Welcome to TP-LINK Tech Support Forum
+ Reply to Thread
Results 1 to 5 of 5
  1. #1

    Vlan setup issue

    Model :

    Hardware Version :

    Firmware Version :

    ISP : [/COLOR]

    Hello guys,

    I just bought a SG108E switch and in my setup i encounter an issue. My setup:

    -Sophos home made firewall with 3 interfaces (WAN, LAN1 and LAN2)
    -TP LINK SG108E
    -CISCO AIR-LAP1131G-E-K9 access point

    The devices are connected as follows: Sophos LAN1 -> port 1 TPLINK - TPLINK port 2 -> Cisco AP

    Sophos LAN 1 has VLAN2 and VLAN3 on it, as well as the other ports involved in the connection above. TPlink has only ports 1&2 configured as trunk; the rest of them are access ports in vlan 2 and port 8 is untagged. Cisco AP has a classic trunk with VLANs 2 and 3 corresponding to ssid main and guest, and also the native vlan (which is untagged).
    Sophos device is a layer 3 device, unable to manage untagged Vlans.
    TPlink device has the management IP on the untagged vlan1.
    Cisco AP has the management IP address on Native vlan 1. This model cannot have a management IP address on any vlan other than the native one (which is untagged).

    TPLINK config iamges:
    Name:  tplink1.JPG
Views: 0
Size:  23.7 KBName:  tplink2.JPG
Views: 0
Size:  26.8 KB

    Problem: while the tagged vlans work OK, the untagged ones are unreachable (management IP of TPlink and Cisco AP). As a workaround, i configured the spare interface on sophos LAN2 with a fixed IP in the same subnet as the native VLAN of TPLINK and Cisco, and connected it to TPLINK port 8 (which is not tagged). Now i can reach the TPLINK IP, but still cannot reach Cisco IP (which is on the same subnet).
    Is there a way to solve this?

  2. #2
    Members TPTHZ is on a distinguished road
    Join Date
    Aug 2017
    where is your computer that want to access the web interface of cisco?(connect firewall or wirless ap), In my opinion, you need check configuration in your cisco AP.
    When you computer connect to cisco AP via wireless directly, could your computer are able to open the web page of cisco AP.

  3. #3
    Members R1D2 is on a distinguished road
    Join Date
    Dec 2015
    Quote Originally Posted by panicos View Post
    Now i can reach the TPLINK IP, but still cannot reach Cisco IP (which is on the same subnet).
    This is another example of the never-ending story of TL-SG108E having a fixed Default VLAN 1. The question is, what happens with untagged Ethernet frames in the Default VLAN on egress? According to the switch's manual, any untagged Ethernet frames received by the switch over the trunk will be added the PVID of the trunk port (that's correct behavior in the sense of Cisco's native VLAN). Since PVID is 1 in your setup above, untagged frames will get assigned to VLAN 1.

    But what happens on egress of such frames on the trunk port? Since ports 1 & 2 are set as untagged ports for VLAN 1, the VLAN tag should be removed, so the Cisco AP should see an untagged frame and handle it through its native VLAN. But since ports 1 & 2 are trunk ports, according to the manual the frame will be forwarded unchanged, i.e. the VLAN tag not removed on egress. I still couldn't figure out what really happens to VID1-tagged frames on egress over a trunk.

    Long story short: I did give up to handle VLAN 1 in my network through TL-SG108Es (I have two of them and similar requirements to be able to handle trunked VLAN 1). While my appliance switch (a TL-SG2008) can be configured to handle VID1-tagged frames over a trunk, I was not able to set it on TL-SG108E. I opened several tickets with TP-Link asking for a firmware change to be able to handle VLAN 1 much like any other VLAN (as it is possible with TL-SG2008), but so far I only got a response that they won't change the Default VLAN on the Easy Smart Switches. So I'm actually considering to replace the TL-SG108Es by smart switches such as the Netgear GS 108E, which allows me to configure VLAN 1 just like any other VLAN.

    If TP-Link insists to set a fixed Default VLAN for whatever reason, they should use a VLAN ID above 4090, but not VLAN 1.
    Last edited by R1D2; 10-09-2017 at 10:54.

  4. #4
    you guys are both right. However, after more analysis, tcpdumps on the firewall i figure it out. The issue was on the AP, because although it has an IP in vlan 1 native (untagged), it does not have a default gateway set for that. So the AP was constantly ARPing for mac of destinations in another subnets, like he was thinking himself to be in the same subnet with vlan 2, or vlan3, etc - very strange. Setting a default gateway in it (def gateway, the Firewall IP address in that subnet) fixed the issue. The initial setup worked for a previously cisco router, but after i replaced it with the firewal and also mounted the tplink in the middle, it didn't anymore.
    Thanks both of you.
    Thread may be closed.

  5. #5
    Members R1D2 is on a distinguished road
    Join Date
    Dec 2015
    Great that it works. However, if the switch indeed uses untagged Ethernet frames for the mgmt IP of the AP in VLAN 1 and the AP uses a default address of the router, this means that the AP's mgmt interface can be reached from each VLAN, right? So, the Default VLAN problem still remains, since every port is always a member of VLAN 1 (that was my point).


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

Copyright 1996-2018 TP-LINK Technologies Co., Ltd. All rights reserved.