Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.
-
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
The sonicwall is plugged into port 48 on one of the switches and that port is set to the All profile.
OK, so this is how the SonicWall can get access to the third VLAN physically, though since you don't have a second virtual port created on that connection on the SonicWall side, I don't see how the SonicWall is talking to that network.
Can you give us a bit more detail?
i.e. something like this
SonicWall
Internal
X0 - LAN (192.168.100.x/24) (DHCP - AD)
X0:10 - Guest (192.168.10.x/24) (DHCP - SonicWall)VLAN 3 - phones/VOIP (10.10.10.x/24) (DHCP - PBX)
*edit - After seeing your last post, I think the above is what you have.
-
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
There is only the non VLAN LAN (X0) and the VLAN (X0:10)
I should rephrase this. There is a VLAN 100 that is mostly isolated from the LAN and it is for the phones. They have their own dhcp server and PBX managed by someone else. (For now!)
Awww, so this network has not internet access at this time?
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
OK, so this is how the SonicWall can get access to the third VLAN physically, though since you don't have a second virtual port created on that connection on the SonicWall side, I don't see how the SonicWall is talking to that network.
The Sonicwall has no interaction with that third VLAN (which is the phones). The phone talk to their own PBX, the PBX has two NICs, one for the phones, one on my LAN.
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Awww, so this network has not internet access at this time?
Correct, and should never have it.
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
The Sonicwall has no interaction with that third VLAN (which is the phones). The phone talk to their own PBX, the PBX has two NICs, one for the phones, one on my LAN.
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Can you give us a bit more detail?
i.e. something like this
SonicWall
Internal
X0 - LAN (192.168.100.x/24) (DHCP - AD)
X0:10 - Guest (192.168.10.x/24) (DHCP - SonicWall)
VLAN 3 - phones/VOIP (10.10.10.x/24) (DHCP - PBX)You are spot on.
I just mocked this up, does it help?
-
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
OK, so this is how the SonicWall can get access to the third VLAN physically, though since you don't have a second virtual port created on that connection on the SonicWall side, I don't see how the SonicWall is talking to that network.
The Sonicwall has no interaction with that third VLAN (which is the phones). The phone talk to their own PBX, the PBX has two NICs, one for the phones, one on my LAN.
yeah, this is the way that many PBX vendors pretty much demand to be setup, though they can't really tell you why - they'll say "it's about ensuring traffic to the devices because of QOS", etc... but then - is QOS actually setup on your switches for the given VLAN?
But really, in modern networking, if you have to rely on QOS because of network congestion at the switch level, you should really be solving that problem, not using the bandaid of QOS.So with all that in mind, moving the PBX and phones onto the same VLAN as the production LAN should not be an issue - though, you will have to solve the DHCP issues since you'll likely not be using the PBX DHCP server, but instead either SonicWall or AD (you'll have to add some scope options) will be updated.
-
In your setup, you should not need an IP helper address. The Sonicwall is directly attached to both corporate LAN and guest LAN, so there is no routing of DHCP packets happening.
If DHCP is not being handed out - I would suspect the SonicWall is broken - is there a firmware update for it?
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
In your setup, you should not need an IP helper address. The Sonicwall is directly attached to both corporate LAN and guest LAN, so there is no routing of DHCP packets happening.
Right, but if I move DHCP to another device, I will. (Even if not, I would still like to understand it better. Which for me, means making it work, then reverting to the original config.)
If DHCP is not being handed out - I would suspect the SonicWall is broken - is there a firmware update for it?
I'll check. But I think it is current. Don't forget, I also suspect it's the scenario that introduces the problem, which means it could be the IPhone, the Unifi, or the Sonicwall.
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
I would suspect the SonicWall is broken
I read where the Sonicwalls have a hard time with complex DHCP configs and large pools. I'm consolidating and cleaning up right now. It'll be a few days before I see the changes in pool usage.
Someone said to use two /24 instead of a single /23 on the sonicwall. They said it behaves much better.
I may try that too.
-
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
I would suspect the SonicWall is broken
I read where the Sonicwalls have a hard time with complex DHCP configs and large pools. I'm consolidating and cleaning up right now. It'll be a few days before I see the changes in pool usage.
Someone said to use two /24 instead of a single /23 on the sonicwall. They said it behaves much better.
I may try that too.
How are you using a single /23? that would be a single network... I could see you having two /23 networks, one for LAN and one for Guest, nothing should be wrong with that. You don't have to put the whole range into the DHCP available addresses either, you could limit it to say 100, or what actually fits your needs.
If you have more than 250 devices, using a /23 is every helpful, preventing you from needing to have multiple LANs of /24 and routing between them.
-
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
How are you using a single /23? that would be a single network
X0 - 192.168.0.1/23 - LAN
X0:10 - 192.168.10.0/23 - VLAN -
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
@Dashrender said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
How are you using a single /23? that would be a single network
X0 - 192.168.0.1/23 - LAN
X0:10 - 192.168.10.0/23 - VLANOK - man, if the sonicwall has issues with that, I'd dump them.... well, I'd dump them anyway.
-
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Someone said to use two /24 instead of a single /23 on the sonicwall. They said it behaves much better.
Someone thinks that that hardware is garbage! I'm no fan, but I've never even hinted at a SonicWall being that bad. That's a serious level of not believing in the gear.
-
Off the top of my head, another option would be to throw a Pi with pihole directly on your vlan10 and have it do your DHCP as well as all of the pihole adblocking. Just food for thought. Looking at the setup, I'd also make sure that you don't have anything else on that vlan10 set as a dhpc server or with a dhcp-relay.
-
@notverypunny said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Off the top of my head, another option would be to throw a Pi with pihole directly on your vlan10 and have it do your DHCP as well as all of the pihole adblocking. Just food for thought. Looking at the setup, I'd also make sure that you don't have anything else on that vlan10 set as a dhpc server or with a dhcp-relay.
good point - hadn't considered that.
@JasGot - you could put a device with wireshark on that network and look for DHCP requests/responses...
-
@scottalanmiller said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
@JasGot said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Someone said to use two /24 instead of a single /23 on the sonicwall. They said it behaves much better.
Someone thinks that that hardware is garbage! I'm no fan, but I've never even hinted at a SonicWall being that bad. That's a serious level of not believing in the gear.
I have been using Sonicwalls for a long time and recently moved to Sophos XG Firewalls but that has never been an issue. /23 when planned properly works well on Sonicwall.
-
One thing to keep in mind with Sonicwall that you can't have Static DHCP entries within the DHCP Scope.
Another thing to note is that the Unifi Switches with a Unifi Server Controller give a lot of troubles with VLAN configuration (I am not talking about EdgeSwitches but the Unifi Swtiches). We needed to replace a USG and multiple Unifi Switches causing wireless issues with the Guest network as you mentioned.
-
@dbeato said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
Another thing to note is that the Unifi Switches with a Unifi Server Controller give a lot of troubles with VLAN configuration (I am not talking about EdgeSwitches but the Unifi Swtiches).
When you get a few minutes, can you elaborate? This sounds like we are experiencing. DHCP issues?
I just updated the firmware on all of the switches and found one loop. I'm hopeful things are better tomorrow.
-
@dbeato said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
One thing to keep in mind with Sonicwall that you can't have Static DHCP entries within the DHCP Scope.
Another thing to note is that the Unifi Switches with a Unifi Server Controller give a lot of troubles with VLAN configuration (I am not talking about EdgeSwitches but the Unifi Swtiches). We needed to replace a USG and multiple Unifi Switches causing wireless issues with the Guest network as you mentioned.
Huh, I have Unifi switches - and while I would say a standard command line config for VLANs is easier, I wouldn't say I had real troubles with the VLANs.
-
@dbeato said in Need to better understand IP Helper for accessing Windows DHCP Server from VLAN.:
One thing to keep in mind with Sonicwall that you can't have Static DHCP entries within the DHCP Scope.
That is so annoying!
