SonicWALL-on-a-Stickadmin | Saturday, September 10th, 2011 | 51 Comments »
SonicWALL’s never tasted so good!
I touched up on this subject in my last blog titled, “Solutions to your SonicPoint WLAN Woes!”
What I want to do here is go over what is traditionally known as “Router-on-a-Stick” or “ROAS”. In this case, “SonicWALL-on-a-Stick” or “SOAS”.
The concept behind “ROAS” is that instead of taking a router and assigning multiple ports to it belonging to different network segments, you consolidate by utilizing 802.1Q trunking on a port which will then carry all VLAN’s over that port. This greatly increases scalability, just imagine if you had ten different network segments, do you have ten available physical ports you would want to dedicate to each network? It would not scale very well!
In the above scenario, each switch is dedicated to a port. It may not seem so bad now, but you can see how fast the ports can run out if you need more network segments. It just isn’t scalable!
Here is your classic “router-on-a-stick”. What you’re doing now is utilizing 802.1Q trunking to carry the VLAN’s to your switch. The key contributing factors are:
- Your firewall or router needs to support 802.1Q
- Your switch needs to support 802.1Q
At this point, you can now individually assign specific ports to each network! For example:
- Network 192.168.1.0/24 can be assigned ports 1-5.
- Network 192.168.2.0/24 can be assigned ports 6-10.
- Network 192.168.3.0/24 can be assigned ports 11-15.
Not only have you cleaned up additional messy wires and cabling, but you are also reducing power consumption by using less switches!
Below I show you how you can setup your SonicWALL TZ 210 running SonicOS 5.8 to utilize trunking off the LAN(Xo) port and creating VLAN’s. You’re going to be creating sub-interfaces!
Go to Network–>Interfaces and create your VLAN’s. It’s very important that your VLAN Tag ID’s are consistent with the same ID’s that will be created on your switch.
Now you will see on the main interfaces page, that the sub interfaces have been created!
The main piece of configuring your SonicWALL with sub interfaces is now complete! The next section covers configuring a Cisco switch to support trunking and assigning specific ports to those VLAN’s. Please refer to your vendor equipment for the proper way to configure your own switch.
With Cisco, if the VLAN doesn’t already exist, it will create it as you can see from the error above. This saves me the extra step of having to create the VLAN ahead of time.
Now that we have our trunk port and ports assigned to proper VLAN’s, we now verify connectivity by plugging a PC into each VLAN and pinging each other!
PC1 being on VLAN1 is able to successfully ping its own gateway. This should work whether we have trunking/sub-interfaces or not, and it’s verified working.
We now ping the default gateways for VLAN 2 and VLAN 3 from PC1. As you can see, we have connectivity! This shows that the trunk is working as expected.
Here we can confirm that you have reach ability beyond just the default gateway, but to actually reach out across the VLAN’s and access another PC on VLAN2. We ping PC2(VLAN2) from PC1 on VLAN1.
Just so that PC3 on VLAN3 doesn’t feel left out. Here we show that PC3 has connectivity to its own default gateway, it can ping itself(which I always like to test for localhost TCP/IP verification) and it can ping PC2 on VLAN2.
That’s about it! I hope you can now think about how a SonicWALL-on-a-Stick can help simplify your network setup!