SonicWALL-on-a-Stick

| Saturday, September 10th, 2011 | 51 Comments »

SonicWALL on a Stick, SonicWALL-on-a-Stick

SonicWALL’s never tasted so good!

I touched up on this subject in my last blog titled, “Solutions to your SonicPoint WLAN Woes!

What I want to do here is go over what is traditionally known as “Router-on-a-Stick” or “ROAS”. In this case, “SonicWALL-on-a-Stick” or “SOAS”.

The concept behind “ROAS” is that instead of taking a router and assigning multiple ports to it belonging to different network segments, you consolidate by utilizing 802.1Q trunking on a port which will then carry all VLAN’s over that port. This greatly increases scalability, just imagine if you had ten different network segments, do you have ten available physical ports you would want to dedicate to each network? It would not scale very well!

In the above scenario, each switch is dedicated to a port. It may not seem so bad now, but you can see how fast the ports can run out if you need more network segments. It just isn’t scalable!

Here is your classic “router-on-a-stick”. What you’re doing now is utilizing 802.1Q trunking to carry the VLAN’s to your switch. The key contributing factors are:

  1. Your firewall or router needs to support 802.1Q
  2. Your switch needs to support 802.1Q

At this point, you can now individually assign specific ports to each network! For example:

  • Network 192.168.1.0/24 can be assigned ports 1-5.
  • Network 192.168.2.0/24 can be assigned ports 6-10.
  • Network 192.168.3.0/24 can be assigned ports 11-15.

Not only have you cleaned up additional messy wires and cabling, but you are also reducing power consumption by using less switches!

Below I show you how you can setup your SonicWALL TZ 210 running SonicOS 5.8 to utilize trunking off the LAN(Xo) port and creating VLAN’s. You’re going to be creating sub-interfaces!

Go to Network–>Interfaces and create your VLAN’s. It’s very important that your VLAN Tag ID’s are consistent with the same ID’s that will be created on your switch.

BrandonTek SonicWALL create VLAN

Now you will see on the main interfaces page, that the sub interfaces have been created!

BrandonTek Sonicwall Show VLAN

The main piece of configuring your SonicWALL with sub interfaces is now complete! The next section covers configuring a Cisco switch to support trunking and assigning specific ports to those VLAN’s. Please refer to your vendor equipment for the proper way to configure your own switch.

BrandonTek SonicWALL create trunk

Create a trunk port on port 24

BrandonTek SonicWALL assign ports to VLAN

Assigning ports to VLAN

With Cisco, if the VLAN doesn’t already exist, it will create it as you can see from the error above. This saves me the extra step of having to create the VLAN ahead of time.

Now that we have our trunk port and ports assigned to proper VLAN’s, we now verify connectivity by plugging a PC into each VLAN and pinging each other!

BrandonTek SonicWALL PC pings Gateway

PC1(VLAN1) pings gateway

PC1 being on VLAN1 is able to successfully ping its own gateway. This should work whether we have trunking/sub-interfaces or not, and it’s verified working.

BrandonTek SonicWALL PC1 pings gateway 2 and 3

PC1 on VLAN1 pings gateway for VLAN 2 and VLAN3

We now ping the default gateways for VLAN 2 and VLAN 3 from PC1. As you can see, we have connectivity! This shows that the trunk is working as expected.

BrandonTek SonicWALL pc1 pings pc2

PC1 on VLAN1 now pings across to PC2 on VLAN2

Here we can confirm that you have reach ability beyond just the default gateway, but to actually reach out across the VLAN’s and access another PC on VLAN2. We ping PC2(VLAN2) from PC1 on VLAN1.

BrandonTek SonicWALL PC3 pings PC2

PC3 on VLAN3 pings PC2 on VLAN2

Just so that PC3 on VLAN3 doesn’t feel left out. Here we show that PC3 has connectivity to its own default gateway, it can ping itself(which I always like to test for localhost TCP/IP verification) and it can ping PC2 on VLAN2.

That’s about it! I hope you can now think about how a SonicWALL-on-a-Stick can help simplify your network setup!

Share
  • trace route

    Hi Brandon i have a question for you regarding the sonic wall router on the stick solution. My internet provider is coming into my house with a fiber. This fiber have 3 vlans configured(vlan 100=ip-telephony, vlan 101=IPTV and vlan 102=internet). I have a cisco sg300 switch which converts the fiber to ethernet and also handles the routing. What i want to do is tootrunk all these vlans and some other which i have control over using sonicwall tz-205. The IPTV are delivered from the provider as DHCP. I am struggling to see how i can create a vlan on the sonic wall not knowing the ip address range? Do you have a suggestion for this.