This inexpensive SOHO/Small biz router has a simple and pretty feature-rich implementation of vlan routing. Configuring vlans on the ZyWall is so simple, that you’ll wish your switches were as easy to configure.

There’s a succinct overview of interfaces in the USG 50 Command Line Interface manual, named “ZyWall USG 50_4.pdf”, on their site.

To learn about tagging, read about IEEE 802.1q.

The USG-50 manual has a few pages about vlans, and no examples, which is a shame.

A VLAN is a technology that allows you to segment a physical LAN into multiple Virtual LANs.  You can also look at it the other way around: you can create multiple VLANs on one physical LAN, and have multiple VLANs on a single ethernet port.

Before discussing VLANs too deeply, let’s define the term “interface.” In this router, an interface is analogous to an ethernet interface card with a single IP address, but it is not a physical thing, at all. This interface is not a physical ethernet port: it is virtualized.

An interface is the IP address where the router exists within a network’s IP address space.

You can create a virtual interface that will appear at another IP address. (In Linux these used to be called aliases, and they have names like lan1:1.)

The interface connecting a VLAN to the router is the vlan interface. The VLAN interface is like a virtual interface; it has an IP address, and the VLAN’s nodes send traffic to the router through that IP address.

The router has four Ethernet ports for LANs, but none of these is an interface — interfaces are associated with ethernet port roles, each of which is associated with one or more ethernet ports. The router has three port roles: LAN1, LAN2, and DMZ. It seems like these roles cannot be changed (but you can rearrange the ports to be in different roles).

So, ports are assigned to roles, and roles are associated with VLANS, and VLANs with interfaces.

Example: if you have the default setup for the ethernet ports P3 – P6, the interface lan1 is on ports P3 and P4, and they are basically connected like a switch, in hardware. lan1 is the interface. You can add additional VLAN interfaces to lan1.

Example: we have two VLANs on our switches, and they uplinked via ethernet port P3. You would set up two VLAN interfaces, vlan1 and vlan2. Vlan1 would have an ip address, e.g. Vlan2 would have a different ip address, e.g.

P3 has two VLANs, and each VLAN has its own VLAN interface.

You could set the gateways to the WAN IP address, but I think you can leave this blank and it’ll default to the wan trunk (so the router will choose).

A VLAN cannot span two interfaces

That is to say, you cannot create a VLAN with the same name and assign it to two interfaces, hoping that the VLAN’s traffic is routed across the interface. This isn’t a failure of the router. By definition, a VLAN is just like a LAN; a router has one interface on a LAN. The router then routes traffic between lans.

If you think you can do this, you should look at this diagram:


VLANs and Uplink at the Switch

Remember, at the switch, make the uplink port a tagged port (a vlan trunk in Cisco terminology), so the uplink connection to the router will pass all the vlans traffic to the router. Read this to learn a bit about the differences in terminology between Cisco and the 802.1q standard.

VLANs everywhere, or just some places? (Gripe Section)

The network I’m reconstructing has around 60 nodes, and it’s already split into two networks. I want to connect the entire thing into one giant LAN, then separate it into VLANs. The only problem is, there might not be adequate wiring to do this, as some things have changed between the planning phase and execution phase.

If, as noted above, ports P3 and P4 aren’t really on the same switch, and it doesn’t pass vlan traffic across the two segments, then I’m in trouble. So now I have to contemplate using two physically separate networks. The big pain in the butt is that now, if I put a node on network 1, it cannot participate in network 2, and vice versa.


Leave a comment

Leave a Reply