Comware

Hello,

I have a very basic setup with 6 HPE switches (DEFAULT_VLAN 1 untagged 192.168.0.X vlan + tagged vlan id 10 192.168.1.X).

The untagged is for our server/computers network while the tagged one is for voice traffic (ip phones+voice server). Now I need to move the voice server from the tagged to the untagged vlan to connect all the softphone enabled clients but, at the same time, I want that all the ip phones in the tagged 10 vlan can still connect to the voice server. Basically I need that the ethernet port connected to the voice server receives traffic from the tagged and the untagged at the same time. 

Is it possible? The backbone of my network is layer-3 while all the other switches are layer-2

Hi! first of all VLANs aren't tagged or untagged...instead ports (physical or logical interfaces) are eventually untagged and/or tagged members of existing VLANs.

So you basically have two VLAN Id(s) defined:

• VLAN 1 (Default Port VLAN id) <-- ports in default state are untagged members of that VLAN id.
• VLAN 10

Then you associated a non overlapping IP Address to each VLAN id:

• VLAN 1 = 192.168.0.x 255.255.255.0 (Data dedicated VLAN id)
• VLAN 10 = 192.168.1.x 255.255.255.0 (Voice dedicated VLAN id)

I suppose that your softphones are running on clients and those clients should be usually connected to your VLAN 1 (Data dedicated) via switch access ports untagged members of VLAN 1. Correct?

The Voice Server would be probably (re)connected to an access port which should be concurrently configured to be an untagged member of VLAN 1 (to stay in touch with softphones on the very same VLAN 1) and a tagged member of VLAN 10 (to stay in tocuh with hardphones on the very same VLAN 10). Clearly this approach means that the Server is VLAN Aware and so its Ethernet interface is going to have a set of networking settings (IP address, Subnet Mask, Default Gateway, etc.) on VLAN 1 (Default) and another set of networking settings (IP address, Subnet Mask, Default Gateway, etc.) on VLAN 10.

Hi, thank you very much for clarifying you are 100% correct about my setup. Yes, I meant ports, on the same port I need that both untagged and tagged frames go to the voice server that is now configured with an ip from the untagged Vlan (192.168.0.200).

The voice server has only one ethernet interface so, being a member of the untagged Vlan, is unable to ping any Vlan 10 phone, so I guess I need to change something in the switch. The voice server port should be an hybrid one to simultaneously communicate with both vlans, or maybe I just need a routing policy (I can do I with my firewall) between the two vlans

---

@mass1q wrote: Hi, thank you very much for clarifying you are 100% correct about my setup. Yes, I meant ports, on the same port I need that both untagged and tagged frames go to the voice server that is now configured with an ip from the untagged Vlan (192.168.0.200).

So - actually - it's highly probable that your Voice Server is connected to a Switch's access port which was configured as an untagged member of VLAN 1.

---

@mass1q wrote: The voice server has only one ethernet interface so, being a member of the untagged Vlan, is unable to ping any Vlan 10 phone, so I guess I need to change something in the switch. The voice server port should be an hybrid one to simultaneously communicate with both vlans, or maybe I just need a routing policy (I can do I with my firewall) between the two vlans

---

Don't worry for the single Ethernet interface: VLANs exist exactly to overcome that (to carry more networks through a single physical/logical link)...the only thing you really need Server side is a Ethernet's Interface Driver that is capable of setting IEEE 802.1Q VLAN Tagging on that interface...it shouldn't be an issue on a Server OS and for a typical Server's Hardware...so your Server will be able to concurrently be member of VLAN 1 (Untagged) and VLAN 10 (Tagged) having, on each one VLAN, its specific set of network settings (so be part, on each VLAN ids, of the associated subnet).

Clearly the Switch's access port used for your Voice Server should be modified to carry VLAN 10 traffic as tagged along with the VLAN 1 traffic as untagged it already carries...it means that that port must be configured to be tagged member of VLAN 10 too (typically on a HP ProCurve/Aruba switch this translates to a command like: interface ethernet <port-id> vlan tagged 10). No Hybrid port is necessary. On Comware based switches such type of port (able to carry more VLAN ids) is called a Trunk Port...but, pay attention that, on HP ProCurve/ArubaOS-Switch a Port Trunk represents instead a Link Aggregation (which is a logical interface).

Think about having a Host with two "logical legs" (those VLANs) over a single "physical leg" (the uplink to the Switch).

The routing between these VLANs is managed by your router (eventually the Switch if your scenario require the Switch to be the router, quite common).

Hello,

great explanation. I checked my config and the voice server is connected to a port that is a member of the untagged Vlan1 and the tagged Vlan 10 (so a trunk port in the "Cisco world") but no VLAN tagging is operated at the interface level, I don't even know if the interface can manage IEEE 802.1Q.

If I understood well what you said, if I set as the default gateway of my ip phones 192.168.1.1 (the ip of my VLAN10 in the core layer-3 switch) the switch will do the inter-vlan routing.

I had a look at the routing table of the layer-3 core switch:

0.0.0.0/0 192.168.1.254 10 static 250 1
127.0.0.0/8 reject static 0 0
127.0.0.1/32 lo0 connected 1 0
192.168.1.0/24 voce 10 connected 1 0
192.168.0.0/24 DEFAULT_VLAN 1 connected 1 0

Layer-2 switches carry the same VLAN10 so, any device connected, should be able to get the correct route from the core switch. My firewall is ip 192.168.0.254 for the untagged and 192.168.1.254 for the tagged, no static route since I suppose that the routing is operated at the switch level. is it correct or am I missing something? If routing works well I should be able to ping the tagged devices in the VLAN10 from the voice server in the untagged VLAN1