NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Network switch selection for VLAN design
I currently have an unmanaged network consisting of a 24 port switch, 3 - 8 port switches, a Netgear RS series router and a cable company supplied modem. Several IOT devices reside on this network, and I would like to redesign to include managed switches to facilitate the use of VLANS to segment my IOT and streaming devices. A rough picture of the current design is below.
My Questions.
- Should I consider replacing Switches A and B with new managed switches or can I get away with replacing the 8 port Port switch at B and put a new 4 port switch between the IOT devices and my main 24 port switch. ( and no, because of location and wiring constraints switch B must also connect to router.
- For the purpose of establishing simple VLANs for IOT, would the GS 3xxseries (GS 308E and GS305E) easy smart managed switches from Netgear work?
23 Replies
However, based on your comments I just realized that there is a new IOT network option. I think you have hit on something here. I can use a wireless bridge for the IOT devices connected to Router A, and connect that to the IOT network. Then I just need to determine an option for the IOT devices currently connected to Switch B.
A question about devices on the IOT network. Can they communicate with each other or are they only allowed to access internet traffic (like the guest network)?
I have been reading the RS600 manual and am a bit confused. There is a VLAN/Bridge mode that can be enabled. It looks like if I enable it I can specify VLAN tag groups by either Ethernet port or wireless network. The documentation suggests that the use of VLAN tagging supersedes Nat translation. So, (at least for switch B), couldn't I replace it with a managed switch, create a vlan on the switch for the IOT devices, define the port that connects the switch and router as a trunk port, and then create a VLANon the RS 600 for the port the managed switch is connected to?
Actually, never mind. I see that the VLAN settings appear to only operate in bridge mode.
Not correct. Its about the WAN facing bridge only, and it's VLAN config options are applicable to the WAN (Internet) port only. The VLAN config there is for Internet connections requiring ISP specific VLAN configurations only.
If I repurpose some old routers as APs, I could potentially hook up the IOT devices and use the guest network on the RS600 to isolate these from the rest of the network.
Again: Neither the Guest network nor the IoT network of the RS600 is available on the Ethernet LAN. Sso no way to connect a Wireless Access Point.
Unless one of your spare units can be repurposed as a Wireless Client, so becoming a bridge, allowing to establish a network connection. And that port can be connected to an access port on a Smart or Managed switch - this could create an Ethernet VLAN, being for the guest network, or an IoT VLAN.
P.S. Stephan,
I am curious, does my wireless router use a VLAN behind the scenes to isolated the guest wireless network from the rest of my network
am curious, does my wireless router use a VLAN behind the scenes to isolated the guest wireless network from the rest of my network
Nothing the like is documented officially for the Netgear Nighthawk RS routers - different from Netgear Orbi mesh systems.
Then how does it Isolate the current wireless guest network from the non-guest wireless network and wired ethernet. Both the documentation and my testing support that isolation. I have an RS600
Actually I think I may have figured out part of my questions. It seems that any switch which wither has to support multiple VLANS or forward VLAN traffic need to be managed. So in my config Switches A B and C would need to me be managed. It also looks like I will need to change the configuration so Switch A chains off Switch B, and that hooks up to the router instead of both A and B.
Stephen, I am curious about your comments on wireless traffic. Right now no IOT device communicates on Wireless. Any wireless TV or phone only uses my guest network. I only use main wireless for a couple of laptops. Are you saying that if I implement vlans appropriately at the switch level, the router will still see these as part of the whole network including the non-guest wireless, thus violating the isolation between them?
Actually I think I may have figured out part of my questions. It seems that any switch which wither has to support multiple VLANS or forward VLAN traffic need to be managed. So in my config Switches A B and C would need to me be managed. It also looks like I will need to change the configuration so Switch A chains off Switch B, and that hooks up to the router instead of both A and B.
Not quite. If all devices connected to a switch are on the same VLAN, then that switch does not need to support VLANs (and can be unmanaged).
In your current configuration, the router needs to support VLANs, as well as switch B. Switch A might not.
If you put a smaller smart switch between the router and switch B that supports VLANs, then you can move all the IoT devices to that new switch. In that case, you can continue to use switch B as your main switch, as it wouldn't need to support VLANs.
The way this works is that the port on the new switch that is connected to switch B is configured in the new switch as being on the main network. VLAN tags aren't needed for that port. The port connecting the new switch to the router is set up as a trunk - carrying traffic from all devices to the router. So that port is configured to be in all VLANs (including the main network), and the packets would carry VLAN tags. The associated router ethernet port also needs to be VLAN aware, and be able to handle the VLAN tags.
Similarly, the router port going to switch A is either dedicated to the IoT VLAN (if only IoT devices are connected to it), or it is also a trunk connection like the one to the new switch (if there is a mix of IoT and main network devices).
But there is another piece of the puzzle. Even if you have an IoT VLAN, your main ethernet-connected devices won't be isolated from the VLAN unless you set up the routing to preserve the isolation at layer 3 (not just layer 2). The RS series router simply doesn't have the features you need to do that.
Double-routing (as I suggested in my first response) is one work-around, or you can get a wired enterprise-class router/firewall, and use the RS series as an AP. There is significant learning curve if you go with the enterprise-class router.
Double-routing (as I suggested in my first response) is one work-around,
Here's what double-routing would look like. You'd add a consumer router and an unmanaged switch. The graphic is messy (I started with your diagram), but this should give you the idea.
Only the IoT clients are connected to the top (edge) router. All your other clients are connected to the bottom (inner) router.
The IoT devices cannot reach your other clients, because the NAT in the inner router blocks that. But the regular clients can reach the IoT devices. (Media streamers might need to be connected to the inner network). The two routers would use different IP subnets - for instance, 192.168.1.x for the edge router, and 10.0.0.x for the inner router.
It should be less expensive than your VLAN implementation, as that requires replacing the router with an enterprise class one and maybe adding smart or managed switches. Also, easier to set up, since there is no learning curve.
Stephen, I am curious about your comments on wireless traffic.
Starting from the basics -
Your devices are communicating using layered protocols.
Layer 2 is ethernet and wifi packets. Each device has a unique MAC (Media Access Control) address that is used in the destination field of the packets to send packets to that device. There a also a broadcast MAC address (ff:ff:ff:ff:ff:ff:ff) that tells your routers and switches to broadcast the packet to all devices on the network. All of this works without IP addresses and routing. Your switches don't care about IP addresses, they instead learn the MAC addresses of all the devices on your network (keeping track of what port they are connected to). They forward each packet to the correct detination port if they know it (and if they don't, they broadcast the packet to all their ports)
Now, the devices that the broadcast packet reaches is called the "broadcast domain". A VLAN is defined to be a broadcast domain. In other words, a broadcast packet sent by a device on a VLAN will only reach other devices on that VLAN. Technically this is done by adding a "tag" to the ethernet/wifi packet that tells routers and switches (that support VLANs) what VLAN the packet is associated with. This effectively isolates each VLAN from other VLANs on your network.
"Above" this layer 2 communications is layer 3. This layer uses IP addresses for routing packets (not the MAC addresses).
If you send a packet to an IP address on another VLAN, that packet will eventually reach your router, and the router will route it to that VLAN. Since your router doesn't support VLANs, the only way to prevent that from happening is to make sure the VLAN is isolated from your router. With your topology, that would also prevent the devices on that VLAN from reaching the internet.
I am curious, does my wireless router use a VLAN behind the scenes to isolated the guest wireless network from the rest of my network
That is one way to do it (and is the way my Orbi mesh does it). The VLAN tag makes it easy for the main router to know if a packet is coming from (or going to) a guest-network device connected to a satellite.
But since there is no mesh in your case, the packets don't have to be tagged with the VLAN since everything going through one device (the router).
I do need to correct something I said earlier. Some Netgear routers allow devices on the guest network to communicate with the local ethernet-connected devices, others do not. I don't have an RS-series, so I am not certain if it allows that or not. (The trend is for newer routers to isolate guest from ethernet).
If the RS does isolate guest from ethernet, then that will not change when you add VLANs. Similarly, if the RS does not isolate guest from ethernet, then adding VLANs won't change that either.
Several things are unclear to me. Does steaming mean you have some media players with live TV allowing zapping?
That won't allow that if your TV boxes will be on a different VLAN, and even less from a single consumer router, or ISP supplied routers, or like almost any Netgear routers, except of the business/AV models like the PR60X.
Even worse, if you expect to use App or WiFi based remotes or Apps to control eg switching TV programs, play other media from local NAS, Tour mobiles need to be connected to the same SSID. Ad-hoc switching wireless networks makes up a very bad usability.
IoT does not require Internet access?
Streaming Devices (like ISP supplied TV Boxes?) don't need Internet access?
For each VLAN - primary LAN like in your unmanaged switches today, IoT devices, and Streaming Boxes (each operating on a dedicated IPv4 subnet for segregation) require some router functionality for NAT, and probably DHCP for each VLAN - your Netgear RS router can't handle all this.
Said that: For multiple VLANs, there is no way around a router supporting at least two networks, being VLAN, or dedicated physical Ethernet ports.
Once you have these requirements covered, you can start brainstorming on the switches. Where you can't reach anything on unmanaged switches.
Sorry, a little but short reply away from home, on Holidays as of writing.
PS. As we know for sure Unmanaged Switches are not appropriate for your project, a moderator has moved this thread to the Easy Smart, Plus, and Smart Switches section
can I get away with replacing the 8 port Port switch at B and put a new 4 port switch between the IOT devices and my main 24 port switch.
FWIW, you haven't said how the streaming devices are connected. Are they also connected only to switch A and B?
Another aspect is how much isolation you want for the IoT devices. You won't be able to isolate them from the wifi network with this arrangement, since the RS routers don't have the VLAN features you need. I am assuming you want that isolation.
You could connect a wired router (or L2/L3 switch with routing functions) to the modem, and then use the RS router as an AP. As far as Netgear kit goes, the GS728 series switches have routing functions built in, so you could potentially connect one of those to the modem. Ideally this would replace switch A, though that depends on whether wiring allows that. Check the manual to make sure it has the routing functions you want.
Of course, one of Netgear's fully managed switches would also work as an edge router.
Is the modem actually a gateway (perhaps in bridge mode)? If it is, you could use the gateway as the edge router (turning off the wifi), and continue to use the RS router in router mode. Then use switches connected to the gateway for the wired IoT devices. These could be unmanaged switches, since the NAT in the RS router would prevent the IoT devices from reaching the RS router network. The RS-connected devices could still reach the IoT devices. The downside here is that you'd have a double-NAT configuration. This is managable, though a bit more complicated if you do port forwarding.
The third option is to get a new small wired router with full VLAN support, and use the RS router as an AP. Unfortunately, Netgear doesn't sell one, so you'd need to use another vendor. As far as switches go, if you have only IoT devices connected to switch B, you'd be able to use connect it to the wired router, and set up the router LAN port as an untagged VLAN. You could also get a small smart switch to connect the IoT devices currently on switch A to the wired router (also connecting that to existing switch A). The GS305E or GS308E switch would work for that.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
