What happens if several VLANs are set to fixed? Will it cause a conflict, or will it ask the ZyWall, as the ZyWall can specify which subnets are allowed in what VLANs. Now, to the Control settings on Static VLAN.Īs far as I can see, if it's fixed, devices connected to the port automatically is set in the VLAN that is set to fixed.
The ZyWall then decides what happens to the traffic from then on. All VLANs that are supposed to reach the ZyWall, needs to have Tx Tagging enabled on the trunk port.Tx Tagging should only be activated on ports that talk with devices that understand VLAN tagged packets, like some APs and the ZyXel USG40 (hence forth referred to as "the ZyWall"). The 'default gateway' configured on clients in all the other networks/zones will be in their respective zone , so as long as those zones are allowed access to whatever other zones they need to communicate with, it will work fine. Assuming there is only 'management' interfaces/IPs in this network, that is the 'proper' way to do it. You said: Will all traffic be blocked if all traffic to VLAN 10 (Network equipment) is blocked? If you do not need to accept INCOMING connections(a connection coming from WAN to ZONE_xxx) then you do not need a rule allowing traffic from WAN. If only traffic to WAN was allowed, replies from WAN would be dropped? You said: I'm assuming that both traffic from and to WAN must be allowed for internet access. I would suggest setting them to 'Internal' so you don t have to mess around with setting routes for everything, you can use firewall/Security Policy to control access to other zones/networks, MUCH easier. If they are set to general, that means the built-in 'internal' routes are disabled and you will need to manually setup routes for these VLANs to all other networks including the internet. Also you said you have all VLANs set to 'General'. You said you have DHCP disabled on the VLANs, I assume you are manually assigning IPs?ģ. EDIT: actually it looks like ALL of your physical eth_xxx interfaces are in the same subnet, you need to change this I noticed your eth_wan1 interface(10.1.10.2) is in the same subnet as your eth_lan1 interface(10.1.10.3)- why? This is going to screw up routing. In the doc linked above, you stated: Still none of my devices connected to the switch (or directly to the USG40) gets a connectionġ.
0 kommentar(er)
