Gateway (ER605) IP Address with Management VLAN

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Gateway (ER605) IP Address with Management VLAN

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Gateway (ER605) IP Address with Management VLAN
Gateway (ER605) IP Address with Management VLAN
2021-10-23 17:18:24
Model: ER605 (TL-R605)  
Hardware Version: V1
Firmware Version: 1.1.1

I'm setting up a new network with several VLANs and am a little confused by the way the controller is configuring the gateway (ER605).

 

I've setup a management VLAN for all the Omada devices (VLAN60).  The system has an OC200 as the controller and, at present, two SG2008P switches and one EAP235-Wall.  I'll be expanding the APs later but I'm in the initial setup stages.  The management VLAN appears to be working with the OC200, switches and AP all getting IPs within the VLAN60 subnet (10.10.10.xx).  However the gateway (ER605) still has an IP address on the main LAN - 192.168.88.1.  Should the gateway not be on the management VLAN as well or must this sit on the main LAN IP address?

 

Sorry if this is obvious but I'm still getting my head round the VLAN management concept so any help appreciated.

  0      
  0      
#1
Options
3 Reply
Re:Gateway (ER605) IP Address with Management VLAN
2021-10-24 09:15:43

@Hansontech Can anyone explain why the gateway isn't on the management VLAN?  For security shouldn't all devices be managed on the management VLAN.  If the gateway remains on the main LAN then isn't that an issue as any devices on the main LAN can then technically access the gateway?  I'm guessing as the gateway is the main routing point it has to exist on the main LAN in order to route traffic.  So I assume the rule is keep everything off the main LAN except for devices you know need access to the main LAN?

 

Sorry if this is obvious.

  0  
  0  
#2
Options
Re:Gateway (ER605) IP Address with Management VLAN
2021-10-26 03:06:27

@Hansontech 

 

I remember reading the FAQ on the official website earlier mentioning that given the Omada Gateway does not support changing the management VLAN temporarily, will need to use the Omada Discovery Utility to inform the Omada gateway of the new IP address of the Omada Controller.

 

And actually they suggest to set ACL to prevent devices in other networks from accessing the devices in management VLAN, which improves the network security.

 

Here is the link: https://www.tp-link.com/en/support/faq/2814/

Just striving to develop myself while helping others.
  0  
  0  
#3
Options
Re:Gateway (ER605) IP Address with Management VLAN
2021-10-26 14:21:29

@Virgo Thanks for the reply but it doesn't address exactly what I was getting at.  I already have a management VLAN setup and working.  What I was asking was whether the gateway itself can be on the management VLAN.  However after some research it's obvious why this can't be.  There is confusion, certainly on my part, between the default VLAN, Native VLAN and the rest of the network.  The gateway has to exist in all VLANs in order to provide routing capability as far as I understand it.  The default VLAN (VLAN1) is always present and cannot be deleted.  However the Native VLAN, which on initial configuration is VLAN1 named LAN, can be changed and the security advice is to change it.  The gateway will always occupy the native VLAN, again from my understanding.  You then need to create ACL rules to ensure that clients cannot connect to the router interface.  I've now configured this and all VLANs are now isolated from each other and there's a deny rule on access to the gateway from any VLAN except the native VLAN.

 

I could have the above all wrong but everything seems to work at the minute and achieves what I need.smiley

  2  
  2  
#4
Options