ZyXEL GS1900 VLAN config

Hello!

This is my first setup, so I may ask stupid questions.
I have the GS1900 and I want to use it with one trunk (all vlans tagged) port and one access port (one VLAN untagged).

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
#       option ula_prefix 'fdxyz::/48'

config device 'switch'
        option name 'switch'
        option type 'bridge'
        option macaddr 'xyz'

config bridge-vlan 'lan_vlan'
        option device 'switch'
        option vlan '1'
        option ports 'lan1 lan2 lan3 lan4 lan5 lan6 lan7 lan8'

config device
        option name 'switch.1'
        option macaddr 'xyz

config interface 'lan'
        option device 'switch.1'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

lrwxrwxrwx    1 root     root             0 Jan  1  1970 eth0 -> ../../devices/platform/1b00a300.ethernet/net/eth0
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan1 -> ../../devices/platform/switch@1b000000/net/lan1
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan2 -> ../../devices/platform/switch@1b000000/net/lan2
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan3 -> ../../devices/platform/switch@1b000000/net/lan3
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan4 -> ../../devices/platform/switch@1b000000/net/lan4
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan5 -> ../../devices/platform/switch@1b000000/net/lan5
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan6 -> ../../devices/platform/switch@1b000000/net/lan6
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan7 -> ../../devices/platform/switch@1b000000/net/lan7
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lan8 -> ../../devices/platform/switch@1b000000/net/lan8
lrwxrwxrwx    1 root     root             0 Jan  1  1970 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx    1 root     root             0 Sep 23 12:56 switch -> ../../devices/virtual/net/switch
lrwxrwxrwx    1 root     root             0 Sep 23 12:55 switch.1 -> ../../devices/virtual/net/switch.1


https://openwrt.org/docs/guide-user/network/vlan/switch_configuration
Is my guess right that my switch is vlan-enabled?

The wiki shows that file with certain differences compared to the wiki.

device, bridge-vlan etc.

Can someone please explain the differences?
Especially what does

config device
        option name 'switch.1'
        option macaddr 'xxxx'

do?

--
kind regards
Marco

This doesn't look right. Is this the default configuration of your device, or did you make edits?

This is the default config except that I commented out the ULA option.

I'm a bit surprised that this is the default configuration... normally the main bridge will contain all ports in a list format, and then the bridge-vlans use a list format rather than an option with all the ports.

For example:

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config bridge-vlan
        option device 'br-lan'
        option vlan '1'
        list ports 'lan1:t'
        list ports 'lan2:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '2'
        list ports 'lan1:t'
        list ports 'lan3:u*'

config bridge-vlan
        option device 'br-lan'
        option vlan '3'
        list ports 'lan1:t'
        list ports 'lan4:u*'

What version of OpenWrt is currently on your device?

ubus call system board
{
        "kernel": "5.15.167",
        "hostname": "OpenWrt",
        "system": "RTL8380",
        "model": "ZyXEL GS1900-8 Switch",
        "board_name": "zyxel,gs1900-8",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.5",
                "revision": "r24106-10cc5fcd00",
                "target": "realtek/rtl838x",
                "description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
        }
}

Thanks. That's up to date.

Because the syntax here is so different than most other OpenWrt DSA devices (i.e. routers), and I don't have specific experience with this device, I'm going to defer to others to help you here. That's simply because I don't want to give you incorrect information that could cause you headaches.

In general, you should be able to find a lot of your answers in the DSA tutorial, but as mentioned, for some reason your switch doesn't seem to follow the same syntax rules... therefore, be careful as you experiment and/or wait until someone with specific knowledge of your switch can assist.

https://openwrt.org/docs/guide-user/network/dsa/dsa-mini-tutorial

I have exactly the same device running the same version. Below is a copy of my network file (less loopback/globals section) so you can compare.

I have three vlans but all trunked back via lan port 8. The bridged vlan filtering section is configured as follows:

ports 1 and 2 untagged on vlan 20
ports 3 and 4 untagged on vlan 30
ports 5,6 and 7 are not members of any vlan
Vlan 10 exists but is for testing mainly and normally has no ports assigned
port 8 is tagged for all 3 vlans and is the vlan trunk link back to my main switch

Hope this helps

config device 'switch'
        option name 'switch'
        option type 'bridge'
        option macaddr '5c:f4:ab:ca:9b:12'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan5'
        list ports 'lan6'
        list ports 'lan7'
        list ports 'lan8'
        option ipv6 '0'

config bridge-vlan
        option device 'switch'
        option vlan '20'
        list ports 'lan1'
        list ports 'lan2'
        list ports 'lan8:t'

config bridge-vlan
        option device 'switch'
        option vlan '30'
        list ports 'lan3'
        list ports 'lan4'
        list ports 'lan8:t'

config bridge-vlan
        option device 'switch'
        option vlan '10'
        list ports 'lan8:t'

config interface 'HIFI'
        option proto 'none'
        option device 'switch.20'
        option delegate '0'

config interface 'IOT'
        option proto 'none'
        option device 'switch.30'
        option delegate '0'

config interface 'HOME'
        option proto 'static'
        option device 'switch.10'
        option ipaddr '192.168.1.150'
        option netmask '255.255.255.0'
        option gateway '192.168.1.1'
        option delegate '0'

config device
        option name 'switch.10'
        option type '8021q'
        option ifname 'switch'
        option vid '10'
        option ipv6 '0'

config device
        option name 'switch.20'
        option type '8021q'
        option ifname 'switch'
        option vid '20'
        option ipv6 '0'

config device
        option name 'switch.30'
        option type '8021q'
        option ifname 'switch'
        option vid '30'
        option ipv6 '0'

1 Like

Thanks @hogkite - this confirms that the device configuration works with the expected DSA/bridge-VLAN syntax.

With that in mind @dabbes, I can help you with your goals...

Yes, your switch is VLAN aware, but this link references the older swconfig syntax. Take a look at my earlier link to the DSA syntax.

Yes, probably because of the differences between swconfig and DSA.

So, let's get into specifics:
-What VLAN IDs are you using?

  • What VLAN is going to be used to manage this device?
  • What address do you want the switch to take on your network (or do you want it to get an address via DHCP)?
  • Please give a port-by-port description of the port-vlan memberships. For the trunk(s), please note which (if any) VLAN is untagged.

I'll try the config from hogkite.
How will the management interface be bound to a specific vlan?

Just set the protocol to "unmanaged" for the non-management VLANs. So whichever VLAN you want to use to manage the device set the protocol to "static address" and configure an appropriate address.

I've now the following config and noticed that untagged traffic arriving at a trunk will be sent untagged to all other ports.
Is there a way to discard them on a trunk port?

Change the PVID on the trunk port to a different (i.e. unused) VLAN. You might need to create a 'blackhole' VLAN to do this.

I currently don't have switch_port configured.

        option device 'eth0'
        option port '8'
        option pvid '1000'

Would that be the stuff I need? Do I need to create the VLAN 1000 like the others or is that enough for the blackhole?

That almost certainly will not work.

Try this:

config bridge-vlan
        option device 'switch'
        option vlan '1000'
        list ports 'lan8:u*'

What does the u* mean?
What is the difference to lan8 without that?

u* is untagged + PVID. not using it should theoretically result in the same behavior, but I always recommend specifying explicitly.

On my trunk ports I don't set any untagged and as far as I can tell I only have tagged frames on the wire. Also, I explicit do not configure vlan 1 at all in my environment.

That's a legit way to do it. But the OP is saying that there is untagged traffic flowing, so the guaranteed way to block that from being an issue is black-holing the traffic with an untagged+PVID VLAN that goes nowhere.

That said, I do agree that this is something of a hack because the untagged traffic must be flowing due to some other misconfiguration.The good news is that the black-holing of the traffic will likely break something else, revealing the path to proper resolution.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.