Network switch selection for VLAN design

CKopp wrote:

Stephen, I am curious about your comments on wireless traffic. 

Starting from the basics - 

Your devices are communicating using layered protocols. 

Layer 2 is ethernet and wifi packets. Each device has a unique MAC (Media Access Control) address that is used in the destination field of the packets to send packets to that device.  There a also a broadcast MAC address (ff:ff:ff:ff:ff:ff:ff) that tells your routers and switches to broadcast the packet to all devices on the network.  All of this works without IP addresses and routing.  Your switches don't care about IP addresses, they instead learn the MAC addresses of all the devices on your network (keeping track of what port they are connected to).  They forward each packet to the correct detination  port if they know it (and if they don't, they broadcast the packet to all their ports)

Now, the devices that the broadcast packet reaches is called the "broadcast domain".   A VLAN is defined to be a broadcast domain. In other words, a broadcast packet sent by a device on a VLAN will only reach other devices on that VLAN.  Technically this is  done by adding a "tag" to the ethernet/wifi packet that tells routers and switches (that support VLANs) what VLAN the packet is associated with.  This effectively isolates each VLAN from other VLANs on your network.

"Above" this layer 2 communications is layer 3.  This layer uses IP addresses for routing packets (not the MAC addresses).

If you send a packet to an IP address on another VLAN, that packet will eventually reach your router, and the router will route it to that VLAN.   Since your router doesn't support VLANs, the only way to prevent that from happening is to make sure the VLAN is isolated from your router.  With your topology, that would also prevent the devices on that VLAN from reaching the internet.

CKopp wrote:

I am curious, does my wireless router use a VLAN behind the scenes to isolated the guest wireless network from the rest of my network

That is one way to do it (and is the way my Orbi mesh does it).  The VLAN tag makes it easy for the main router to know if a packet is coming from (or going to) a guest-network device connected to a satellite.

But since there is no mesh in your case, the packets don't have to be tagged with the VLAN since everything going through one device (the router).   

I do need to correct something I said earlier.  Some Netgear routers allow devices on the guest network to communicate with the local ethernet-connected devices, others do not.  I don't have an RS-series, so I am not certain if it allows that or not.  (The trend is for newer routers to isolate guest from ethernet). 

If the RS does isolate guest from ethernet, then that will not change when you add VLANs.  Similarly, if the RS does not isolate guest from ethernet, then  adding VLANs won't change that either. 

CKopp wrote:

Actually I think I may have figured out part of my questions.   It seems that any switch which wither has to support multiple VLANS or forward VLAN traffic need to be managed.  So in my config Switches A B and C would need to me be managed.   It also looks like I will need to change the configuration so Switch A chains off Switch B, and that hooks up to the router instead of both A and B.

Not quite.  If all devices connected to a switch are on the same VLAN, then that switch does not need to support VLANs (and can be unmanaged).  

In your current configuration, the router needs to support VLANs, as well as switch B.  Switch A might not.

If you put a smaller smart switch between the router and switch B that supports VLANs, then you can move all the IoT devices to that new switch.  In that case, you can continue to use switch B as your main switch, as it wouldn't need to support VLANs.

The way this works is that the port on the new switch that is connected to switch B is configured in the new switch as being on the main network.  VLAN tags aren't needed for that port.  The port connecting the new switch to the router is set up as a trunk - carrying traffic from all devices to the router.  So that port is configured to be in all VLANs (including the main network), and the packets would carry VLAN tags.  The associated router ethernet port also needs to be VLAN aware, and be able to handle the VLAN tags.

Similarly, the router port going to switch A is either dedicated to the IoT VLAN (if only IoT devices are connected to it), or it is also a trunk connection like the one to the new switch (if there is a mix of IoT and main network devices).

But there is another piece of the puzzle.  Even if you have an IoT VLAN, your main ethernet-connected devices won't be isolated from the VLAN unless you set up the routing to preserve the isolation at layer 3 (not just layer 2).  The RS series router simply doesn't have the features you need to do that. 

Double-routing (as I suggested in my first response) is one work-around, or you can get a wired enterprise-class router/firewall, and use the RS series as an AP.  There is significant learning curve if you go with the enterprise-class router.