Simple vLAN setup

Question

I have a basic lab environment set up to try and get 2 vLANs working in hyper-v.

I have the following equipment

• 1 hyper-v server
• 1 Desktop PC
• 1 Managed Switch (d-link DES-3052P)
• 1 cheap router (DI-604)

My end goal is to have 1 VM and the desktop on one vLAN with internet, and 1 VM on a separate vLAN with internet access.

I am having troubles getting an internet connection to both vLANs. The switch does not have the ability to have asynchronous vLANs.

This is my switch configuration

• Port 1 - Trunk Port - Connected to router
• Port 2 - Trunk Port - Connected to hyper-v Server
• Port 3 - Access Port- Connected to Desktop

Within hyper-v I have 1 switch and 2 VMs. When the VMs are set up to use vlan ID 1, everything works fine. As soon as a VM is set up to use vlan ID 2, they lose all network connection and cannot communicate with the router anymore. I believe this is because the router is not vLAN aware.

Can anyone help me with what settings need to be set up on my switch? I believe I want an egress rule so traffic leaving towards the router is untagged, is that right? If not, any ideas or hints as to what needs to be set up?

Answer 1

This seems similar to VLAN Configuration for Home Network in that you want two separate VLANs with Internet access through a router that is not VLAN-aware. Your situation is a little more complicated due to the virtualization of two machines and a switch, but I think the basic problem is similar.

I'd suggest you try the technique proposed in the other question and create a new VLAN that spans all ports on both switches. Set pvids for the desktop and VMs to be 1 (if on VLAN 1) and 2 (if on VLAN 2), and pvid=3 for the router, and set the router connection to "untagged" as you suggested. VLAN 3 allows all requests to go out to the router (and Internet). The pvid settings prevent cross-VLAN communication. However, any device that connects directly to the router will have access to both VLANs, so you don't have complete VLAN isolation.

I can't vouch for the security of this approach, but for a lab setup it might help you accomplish your goal of allowing Internet access to both VLANs without a VLAN-aware router.