Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a bit confused as to how to use the default VLAN on a 3Com 4210.

The switch is configured out of the box with all ports on a default VLAN 1. I need 4 VLANs on this switch:

  • 100 - Internal WIFI
  • 101 - Internal LAN
  • 200 - Guest WIFI
  • 999 - Management LAN for my wireless access points (also for switch ??)

So my question is around the default VLAN 1. I don't want this VLAN, but I can't remove it (web GUI says VLAN 1 cant be modified). So what risks does this impose? If all my ports ends up in this VLAN then don't this go against what VLANs are all about? I don't want this broadcast domain between all ports. I want to cut this switch up and have 4 ports for wireless access points (these are trunks - WAP's will be untagged VALN 999; Internal WIFI 100; Guest WIFI 200), 20 ports for internal LAN and the two trunks that connect the switch to the pfSense router (Alix 2D13).

my vlan plan

share|improve this question

You don't need to get rid of the VLAN, just don't assign any ports/MACs etc. to it, then it's just sat around doing nothing, no more or less risky than creating a new VLAN and not assigning it.

By the way, what's doing your routing?

share|improve this answer
The Alix 2D13 running pfSense does the routing. The problem with the 3Com 4210 is that it won't let me remove ports from VLAN1. – ilium007 Apr 13 '13 at 11:00
Can you assign the other ports to a different vlan? That effectively removes them from vlan 1. – cpt_fink Apr 14 '13 at 5:48
Yes, that's exactly what I suggested. – Chopper3 Apr 14 '13 at 8:28

I agree with the response of Chopper3.

If you assign a port to a vlan, say 200 ( untagged and put the port in access mode ), then he will not be part of vlan1. Access port can only contain 1 untagged vlan. So no worry about those ports.

Put your uplink ports in mode trunk. Trunk ports can only contain tagged traffic. Vlan1 is default untagged ( aka there wont be a vlan tag on your traffic ), hence the traffic of vlan1 won't go through your upstream ports.

So looking at your image, there won't be a problem if you put your "access" ports in a vlan different from 1 and you 2 uplink as "trunk" ports.

Security tip for unused ports

What we do in our company is, we let all the unused (ports with no cable/destination) ports in vlan1 ( aka the default vlan ). But put add vlan 1 to the forbidden vlan list on the uplink port ( even not needed if you put your uplink port in "trunk" mode ). This way if somebody connects its device to a port that was not assigned a known vlan ( aka 100,101,200,999 ) then he can do no harm. He can talk to other devices connected on that switch in vlan 1 but can't leave the switch and go further on to your network.

You can go further, on most managed switch set the port disabled. But have complains of colleagues who seek 30min for a working cable ( one that show's link ) to then just find out his port is disabled and the cable is just fine...

share|improve this answer

The issue with 3com switches saying "the vlan N cannot be modified" is caused by the port's mode not being set (access, hybrid, trunk, fabric).

I just wanted to clarify this since it's not apparent.

The cli command "display this" in the specific interface you're editing is your friend ;-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.