2

I'm looking into the managed switch HP ProCurve 1810G-24 to see if it can meet our office demands. The specs say it has IEEE802.1Q - whatever that means.

Our office consists of four companies that share a common broadband connection. The infrastructure of the building is such that it results in all ethernet cables are located in our server room with a patch panel.

I've read a some about VLAN and what it is about, but can't quite get a grasp on whether it is suited for our needs or not, so I decided to post our scenario here and get some professional opinions on the matter.

We wish to separate our four companies so that each company cannot access resources on a different VLAN. At the same time, we wish to allow for a shared internet access.

I thought the solution would be to set port 1 as VLAN 1 and connect the broadband router to that port. Then create VLAN 2-5 (four VLAN's) on the remaining ports by setting T (tag) on all ports for the VLAN in question, and setting E (exclude all) on all ports not on that VLAN - BESIDES port 1 where the broadband router is located, which i set to U (untag).

Or is the solution to also include port 1 as T (tag) for each VLAN?

I hope I made myself understood and that someone could shine a light on this scenario.

7
  • We really need to know what router hardware or software you're using.
    – Chris S
    Jun 5, 2012 at 13:16
  • It's a really simple ADSL modem/router called "Billion". I seriously doubt it has multi-network support. Any advice on router selection? I could setup my modem as DMZ and put the router between the networks and the modem.
    – Vincent
    Jun 5, 2012 at 13:26
  • What about the Cisco SB RVS4000 Gigabit Security Router?
    – Vincent
    Jun 5, 2012 at 13:37
  • RVS4000 has 4 active VLANs including the default. It looks like you need 5. Jun 5, 2012 at 16:44
  • @DmitriChubarov Why does he need 5? He's only got 4 companies.
    – Chris S
    Jun 5, 2012 at 17:02

2 Answers 2

4

VLANs are no replacement for NAT.

HP ProCurve 1810G-24 is a very nice silent gigabit web-managed L2 switch with VLAN capabilities, SNMP monitoring and more.

You can split the switch into several virtual switches using separate VLANs so that each virtual switch has a virtual port on the physical port of the router.

       VLAN1 VLAN2 VLAN3
Port1    U     T     T
Port2    E     U     E
Port3    E     E     U      

Here Port1 is the router, Port2 is Company1, Port3 is Company2, VLAN1 is for network management, VLAN2 and VLAN3 are for the customers.

However you need a router that is capable of having several virtual interfaces for each VLAN and doing NAT for several networks. This is not a stock broadband router.

The router should be capable of accepting traffic with at least 5 different VLAN tags including the default VLAN for the uplink.

Other capabilities to look for in a router for your network:

  • DHCP server and DHCP relay
  • Network address translation (NAT)
  • At least 5 active 802.1Q VLAN tags
  • Firewall
  • If a router has an ADSL modem functionality, you could used it to replace the device that installed by your provider.
2
  • Right, it's web-managed only.
    – ewwhite
    Jun 5, 2012 at 13:56
  • Wow, screwed that one up. Sorry about the comment too, deleted the wrong one... Should have just stayed in bed this morning.
    – Chris S
    Jun 5, 2012 at 15:35
1

1810G-24 supports tagged vlans. to make things work you'll divide switch into separate isolated subnets each in separate vlan. one interface of switch will give tagged access to all vlans to your router. on it you'll have to create separate subnets / nat rules for each of the office tenants.

2
  • Are you on the switch or the router? I don't think our broadband router / DHCP has the functionality to create subnets. Maybe i misunderstood you. Speak as you would to a child :)
    – Vincent
    Jun 5, 2012 at 12:45
  • it's correct - one interface of a switch will face your router, i'll provide trunk with all vlans. your router needs to be able to 'unpack' those vlans from tagged trunk and handle them separately. 'Billion' router probably will be unable to do it.
    – pQd
    Jun 5, 2012 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .