Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm looking into the managed switch HP ProCurve 1810G-24 to see if it can meet our office demands. The specs say it has IEEE802.1Q - whatever that means.

Our office consists of four companies that share a common broadband connection. The infrastructure of the building is such that it results in all ethernet cables are located in our server room with a patch panel.

I've read a some about VLAN and what it is about, but can't quite get a grasp on whether it is suited for our needs or not, so I decided to post our scenario here and get some professional opinions on the matter.

We wish to separate our four companies so that each company cannot access resources on a different VLAN. At the same time, we wish to allow for a shared internet access.

I thought the solution would be to set port 1 as VLAN 1 and connect the broadband router to that port. Then create VLAN 2-5 (four VLAN's) on the remaining ports by setting T (tag) on all ports for the VLAN in question, and setting E (exclude all) on all ports not on that VLAN - BESIDES port 1 where the broadband router is located, which i set to U (untag).

Or is the solution to also include port 1 as T (tag) for each VLAN?

I hope I made myself understood and that someone could shine a light on this scenario.

share|improve this question
    
We really need to know what router hardware or software you're using. –  Chris S Jun 5 '12 at 13:16
    
It's a really simple ADSL modem/router called "Billion". I seriously doubt it has multi-network support. Any advice on router selection? I could setup my modem as DMZ and put the router between the networks and the modem. –  Vincent Jun 5 '12 at 13:26
    
What about the Cisco SB RVS4000 Gigabit Security Router? –  Vincent Jun 5 '12 at 13:37
    
RVS4000 has 4 active VLANs including the default. It looks like you need 5. –  Dmitri Chubarov Jun 5 '12 at 16:44
    
@DmitriChubarov Why does he need 5? He's only got 4 companies. –  Chris S Jun 5 '12 at 17:02

2 Answers 2

up vote 4 down vote accepted

VLANs are no replacement for NAT.

HP ProCurve 1810G-24 is a very nice silent gigabit web-managed L2 switch with VLAN capabilities, SNMP monitoring and more.

You can split the switch into several virtual switches using separate VLANs so that each virtual switch has a virtual port on the physical port of the router.

       VLAN1 VLAN2 VLAN3
Port1    U     T     T
Port2    E     U     E
Port3    E     E     U      

Here Port1 is the router, Port2 is Company1, Port3 is Company2, VLAN1 is for network management, VLAN2 and VLAN3 are for the customers.

However you need a router that is capable of having several virtual interfaces for each VLAN and doing NAT for several networks. This is not a stock broadband router.

The router should be capable of accepting traffic with at least 5 different VLAN tags including the default VLAN for the uplink.

Other capabilities to look for in a router for your network:

  • DHCP server and DHCP relay
  • Network address translation (NAT)
  • At least 5 active 802.1Q VLAN tags
  • Firewall
  • If a router has an ADSL modem functionality, you could used it to replace the device that installed by your provider.
share|improve this answer
    
Right, it's web-managed only. –  ewwhite Jun 5 '12 at 13:56
    
Wow, screwed that one up. Sorry about the comment too, deleted the wrong one... Should have just stayed in bed this morning. –  Chris S Jun 5 '12 at 15:35

1810G-24 supports tagged vlans. to make things work you'll divide switch into separate isolated subnets each in separate vlan. one interface of switch will give tagged access to all vlans to your router. on it you'll have to create separate subnets / nat rules for each of the office tenants.

share|improve this answer
    
Are you on the switch or the router? I don't think our broadband router / DHCP has the functionality to create subnets. Maybe i misunderstood you. Speak as you would to a child :) –  Vincent Jun 5 '12 at 12:45
    
it's correct - one interface of a switch will face your router, i'll provide trunk with all vlans. your router needs to be able to 'unpack' those vlans from tagged trunk and handle them separately. 'Billion' router probably will be unable to do it. –  pQd Jun 5 '12 at 13:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.