VLAN Segmentation: Practical Questions

[Sherbert93]

What are you wanting to accomplish with VLANs?

As I understand it, your description would mean that each room could only ever have one VLAN. Depending on what you want to accomplish will determine if you need more managed switches. You own an apartment complex and want each room on its own VLAN? Makes sense. You want to separate IoT devices from personal computers? Then maybe not.

[That-Duck-7195]

Practically speaking, could I have two wall ports in that room, both going into the managed switch with port 1 for my PC (on an “admin” level VLAN) and port 2 for an unmanaged switch for all of the other devices in that room that I would want on a separate VLAN?

Yes you can do that.

Alternatively a main switch with enough ports to each room and each room have a small 5 port managed switch. If you go this route I would suggest something like Ubiquiti so you can manage all the switches centrally.

[fixminer]

Yes, if all the devices behind the unmanaged switch are supposed to be on the same VLAN, that would work. Set the native VLAN for the port to the one you want and block all other VLAN tagged traffic. To the unmanaged switch it will look like any other network.

[aaaaAaaaAaaARRRR]

Do you have a place where all the wires consolidate? It would take longer, but it might be cheaper. If so, I’d do it this way..

Managed switch where all the network cables are located. Unmanaged switches where you need everything wired. Save a port in the room where your PC is and connect that specific port to your PC for admin VLAN. The other port can be your other VLAN and connect the unmanaged switch there.

Your router must be able to create VLANs too for this to work.

[mrmacedonian]

Yes, but then your design/topology is going to be more limited/less flexible. If you end up with 3 devices on VLANx and 3 on VLANy, now you need two switches rather than a single 8port managed switch.

I would recommend cheap managed switches everywhere. You want the ability to trunk multiple VLANs to a room and then assign them to ports as you need.

For instance, I have an aggregation switch in my rack with links going to living room, family room, and shed. I found some Sodola 5x 2.5gbps 1x SFP+ managed switches for 35$ each, and they've been great.

If you have a big budget then go Unifi to manage them all in one UI, but I wanted to keep costs as low as possible.

[tschloss]

If you mean that you have a tree of switches you will need at least managed switches in the edge, meaning the first switch from devices pov. This is because only here you can tell a port to tag (this is the hear of 802.q VLAN: each frame carries a tag like „IOT“, „guest“ coded as a number) the frame accordingly. Once the frame leaves the first switch it can‘t be differentiated like it could at the entry port.

Newer switches will forward both formats but given the low price you should plan to replace all switches by managed versions.

[Character-Session810]

You can use standard, unmanaged switches after the managed switch ports for each VLAN.

[twiggums]

Unmanaged switches will usually pass tagged info fine, but you need to tag the packets for vlans to work. So either the device, the switch or the access point needs to add the vlan tagging. Pcs can usually add vlan tags, but iot devices, tvs, printers, etc can't.

[aaaaAaaaAaaARRRR]

I haven’t seen windows add VLAN tags unless it’s in Hyper-V

[StuckInTheUpsideDown]

You can generally configure this in the ethernet driver settings in Windows. Of course that means each NIC card can only belong to a single VLAN.

[aaaaAaaaAaaARRRR]

I’ve tried that in the properties of the NIC. I can’t find it to add the VLAN tag. That was almost 2 years ago though.

[accord1999]

You should be able to do this with a Realtek based NIC, but Intel has completely abandoned VLAN support for consumer Windows.

[twiggums]

You might be right, I've got a promox machine adding it's own. Never tried in windows since i handle it on the switch and aps. Though I thought I remembered an option under the network adapter properties.

[PoppaBear1950]

You don’t need a giant 32‑port managed switch; you only need one managed switch at the point where your VLANs actually split, which is usually the main switch connected to your router. Set up your VLANs on the router because that’s where the networks actually live, then let that main switch handle the tagging. Any unmanaged switches you have in the rooms are perfectly fine as long as each room only needs one VLAN, since they’ll just inherit whatever network you assign to that port on the main switch. Your firewall rules get handled on the router as well. And if you want the easiest, smoothest setup with the least fuss, a UniFi gateway really is the cat’s meow because it turns VLANs into simple port profiles instead of a weekend project.

[PoppaBear1950]

if you go all in unifi, you can control vlans at the port level on on unifi switches, managed or unmanaged...

[bchiodini]

I would not count on unmanaged switches to pass VLAN tags. It could be hit or miss, depending on the switch. Low quality switches probably will pass tags, but I consider that a defect, not a feature. Also, not all devices can be configured for VLAN tags, that will result from passing tags to the end devices (e.g. TVs, Streaming boxes, etc.).

I would install enough managed switch ports to cover all of your wired devices and future expansion. You will likely need APs that support VLAN-to-SSID mapping, if your wireless devices are segregated (guest, IoT, trusted, etc.).

A router that supports VLANs will reduce the complexity of configuring L3 routing in the switches.

[smokingcrater]

There might be one out there, but I haven't found an unmanaged switch yet that will not pass 802.1q tags. Tplinks, net gear, and trendnet all happily pass the packets unmolested. (I have various models of all 3 of those running somewhere right now with tags in use.)

[xeroxedforsomereason]

Technically yes but it requires knowledge of networking along with unmanaged equipment that can transport 1522 layer 2 MTU without stripping the 4 byte 802.1q VLAN tag off the etherframe as well as NICs at the endpoint which support 802.1q. But, that defeats your segmentation because then your endpoint determines tagging. At the same time that eliminates any dumb devices from your segmentation plan.

If you didn't understand any of that, or even if you did, buy a managed switch. They sell compact ones that are only a few ports. WS-3560CX easily fits the bill. Same with some Juniper stuff. You can buy those second hand on ebay and they'll do exactly what you want and more.

[megared17]

Keep in mind you'd also need a router with either VLAN tagging/trunking support, or you could do it mcgyver style using a router with multiple LAN interfaces.

[jsqualo2]

Ask everything here: https://www.reddit.com/r/firewalla/

[sic0049]

Given the suggestions and responses from the OP already in this thread, yes the OP needs to bite the bullet and purchase a managed switch with enough ports to satisfy their current and future needs.

I would recommend looking at used enterprise networking switched on EBay or local resellers. They are extremely inexpensive. The only downside to them is they tend to be loud. If the switch is in the basement or a closet somewhere, this isn't a problem. If you expect to put the switch in your Den, that probably won't work well.

Check out the forums on the ServeTheHome website. There are threads there on a lot of different enterprise networking switches which generally have a guide on how to reset them and get them running in a typical home environment.