VLANS

[nathan]

That is a question for either a Layer3 switch or a router. We have no inter vlan routing and exclusion ACLs for our setup as that is the whole point of the guest wifi.

 

But if you have a half decent core switch or control of your router you should be able to do that. Our inter vlan routing is done by our core switch as that has the lowest distance overhead.

 

We don't want to separate our main wifi, just our guest one. We don't have control of our router but we've been told it can be easily setup.

[nathan]

Brill, thanks guys.

 

All i want to do is make sure the guest wifi is nowhere near our network and only has internet access.

[caffrey]

Is it considered best practice to use vlan 1 ? I'm having issues configuring routing on a netgear L3 switch because vlan 1 is considered the management vlan so I've been experimenting moving the domain to use a different vlan instead (and not having the best of luck)

[localzuk]

Best Practice is for VLAN 1 to be used for Switch/Network gear management only. Everything else should be on other VLANs ideally.

[caffrey]

So essentially the switch should look like this ?

 

 

The only thing I think that is wrong on there is that ports 1,23,24 should be tagged on vlan 10 to carry vlan 10 from switch to switch ?

[DPrince]

Worth mentioning that the definition of 'tagged' and 'untagged' is different depending on the manufacturer of your switches.

[Paul_Fielder]

We use netgear switches, and my understanding is, for devices such as VoIP which will auto tag traffic you set the port to tagged on that vlan. A workstation that needs to be on vlan 20 would be marked as untagged on vlan 20 and its pvid set to 20. Therfore all traffic entering the port would be tagged as vlan 20. Traffic on the uplink ports 21,22,23,24 should be untagged on every vlan that you want to leave the switch. Likewise untagged at the other end.

 

Hope that helps.

[localzuk]

We use netgear switches, and my understanding is, for devices such as VoIP which will auto tag traffic you set the port to tagged on that vlan. A workstation that needs to be on vlan 20 would be marked as untagged on vlan 20 and its pvid set to 20. Therfore all traffic entering the port would be tagged as vlan 20. Traffic on the uplink ports 21,22,23,24 should be untagged on every vlan that you want to leave the switch. Likewise untagged at the other end.

 

Hope that helps.

 

Untagged on the trunk ports? That isn't right. It should be tagged on all applicable VLANs, bar the "management VLAN" which should be untagged. You can only have a single "untagged" vlan on any port.

 

Think of it this way...

 

Tagged ports would more accurately be called "non-tagging" ports. They don't alter the traffic in any way. They just send everything that comes through them to the VLAN which they are tagged with. If a port is tagged with multiple ports, the traffic is analysed and sent to whichever port it is tagged with - but never altered.

Untagged ports would more accurately be called "tagging" ports. They alter the traffic by tagging it with the VLAN specified, so it goes to that VLAN.

 

So, if a port were to be "untagged" with more than 1 VLAN, it wouldn't know what to do with traffic - it can't direct it to 2 VLANs simultaneously.

 

(I know the technical implementation is not like that, but for a conceptual description, it works I feel).

[Paul_Fielder]

Untagged on the trunk ports? That isn't right. It should be tagged on all applicable VLANs, bar the "management VLAN" which should be untagged. You can only have a single "untagged" vlan on any port.

 

Think of it this way...

 

Tagged ports would more accurately be called "non-tagging" ports. They don't alter the traffic in any way. They just send everything that comes through them to the VLAN which they are tagged with. If a port is tagged with multiple ports, the traffic is analysed and sent to whichever port it is tagged with - but never altered.

Untagged ports would more accurately be called "tagging" ports. They alter the traffic by tagging it with the VLAN specified, so it goes to that VLAN.

 

So, if a port were to be "untagged" with more than 1 VLAN, it wouldn't know what to do with traffic - it can't direct it to 2 VLANs simultaneously.

 

(I know the technical implementation is not like that, but for a conceptual description, it works I feel).

 

Your are a absolutely right, posted before coffee, never a good idea. 😴