Network switch selection for VLAN design

CKopp wrote:

Stephen, I am curious about your comments on wireless traffic. 

Starting from the basics - 

Your devices are communicating using layered protocols. 

Layer 2 is ethernet and wifi packets. Each device has a unique MAC (Media Access Control) address that is used in the destination field of the packets to send packets to that device.  There a also a broadcast MAC address (ff:ff:ff:ff:ff:ff:ff) that tells your routers and switches to broadcast the packet to all devices on the network.  All of this works without IP addresses and routing.  Your switches don't care about IP addresses, they instead learn the MAC addresses of all the devices on your network (keeping track of what port they are connected to).  They forward each packet to the correct detination  port if they know it (and if they don't, they broadcast the packet to all their ports)

Now, the devices that the broadcast packet reaches is called the "broadcast domain".   A VLAN is defined to be a broadcast domain. In other words, a broadcast packet sent by a device on a VLAN will only reach other devices on that VLAN.  Technically this is  done by adding a "tag" to the ethernet/wifi packet that tells routers and switches (that support VLANs) what VLAN the packet is associated with.  This effectively isolates each VLAN from other VLANs on your network.

"Above" this layer 2 communications is layer 3.  This layer uses IP addresses for routing packets (not the MAC addresses).

If you send a packet to an IP address on another VLAN, that packet will eventually reach your router, and the router will route it to that VLAN.   Since your router doesn't support VLANs, the only way to prevent that from happening is to make sure the VLAN is isolated from your router.  With your topology, that would also prevent the devices on that VLAN from reaching the internet.

CKopp wrote:

I am curious, does my wireless router use a VLAN behind the scenes to isolated the guest wireless network from the rest of my network

That is one way to do it (and is the way my Orbi mesh does it).  The VLAN tag makes it easy for the main router to know if a packet is coming from (or going to) a guest-network device connected to a satellite.

But since there is no mesh in your case, the packets don't have to be tagged with the VLAN since everything going through one device (the router).   

I do need to correct something I said earlier.  Some Netgear routers allow devices on the guest network to communicate with the local ethernet-connected devices, others do not.  I don't have an RS-series, so I am not certain if it allows that or not.  (The trend is for newer routers to isolate guest from ethernet). 

If the RS does isolate guest from ethernet, then that will not change when you add VLANs.  Similarly, if the RS does not isolate guest from ethernet, then  adding VLANs won't change that either.