2

Ok, I have a basic understanding of VLAN's but I am trying to do the following setup which seems way more complicated than it should be because of things I am not sure of. I am doing this because we had a professional hacker come in and they said that I need to separate the Guest Wi-Fi from the secured Wi-Fi.

I have Netgear switches in my environment. The non PoE switches are either GS724TS or GS748TS. The PoE switches are all GS728TPS switches. These all connect back to a M5300-28GF3 via fiber.

What I am trying to setup is the following VLAN's 1 Default Netgear VLAN 260 Management VLAN 360 HS VLAN (high school) 460 JH VLAN (junior high school) 560 Elementary VLAN 660 Guest Wi-Fi VLAN

What I think I should do is create these VLAN's on all switches. Then on each switch I should Tag all uplink ports on all switches. Then on each switch I should change all PVID to be the main VLAN (Except for the uplink ports which will remain PVID 1) so for HS VLAN 360 would be the PVID and JH VLAN PVID would be 460 and the Elementary VLAN would be 560. Then on the GS7xxTS switches all other ports except the uplink ports should be untagged. Then on the PoE switches, any port that is connected to an Access point should be Tagged on the main building VLAN and VLAN 660 for the guest Wi-Fi.

Then on PoE switches don't have Access Point I should set the ports as untagged. Then on the fiber switch I should tag the port for each building as the building VLAN, and both the 260 and 660 VLAN's.

Now is where it gets really fuzzy for me. I have 3 ports going back to our internet connection which hooks to Cisco switches. I want to change it to one port over a 10GB connection on my fiber switch so I am guessing that I just need to tag all VLAN's on that port. I know that currently the cisco switch is setup like the below on 2 of the ports

port 4 Elementary untagged vlan 560

port 5 Junior high untagged vlan 460

So here are where my questions start to arise. Question 1: To do what I want will the Cisco accept the traffic if it is set to untagged when I am sending tagged traffic? Or do they need to switch to tagged.
Question 2: How does the VLAN ID 1 fit into this whole thing? Tagged ports are going to be left as PVID 1 right? If so how do I set the other ports? Tagged or untagged on PVID 1?
Question 3: Should the main VLAN for each building have the ports as untagged for all but the uplink or access point ports? Question 4: Should VLAN 1 ports remain untagged for some reason?

Before the new setup I only have PVID 1 on all switches except the M5300-28GF3 which also has VLAN's for each building.

Question 5: For VLAN 260 which I want to be the management VLAN am I correct to assume that it only needs to be on the uplink ports as tagged?

enter image description here

Improve this question
4
  • 3
    It's hard to follow all this without a diagram. Can you post a simple one? Here is a simple rule: when 2 switches are connected via trunks, the tagging has to match. Remember that tagging is specific to a port. A VLAN can be tagged on one port, but not tagged on another.
    – Ron Trunk
    Commented May 10, 2018 at 13:12
  • 2
    You also might find this question helpful: networkengineering.stackexchange.com/questions/6483/…
    – Ron Trunk
    Commented May 10, 2018 at 13:37
  • How do I post a diagram? I have a pdf file
    – Matthew Lambertson
    Commented May 10, 2018 at 18:12
  • You can edit your question to include an image
    – Ron Trunk
    Commented May 10, 2018 at 18:13

1 Answer 1

Reset to default
3

First, tagging a VLAN applies only to a particular port. A VLAN can be tagged on one port, but untagged on another.

Second, if two devices are connected via a trunk, then the VLAN tagging should match on both devices.

Question 1: To do what I want will the Cisco accept the traffic if it is set to untagged when I am sending tagged traffic? Or do they need to switch to tagged.

You will configure the Cisco router port with subinterfaces, one for each VLAN. Yes, they will be tagged.

Question 2: How does the VLAN ID 1 fit into this whole thing? Tagged ports are going to be left as PVID 1 right? If so how do I set the other ports? Tagged or untagged on PVID 1?

Doesn't matter as long as you're consistent.

Question 3: Should the main VLAN for each building have the ports as untagged for all but the uplink or access point ports?

Ports that are not trunk ports (i.e. access ports connected to PCs or other devices) should be untagged for the desired VLAN. PCs do not understand tags.

Question 4: Should VLAN 1 ports remain untagged for some reason? Before the new setup I only have PVID 1 on all switches except the M5300-28GF3 which also has VLAN's for each building.

See Q2

Question 5: For VLAN 260 which I want to be the management VLAN am I correct to assume that it only needs to be on the uplink ports as tagged?

If the port is a trunk port (a port with more than one VLAN), then it should be tagged. Otherwise, No.

Most Important!!

Doing all this will not solve your security problem UNLESS you also apply an access-list on your router to restrict your guest VLAN.

Improve this answer
5
  • Ok, so long as I am consistent with the settings on VLAN 1 (default) VLAN is doesn't matter if they are all untagged? What is the best practice say I should do on VLAN 1 when I am changing the Native VLAN to 360 for example?
    – Matthew Lambertson
    Commented May 10, 2018 at 18:49
  • Again, a VLAN can be native (untagged) in the context of a particular port. So you can change VLAN 360 to be native on port 1 (for example), but it might be tagged on port 2. You will tag VLAN 360 on your trunk ports, but not on your access (user) ports.
    – Ron Trunk
    Commented May 10, 2018 at 18:58
  • by the access list on the router you are referring to ip ranges right?
    – Matthew Lambertson
    Commented May 10, 2018 at 19:05
  • That is correct.
    – Ron Trunk
    Commented May 10, 2018 at 19:24
  • Ron: Thank you very much for sharing you knowledge it has been really helpful.
    – Matthew Lambertson
    Commented May 10, 2018 at 19:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.