NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
VLAN Tagging for Guest Network
I've seen a couple of posts about this in the past on this forum, but all of them appear to be kinda old, and before you could uncheck the "Allow Guests to see each other and access my local network"...
sdct989 wrote:
I have my own router/DHCP/firewall/gateway that I want to keep using, so I have put my Orbi network into AP only mode. However, I would still like to have a guest network that I'm able to separate at my router. I would like to do this via VLAN tagging. So my questions are:
Is this something that Orbi is capable of now?
If not, is this something that will be available in the future? And if so, is there a way to be notified when it is available?
What actually happens when you uncheck "Allow Guests to see each other and access my local network" while in AP only mode? Does the Orbi just start NAT'ing and serving it's own DHCP at that point?
Lastly, assuming that it's not already a thing, I would like to chime in with others here and say that I would REALLY like to see VLAN tagging as an option in the advanced interface.
hi , once in AP mode the theory is that all it is a pure wireless access point and your upstream router is doing the actual routing and vlan functionality
vlan is usually an advanced feature of the router not the ap
will have a look at this during this weekend and try and get back to you but i think the "Allow guests to see each other and access my local network" only works in router mode
"hi , once in AP mode the theory is that all it is a pure wireless access point and your upstream router is doing the actual routing and vlan functionality. vlan is usually an advanced feature of the router not the ap"
This is inaccurate and a common misconception. APs should have VLAN tagging support per SSID (or at least non-guest and guest). While modern routers do support VLAN technologies, APs and switches through which a given network pass are required to support the same or have compensatory systems where one or more devices does not.
Even in home deployments (that is, SOHO), having VLAN tagging is desirable. Every home network in my opinion should have at least three networks nowadays. While not typcial, my home has the following networks:
* Security: my contracted security system
* Security-Home: my backup security system
* Guest: for guests
* Internal: general family network
* Voice: voip phones/devices
* Risk: for things I must use but don't want to
* Protected: my main servers and dot1x authenticated devices
* Lab1: a lab I share with my friends/colleagues that ties to virtual networks
* Lab2: another lab like Lab1 based on virtualization
Each of the above have an IP subnet (CIDR) with dedicated security policies. At most of the edge, these methods address VLAN assignment:
* SSID (two SSIDs share a VLAN but the rest do not)
* RADIUS assigned VLAN
* MAC-based VLAN
* Port-based VLAN
* Device-tagged VLAN
There are other tecnhniques that can be used as well such as IP-based VLAN assignment.
If one did have VLAN by SSID assignment on the Orbi, the devices upstream of the AP must either leverage one or more of the above features. Normally these are the domain of the switch/bridge (such as MAC and IP based VLAN assignments) or those devices must have enough interfaces if port-based asssignment is the primary means. For example, the router must support the tagging (trunk, at which point an IRB/RVI interface is associated with the VLAN), have enough physical interfaces, and/or leverage alternate technologies (such as MAC VLAN assignment).
Because this is another Netgear's forum, I will not post to competing products that can perform the roles. However, I will comment that Netgear does sell affordable switches with the features required to do everything I just said.
Some vendors do use a NATed guest mode but this is a poor handling especially in larger homes if guest mobility is important. Such a mode also pulls certain policy application to the AP where it may not be best suited.
After having said all that, every vendor including Netgear should have VLAN tagging support in consumer equipment at this point but especially at the AP and router as those are most often directly connected. The year is 2017 - we all benefit by having better security and security is greatly aided by basic network segmentation.
Cheers.
- Matthew Kurowski