GS750E: Device with one MAC but 2 Ports and Subnets on 2 VLANs , ARP issue?

[Lukas_O]

Dear community,

I have just replaced two GS724 with a GS750E as I was not using most of the capabilties of the GS724 anyway. The thing I was using is port based VLAN.

I have a router providing 2 segregated networks Subnet 10.0.10.1 and Subnet 10.0.20.1 (via physical port isolation). I have configured "Advanced Port-Based VLAN", put ports in different groups and attached Router Port 1 to a switch port with VLAN ID 1 and Router Port 2 to a switch port with VLAN ID 2. ARP resolves the Router's IP for the 10.0.10.1 and 10.0.20.1 with the same MAC, perfect.

Problem is that both IPs cannot be resolved at the same time:

I can arping 10.0.10.1 from a device on VLAN ID 1 but not 10.0.20.1 from VLAN ID 1 at the same time. It looks like the switch is constatnly changing the port where the Router MAC is sitting.

I did have the same config on the GS724 with port based VLAN as well it it was fine. What am I doing wrong?

Cheers Lukas

[Lukas_O · Accepted solution]

Hi there,

Thanks for the reply. I absolutly did untick the ports and even tried pinging from one VLANed port to the other (using the appropriate network config). That failed, so isolation works.

However I have solved my issue:

I have been using the "port-based" VLAN option (Advanced) and ran into problems. I am now using real "802.1Q" VLAN (Advanced). What I did is:

1. VLAN-Configuration: Create VLAN ID "100" and VLAN Name "Isolate"
2. VLAN Membership: Tick all ports I want in VLAN "Isolate". I am not tagging so I took the "U" option. Apply.
3. VLAN Membership: Untick the above ports from default VLAN 1. Apply.
4. Port PVID: Set above ports to PVID "100"

Cheers

Lukas

[schumaku]

Hello Lukas,

Have unticked the ports you intend to use on the VLAN 2 in the VLAN 1? This does not happen automatically.

[Lukas_O · Accepted solution]

Hi there,

Thanks for the reply. I absolutly did untick the ports and even tried pinging from one VLANed port to the other (using the appropriate network config). That failed, so isolation works.

However I have solved my issue:

I have been using the "port-based" VLAN option (Advanced) and ran into problems. I am now using real "802.1Q" VLAN (Advanced). What I did is:

1. VLAN-Configuration: Create VLAN ID "100" and VLAN Name "Isolate"
2. VLAN Membership: Tick all ports I want in VLAN "Isolate". I am not tagging so I took the "U" option. Apply.
3. VLAN Membership: Untick the above ports from default VLAN 1. Apply.
4. Port PVID: Set above ports to PVID "100"

Cheers

Lukas

[schumaku]

Cools, using 802.1Q VLAN would have been be the next suggestion - that's the only thing we deploy on our networks, and such an issue would have caught us many times.

It would be worth opening a support case with Netgear so this suspect issue on the Port based [Basic and?] Advanced  VLAN is reviewed by the Netgear engineering. Probably @Christian_R  can arrange the short-cut for this, thank you Chris!