Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 28 subscribers
  • Views 637 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VLAN Setup on XG125 v18

Martinen

Hi there,

my client has a basic setup with one local subnet 192.168.3.0/24 on the XG standard physical LAN port 1. Now we are about to introduce new switches and vlans to separate his traffic from his tenants'. The current subnet needs to be preserved because there a lot of machines with static IPs. The tenants' subnets / vlans would look similar to the main one (e.g. 192.168.4.0 with vlan 4 and so on).

So far I came across two options to set this up on the XG:

1. Leave the original subnet as it is and add vlans (= sub-interfaces) to the eth1 interface ( vlan4 = eth1.4, vlan5 = eth1.5 and so on).
That's what I have done with my own network to separate IoT-Devices and a guest network from the business network. This was a smooth transition. When I plugin new devices in a business network switch port though, they receive a 192.168.3.0/24 address via DHCP so I assume that the switch tags the traffic as vlan1 and the XG accepts vlan1 traffic on its eth1 interface. However I could not find a way to tag the original subnet on the eth1 interface with a user-defined vlan e.g. vlan3.


2. Create a new interface, e.g. on physical port 4 with a static "dummy" IP, e.g. 192.168.1.1 and add vlan3 / if4.3 ( with 192.168.3.0/24 as my clients' business network), vlan4 / if4.4 (tenant1), vlan5 / if4.5 (tenant2) and so on. I have not tested this setup yet but I assume it would work.

And maybe there is a third / better way to do this?

Any comment is appreciated!

Kind Regards,
Martin



This thread was automatically locked due to age.
Parents
  • 0

    There are two or three ways how that can work:
    1) the switch supports dynamic VLAN membership and someone (normally a RADIUS server) is configuring the switchports VLAN ID/membership based on the connected device automatically,

    2) the switch is using a port-based VLAN.
    a) VLAN-ID of the switchport is manually changed to only submit in the right VLAN. (Untagged VLAN4 for example)
    b) every switchport is configured with a default untagged VLAN and all other VLANs are tagged on the same port.

    My wording come from smaller HPE switches, other brands or models may have other namings.

    1) is the most comfortable and secure way.
    2a) is secure but needs manual configuration for every switchport. Works with every device.
    2b) is comfortable but needs devices that are capable of using VLAN tagging.

    I prefer physically separating networks that do not belong to each other, where that isn't possible it comes mostly to 2a) as a solution.
    On the firewall it depends on the traffic that is processed and what interface capabilities it has. 2 VLANs on a 1G interface ist still a 1G uplink. When there are interfaces free I would prefer using them before I use multiple VLANs on the same port. 

Reply
  • 0

    There are two or three ways how that can work:
    1) the switch supports dynamic VLAN membership and someone (normally a RADIUS server) is configuring the switchports VLAN ID/membership based on the connected device automatically,

    2) the switch is using a port-based VLAN.
    a) VLAN-ID of the switchport is manually changed to only submit in the right VLAN. (Untagged VLAN4 for example)
    b) every switchport is configured with a default untagged VLAN and all other VLANs are tagged on the same port.

    My wording come from smaller HPE switches, other brands or models may have other namings.

    1) is the most comfortable and secure way.
    2a) is secure but needs manual configuration for every switchport. Works with every device.
    2b) is comfortable but needs devices that are capable of using VLAN tagging.

    I prefer physically separating networks that do not belong to each other, where that isn't possible it comes mostly to 2a) as a solution.
    On the firewall it depends on the traffic that is processed and what interface capabilities it has. 2 VLANs on a 1G interface ist still a 1G uplink. When there are interfaces free I would prefer using them before I use multiple VLANs on the same port. 

Children
No Data