NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Network switch selection for VLAN design
I currently have an unmanaged network consisting of a 24 port switch, 3 - 8 port switches, a Netgear RS series router and a cable company supplied modem. Several IOT devices reside on this network, ...
Actually I think I may have figured out part of my questions. It seems that any switch which wither has to support multiple VLANS or forward VLAN traffic need to be managed. So in my config Switches A B and C would need to me be managed. It also looks like I will need to change the configuration so Switch A chains off Switch B, and that hooks up to the router instead of both A and B.
Not quite. If all devices connected to a switch are on the same VLAN, then that switch does not need to support VLANs (and can be unmanaged).
In your current configuration, the router needs to support VLANs, as well as switch B. Switch A might not.
If you put a smaller smart switch between the router and switch B that supports VLANs, then you can move all the IoT devices to that new switch. In that case, you can continue to use switch B as your main switch, as it wouldn't need to support VLANs.
The way this works is that the port on the new switch that is connected to switch B is configured in the new switch as being on the main network. VLAN tags aren't needed for that port. The port connecting the new switch to the router is set up as a trunk - carrying traffic from all devices to the router. So that port is configured to be in all VLANs (including the main network), and the packets would carry VLAN tags. The associated router ethernet port also needs to be VLAN aware, and be able to handle the VLAN tags.
Similarly, the router port going to switch A is either dedicated to the IoT VLAN (if only IoT devices are connected to it), or it is also a trunk connection like the one to the new switch (if there is a mix of IoT and main network devices).
But there is another piece of the puzzle. Even if you have an IoT VLAN, your main ethernet-connected devices won't be isolated from the VLAN unless you set up the routing to preserve the isolation at layer 3 (not just layer 2). The RS series router simply doesn't have the features you need to do that.
Double-routing (as I suggested in my first response) is one work-around, or you can get a wired enterprise-class router/firewall, and use the RS series as an AP. There is significant learning curve if you go with the enterprise-class router.
Double-routing (as I suggested in my first response) is one work-around,
Here's what double-routing would look like. You'd add a consumer router and an unmanaged switch. The graphic is messy (I started with your diagram), but this should give you the idea.
Only the IoT clients are connected to the top (edge) router. All your other clients are connected to the bottom (inner) router.
The IoT devices cannot reach your other clients, because the NAT in the inner router blocks that. But the regular clients can reach the IoT devices. (Media streamers might need to be connected to the inner network). The two routers would use different IP subnets - for instance, 192.168.1.x for the edge router, and 10.0.0.x for the inner router.
It should be less expensive than your VLAN implementation, as that requires replacing the router with an enterprise class one and maybe adding smart or managed switches. Also, easier to set up, since there is no learning curve.
Here's what double-routing would look like. You'd add a consumer router and an unmanaged switch. The graphic is messy (I started with your diagram), but this should give you the idea.
Double NATing would not allow any IGMP Multicast based live TV then. The IGMP Proxy exists in the primary NAT router only, it won't span over to the next NAT router.
The IGMP Proxy allows magically NATing a dedicated ISP IPTV VLAN to the primary router LAN and subnet, on a RFC1918 private network.
The OP won't be able to operate such IGMP based TV boxes behind yet another BAT router for various reasons. The most obvious one? The second BAT router doesn't see the IPTV VLAN provided by the ISP.
If the community members are seeking for assistance, a bare minimum of information is required. A little bit more than "TV Boxes". What ISP, what IPTV service, what TV boxes are the care minimum.
Don't understand why people don't want to listen.
Double NATing would not allow any IGMP Multicast based live TV then. The IGMP Proxy exists in the primary NAT router only, it won't span over to the next NAT router.
CKopp would prefer them to be isolated (so connected to the edge router, not the inner router). If that is practical, then the IGMP proxy will not be a barrier for him.
Whether this is possible depends on the source of the media they are streaming. If the media is being streamed from a local PC or phone, then the media streamer would need to be connected to the inner router (and not isolated). That is why I said the media streamers might need to be connected to the inner router.
FWIW, my own set top boxes are connected to my edge router (ISP supplied) - they won't work otherwise. That connection is done with an old Orbi in AP mode - so the constraint is not implemented with an IPTV VLAN.
The TVs are connected to my inner router (Orbi). So the TVs are not isolated from the main network in my setup.
If the community members are seeking for assistance, a bare minimum of information is required. A little bit more than "TV Boxes".
Agreed that we'd need to know more about what these are and what services they use, in order to sort out what it takes to isolate them from other clients.
I had already thought of tiering two routers to isolate but was wondering if that makes it challenging to regulate traffic via armor or other AV software for devices on network). Also The physical location and current network wiring doesn't support this design with out re-wiring ( Switch A and its IOT devices are in one physical location, switch B is in another along with the router, and only one connection between Switch a and this location exist) this was why I was thinking VLANS may make it easier but now not so much.
A few points.
- Streaming is all handled by standard Roku or fire devices. Have had multiple ISPs (Spectrum/TDS, etc.) and that as never mattered before, but it sounds like not all ISPs support VLAN traffic for streaming?
- The IOT and streaming devices need two way communication with the internet. (With one exception (a TIVO with an remote device which I was planning to address separately) no other devices need to communicate with either the IOT devices or the streaming devices.
- Main reason for looking at VLANs was to isolate IOT devices. not so much for wired streaming devices, and wireless streaming already isolated on guest network.
- The IOT devices communicate wirelessly via dedicated connections to hubs which are connect via wired network.
A couple questions.
If the edge router were compromised, I assume the inner router would still provide the same level of protection for everything other than what on the edge network, assuming it remains uncompromised - correct?
If Armor runs on the inner network, I assume its operation would continue as before, just with isolation to activity to and from the inner network - correct?
Thanks to everyone for the feedback. I may just have to bite the bullet and re-wire a new line and run an edge router.
If the edge router were compromised, I assume the inner router would still provide the same level of protection for everything other than what on the edge network, assuming it remains uncompromised - correct?
Correct.
If Armor runs on the inner network, I assume its operation would continue as before, just with isolation to activity to and from the inner network - correct?
Also correct.
( Switch A and its IOT devices are in one physical location, switch B is in another along with the router, and only one connection between Switch a and this location exist) this was why I was thinking VLANS may make it easier but now not so much.
You can avoid rewiring if that is too expensive.
If you can get good wifi performance with the inner router at the switch B location, then you'd connect the edge router to a new unmanaged switch (also co-located at switch B). That new switch would be connected to the wired IoT devices, and also to the inner router. Switch B is connected to the inner router of course.
If you want to co-locate the inner router and the edge router, then it is still possible (but a bit more expensive). You'd get two smart switches (the GS300 series you mentioned in your first post), and put one at the router location and one at the switch B location. You'd create two VLANs - one for the edge router's LAN, the other for the inner router's LAN. Both routers would have a LAN port connected to the router side smart switch, then the link between the two smart switches would be a trunk that carries both VLANs. Then the new smart switch at router B has the IoT ports configured as the edge VLAN, and a port going to switch B that is configured as the inner router LAN. Layer 3 isolation is achieved because the two VLANs go to different routers.
This second approach is what I currently use - I need both inner and outer networks at the our two TVs, so I have a small smart switch at both those locations.
There is one other possible approach I am considering. If I repurpose some old routers as APs, I could potentially hook up the IOT devices and use the guest network on the RS600 to isolate these from the rest of the network. Hmmm, some more thinking to do. Otherwise my RS600 is quite powerful, I'll need to rewire, rebuild the shelf location and get a powerful enough edge router so as to not constrain the throuhput.
Helpful info
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
