Vlan setup

[John813]

I have a 1550 that I setup Vlan 10 ip 192.168.10.1/24 Went to a laptop and set static ip 192.168.10.4  device does not have internet access. Went to policy and added rule allow, still no internet. Local internet said  vlan is up. Any advice?

John

[the_rock]

What do you see if you do traceroute to say google dns? What does capture on the firewall tell you? You can also try do zdebug command as well...fw ctl zdebug + drop | grep x.x.x.x (just replace with IP you are testing).

[John813]

Thank you for your input, what you are asking me is way above my knowledge base. I may not have communicated what I am trying to do well enough.  In simple terms I am trying to run three lans off of one physical  port. 192.168.10, 192.168.1, 192.168.20. Is that possible on the 1550?

[the_rock]

I dont see why that would not work. Not sure what vlan limit is, but I believe it used to be 1024 max.

[G_W_Albrecht]

For Tagged VLANs it is 100 for 15x0 units, see sk113247: Maximum number of VLAN and VAPs for Gaia Embedded Appliances 8)

[John813]

Yes thank you. Do you know of any sk that describes how to create a vlan? I downloaded the admin guide for 1550 and just don't understand it. I shelved the issue for now, but really think a vlan will help. 

John

[the_rock]

Hey John,

You can refer to below 

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/VLAN-In...

Andy

[G_W_Albrecht]

No, this link is invalid for Quantum Spark 1550 Embedded GAiA units. Why is the VLAN needed at all ?

[John813]

I work at a school. We have  one physical lan we are trying to separate the lan into 3 segments. We would like to have office staff on one. Students on another and Teachers on third. We have 192.168.1.1/24 as main lan.   I need to setup 192.168.10.1/24 for teachers. 192.168.20.1/24 for students.

John

[PhoneBoy · Accepted solution]

A specific VLAN tag only makes sense if you are uplinking to another switch that is also configured with the same tags.
Otherwise, if you want some hosts on a different LAN segment:

• Remove the relevant ports from the LAN1 Switch (done via Device > Network > Local Network > LAN1 Switch > Edit)
• If it is more than one port, create a new switch, adding those ports to the new switch and setting the network IP as desired, otherwise, you can just edit the relevant LAN port.

[John813]

Thank you I'll look at that.

John