the guest network gets IP's on vlan 5.
I have TPLink RE450v2's, so like a wireless extender in access point mode, running openWRT. They're set up and good to go. The main question is, what do I need to do to make sure the single ethernet port on there connecting back to the switches is "Trunked" to carry traffic over the vlans? I've been using the GUI, but if that's a mistake, I can switch to the CLI where I'm less comfortable.
As I see it, I need to go into the network -> interfaces -> devices tab -> bridge device -> configure -> Bridge VLAN Filtering, then make sure I have entries for 1, 4, and 5 "untagged". Is that it? Is there a different way to solve this?
Uplink to the switch will be trunk, therefore the vlans will be tagged.
Then each vlan will be associated to an interface and that interface will be linked to an SSID.
The interface with the management vlan will have an IP/mask/gw/dns.
The rest will be unmanaged interfaces.
How does that work? When I go to interfaces, I have a single bridge interface. When I go to devices, I have the bridge, then a bunch of eth and wlan devices I can't edit.
I'm pretty new on my networking journey, would it be helpful to output any config?
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
Check the fourth scenario in the DSA tutorial.
You need to config bridge-vlans for each vlan and then assign an interface to them.
Remember to use protocol unmanaged (or none in uci) for the interfaces carrying client traffic, and leave the interface with static IP for management of the device.
I think I have it set up, but I'm not sure I've fully associated an SSID with a specific VLAN, and I'm not seeing how to do that? I see nothing in the device settings or the wireless settings that link an SSID to a VLAN. That being said, my DHCP server assigns static IP's based on MAC which are already on the correct subnet, and all clients are already talking to the correct SSID, so when I switch this over the clients will hopefully get the right VLAN, but I feel like I'm missing something. This is what I'm seeing in the UI:
Sorry, I am not fully understanding. There is only 1 ethernet port on the device, and that bridges "eth0." That device has 3 vlan devices now for the 3 vlans that ethernet port sees (1, 4, and 5, the latter 2 being wifi clients). Are those the "bridge-vlans" you're talking about, or do I need to make a new interface for each vlan?
If that's the case, if I make a new interface, do I create it as "Unmanaged" and associate the "br-lan.4" as the device? Then I can assign the SSID to that interface? Then I do the same thing for "vlan5" associated with "br-lan.5"? The only thing that needs vlan1 is the AP itself, so I don't need to make a separate interface for that, do it?
Edit: I just wanna say thanks for the help, because I know I'm a bit slow on the uptake with all this as I'm just learning how to go from an unmanaged network to a managed network and I don't have my head wrapped around all the concepts yet. Most of my learning has been on the switches I've procured, and the AP side of it has been secondary.
Interestingly, when I try to do the first part of that change (make the 3 devices under Bridge VLAN filtering) it fails to apply and reverts. These are the changes it says need to be made:
uci add network bridge-vlan # =cfg05a1b0
uci set network.@bridge-vlan[-1].device='br-lan'
uci set network.@bridge-vlan[-1].vlan='1'
uci add_list network.@bridge-vlan[-1].ports='eth0:u*'
uci add network bridge-vlan # =cfg06a1b0
uci set network.@bridge-vlan[-1].device='br-lan'
uci set network.@bridge-vlan[-1].vlan='4'
uci add_list network.@bridge-vlan[-1].ports='eth0'
uci add network bridge-vlan # =cfg07a1b0
uci set network.@bridge-vlan[-1].device='br-lan'
uci set network.@bridge-vlan[-1].vlan='5'
uci add_list network.@bridge-vlan[-1].ports='eth0'
Ok, I finally replaced my L2 and L3 switches so I could implement this change on my 3 AP's. On the first, it failed completely and I'm locked out of the device; I'm looking at a factory reset and a reloading previous firmware.
I was doing the "bridge vlan filtering" to make the 3 vlan tags, and it came back and said it failed and I told it to apply anyway. That's when it locked out. Since I don't have DHCP running on this AP, it had a manual static IP and I was connected from a laptop also with a static IP.
I think this was mostly an order of events problem? On the L2 switch this AP is connected to the port is trunked with vlans 1, 4, and 5. The ethernet port on this AP should carry 1, 4, and 5, then of the 4 SSID's (2.4, 2.4 Guest, 5, 5 Guest) 2 are vlan 4 and 2 are vlan 5.
What's the order of operations for implementing this correctly?
I had the config backed up and was ready to factory reset and restore, which is why I did it not worried.
I'm not fully understanding how the bridge interfaces work. This is a device with a single ethernet port, so I think I'm using DSA? But most of the documentation I see uses DSA with multiple ethernet ports; I'm dealing with a single.
Out of the box, the single eth0 port is bridged into br-lan automatically, I didn't touch that. Do I then create new devices, and if so, are they bridge devices, or 802.1Q devices? I've been doing the latter; do I associate them with the eth0 device, or the bridge device? I've been associating them with the bridge. I then enable bridge vlan filtering, vlan 1 being pvid and tagged, then vlan 4 and 5 untagged. If I save and apply this (then go to the upstream switch and configure the port accordingly) the switch goes unreachable, and eventually reverts itself and is reachable again after I revert upstream port changes.
On the bridge, I added bridge filtering for vlans 1/4/5. The PVID is 1 (t*), the other 2 are tagged (t) That creates 3 devices of the 802.1Q type, one for each vlan. Going back to interfaces, I changed the "LAN" default interface to be backed by the vlan1 bridge, and gave that the IP. Then I created 2 other unmanaged interfaces, one for each vlan, each backed by the correct brlan device for the vlan. When I then made the SSID's, I associated them with the correct interface, robert is your mother's brother, all is working.
I needed to work through it to understand it, but now it's good to go!
