I have several hosts I want to connect directly to my WAN subnet, eg., (web, mail, and router for LAN).

I have a web managed switch (DGS-1210-24), and was wondering if there were any security concerns with creating an untagged VLAN for this purpose.

  • Well.. you won't have much visibility into what those hosts are doing potentially, but I don't see anything wrong with it as long as that is acceptable. – SpacemanSpiff Mar 30 '13 at 4:28

We use vLANs for everything. Every device is connected directly to an access switch, cable modem, routers, servers, etc. The vLAN is the only thing keeping the WAN and LAN separate.

Be sure to put your untrusted traffic (this should be essentially everything) in a vLAN to prevent hopping. Otherwise there is only the "normal" security concerns.


There is nothing wrong with using an untagged vlan for the DMZ zone (that is what you seem to be saying...). There is no real difference between tagged and untagged vlans.

But do make absolutely sure that your switch is NOT using the default untagged VLAN (typically 1 or 0) for anything. (It often is the management interface.)
If you create more than one untagged vlan these vlans are effectively the same vlan.
Some switches won't even let you make multiple untagged vlans just because of this. (Or you can make multiple but you can only enable one of them.)

What I don't get is why you would want to do this in the first place ?
Just keep it tagged. The switch will remove the tag on outgoing traffic on the access-ports anyway (and tag incoming traffic when it arrives at the access-port).
There is no real need to keep the traffic untagged when traveling inside the switch. In fact, keeping it tagged prevents a lot of potential mistakes and configuration complications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.