nathan Posted July 10, 2014 Author Posted July 10, 2014 That is a question for either a Layer3 switch or a router. We have no inter vlan routing and exclusion ACLs for our setup as that is the whole point of the guest wifi. But if you have a half decent core switch or control of your router you should be able to do that. Our inter vlan routing is done by our core switch as that has the lowest distance overhead. We don't want to separate our main wifi, just our guest one. We don't have control of our router but we've been told it can be easily setup.
nathan Posted July 10, 2014 Author Posted July 10, 2014 Brill, thanks guys. All i want to do is make sure the guest wifi is nowhere near our network and only has internet access.
caffrey Posted July 11, 2014 Posted July 11, 2014 Is it considered best practice to use vlan 1 ? I'm having issues configuring routing on a netgear L3 switch because vlan 1 is considered the management vlan so I've been experimenting moving the domain to use a different vlan instead (and not having the best of luck)
localzuk Posted July 11, 2014 Posted July 11, 2014 Best Practice is for VLAN 1 to be used for Switch/Network gear management only. Everything else should be on other VLANs ideally.
caffrey Posted July 12, 2014 Posted July 12, 2014 So essentially the switch should look like this ? The only thing I think that is wrong on there is that ports 1,23,24 should be tagged on vlan 10 to carry vlan 10 from switch to switch ?
DPrince Posted July 12, 2014 Posted July 12, 2014 Worth mentioning that the definition of 'tagged' and 'untagged' is different depending on the manufacturer of your switches.
Paul_Fielder Posted July 12, 2014 Posted July 12, 2014 We use netgear switches, and my understanding is, for devices such as VoIP which will auto tag traffic you set the port to tagged on that vlan. A workstation that needs to be on vlan 20 would be marked as untagged on vlan 20 and its pvid set to 20. Therfore all traffic entering the port would be tagged as vlan 20. Traffic on the uplink ports 21,22,23,24 should be untagged on every vlan that you want to leave the switch. Likewise untagged at the other end. Hope that helps.
localzuk Posted July 12, 2014 Posted July 12, 2014 We use netgear switches, and my understanding is, for devices such as VoIP which will auto tag traffic you set the port to tagged on that vlan. A workstation that needs to be on vlan 20 would be marked as untagged on vlan 20 and its pvid set to 20. Therfore all traffic entering the port would be tagged as vlan 20. Traffic on the uplink ports 21,22,23,24 should be untagged on every vlan that you want to leave the switch. Likewise untagged at the other end. Hope that helps. Untagged on the trunk ports? That isn't right. It should be tagged on all applicable VLANs, bar the "management VLAN" which should be untagged. You can only have a single "untagged" vlan on any port. Think of it this way... Tagged ports would more accurately be called "non-tagging" ports. They don't alter the traffic in any way. They just send everything that comes through them to the VLAN which they are tagged with. If a port is tagged with multiple ports, the traffic is analysed and sent to whichever port it is tagged with - but never altered. Untagged ports would more accurately be called "tagging" ports. They alter the traffic by tagging it with the VLAN specified, so it goes to that VLAN. So, if a port were to be "untagged" with more than 1 VLAN, it wouldn't know what to do with traffic - it can't direct it to 2 VLANs simultaneously. (I know the technical implementation is not like that, but for a conceptual description, it works I feel).
Paul_Fielder Posted July 12, 2014 Posted July 12, 2014 Untagged on the trunk ports? That isn't right. It should be tagged on all applicable VLANs, bar the "management VLAN" which should be untagged. You can only have a single "untagged" vlan on any port. Think of it this way... Tagged ports would more accurately be called "non-tagging" ports. They don't alter the traffic in any way. They just send everything that comes through them to the VLAN which they are tagged with. If a port is tagged with multiple ports, the traffic is analysed and sent to whichever port it is tagged with - but never altered. Untagged ports would more accurately be called "tagging" ports. They alter the traffic by tagging it with the VLAN specified, so it goes to that VLAN. So, if a port were to be "untagged" with more than 1 VLAN, it wouldn't know what to do with traffic - it can't direct it to 2 VLANs simultaneously. (I know the technical implementation is not like that, but for a conceptual description, it works I feel). Your are a absolutely right, posted before coffee, never a good idea. 😴
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now