1

I have been trying to configure the static IP addresses with Ubuntu 16.04 Dabian version. The network as follows in the graph

I have been failing to ICMP (ping echoing) between the Client and the HTTP server. Is there a way I can connect both of the Server and Client through the router 192.168.1.11 and 192.168.1.12?

My current network interface configuration for 192.168.1.11 and 192.168.1.12 which can ICMP between 192.168.0.16 and 192.168.2.16, but not to 192.168.0.17 from 192.168.1.12 nor to 192.168.2.17 from 192.168.1.11:

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback


# adding vlan 201 on eno1 - static IP address
auto eno1.201
iface eno1.201 inet static
        address 192.168.1.12
        netmask 255.255.255.0
        vlan-raw-device eno1
        post-up ip route add default dev eno1.201

# Adding vlan 101 on eno1 - Static IP address
auto eno1.101
iface eno1.101 inet static
        address 192.168.2.16
        gateway 192.168.1.10 # switch IP address
        netmask 255.255.255.0
        vlan-raw-device eno1

My Client static address:

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback

auto eno1
iface eno1 inet static
        address 192.168.2.17
        netmask 255.255.255.0
        network 192.168.2.0
        gateway 192.168.2.16

Note: I can connect the server and the client when I use IPsec, but when I stop IPsec, they don't ICMP each other.

Edit: Basic Switch ports configurations enter image description here

Improve this question
5
  • If I understand your picture correctly, there server and the client are in different networks, and unless the switch is somehow configured to forward between those, of course you can't ping one from the other. I also have the suspicion that your setup is more complicated than it needs to be, but you'd have to explain what you want to achieve with that setup before I can comment on that.
    – dirkt
    Aug 10, 2017 at 14:49
  • @dirkt , yes, both of the server and the client are in different networks. The switch is configured as tagged and untagged ports where I can connect these two different networks. The struggle I have until this moment is when I stop the IPsec, I can't ping the server from the client and vice versa. My setup may seem complicated because I honestly tried every method given here in the internet and nothing works so far. so basically, I need to ping both ends while IPsec is stopped.
    – debugging XD
    Aug 11, 2017 at 13:11
  • Please edit your question with configuration details of the switch, e.g. as obtained from its command line interface. From the picture, it looks like the tagged VID 100 on ports 5-6 is not connected to the untagged ports 12-15. So the switch will not connect those different networks. With IPsec, client and server might actually be connected via the green/red/green path, if both laptops forward, but that isn't clear from the picture, either.
    – dirkt
    Aug 11, 2017 at 14:47
  • @dirkt I have edited my question above and made it as clear as possible. I hope it is understandable now.
    – debugging XD
    Aug 11, 2017 at 16:00
  • @dirkt I wonder whether DHCP relay could help in this scenario too?
    – debugging XD
    Aug 11, 2017 at 16:13

1 Answer 1

Reset to default
0

Let me quickly explain how VLANs work on the wire: A normal ethernet packet does not have a special field for the VLAN id. VLAN packets, on the other hand are a later extension that uses a new packet format which consists of all fields of the old format plus the additional tag, as definined in 802.1Q. So on the same wire, you can have untagged and tagged packets, and the interpretation is that they "just go past each other" and form different "virtual connections" on top of a physical connection.

So what does your switch do when you define a VLAN group with tagged and untagged ports, say VID=100? If the switch receives packets tagged with 100 on ports 1-4, it will forward them (with the same tag) to (the other numbers in) ports 1-4, and it will strip the tag and forwarded them to ports 5-6. All other tags and untagged packets on port 1-4 are ignored. When it receives untagged packets on ports 5-6, it will forward them untagged to the other port in 5-6, and it will tag them with 100 and forwarded it to port 1-4. All tagged packets received on ports 5-6 are ignored (for this VLAN)

Similarly for VID=201: If it receives packets tagged with 201 on ports 5-6 or 10-11, it will forwarded them tagged to the other ports in 5-6,10-11 and untagged 7-9 etc.

What it doesn't do is to somehow forward packets "between" different VLANs: A packet tagged with 100 and received on port 1-4 is not retagged with 201 "on port 5-6" and forwarded to the VID=201 VLAN, and then again retagged with 101 and forwarded to port 12-15.

The IP address that is assigned in the switch plays no role in this at all: A switch works on OSI level 2, where there are no IP addresses.

DHCP issues are also totally unrelated, this is purely networking.

So in your current configuration, there's no connection between VLAN 100 and VLAN 101 (unless you defined a routing table somewhere), they are completely separate, and hence the server and the client can't ping each other.

If you can explain what you want to achieve with your network configuration, I can try and come up with a solution. Something along the lines:

The client and server should always communicate, the left laptop should only communicate with the server and not the client, the right laptop should only communicate with the client and not the server, the laptops should only communicate via IPsec. All computers have only a single ethernet plug.

Usually in this situation you'd use one VLAN for each "separate" connection, so each computer will be part of several VLANs. Note that is purely administrative, and not secure: Nothing prevents any "rogue" computer from pretending that it is on other VLANs as well. So please mention security concerns, if there are any.

Improve this answer
4
  • Firstly, thanks a lot for the detailed explanation of how packets are being forwarded and received in both networks. It is perfectly explained. However, I still need a little further help in the Interface configuration as it is the main reason I put the question. Yes, there shouldn't be any direct connection between VLAN 100 and VLAN 101. I haven't defined a routing table for them, they are completely separate networks, but connected through the router VLAN 201 with IPsec security connection of course. I tried to use one VLAN for each separate network, but my attempts failed big time.
    – debugging XD
    Aug 13, 2017 at 13:46
  • The thing is: if you have separate VLANs, they can't communicate. If you route between two VLANs, you might as well just use one VLAN. So with your current design of the VLANs, it just won't work. So the questions are: (1) Why do you need separate VLANs in the first place? Wouldn't a single untagged LAN segment also do? (2) If you do need separate VLANs, for whatever reason, why can't you use a 4th VLAN that connects client and server? (3) I really, REALLY suggest you write down the requirements and goals of your setup, and then do a proper design.
    – dirkt
    Aug 13, 2017 at 17:08
  • The thing, I tried to use only one VLAN and one static IP address, but still the server and the client didn't communicate. So I had to use two VLANs so the server and the client can communicate with each other. Note that this works only when IPsec is on, but when I switch it off, both of the client and the server can't communicate again. So as you may conclude that I couldn't use only one VLAN and a normal static IP address for the routers. My aim so far is just to configure the interface of the tagged routers with two different networks as it is shown in the graphs above.
    – debugging XD
    Aug 14, 2017 at 15:06
  • We are somehow talking in circles. Client and server can only communicate if they are in the same LAN segment. Full stop. So the first thing to do is to configure the router with no VLANs, as a simple switch where every port is forwarded to every port, untagged. So, one LAN segment, untagged Assign static addresses to all computers, see if it works. No need to configure VLANs on the computers. Now enable IPsec, see if it works. If that setup doesn't meet your intentions, please explain why.
    – dirkt
    Aug 14, 2017 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .