New to VLANs

New to VLANs
New to VLANs
2022-05-21 10:09:22
Hardware Version:
Firmware Version:

Hi,

Hope I'm posting in correct place.

 

I am looking at buying a TL-SG1016DE switch to hopefully resolve some home networking issues.

 

We need to put a LAN network in the house (kids games consoles, multiple devices and CCTV with NVR) WiFi just does not cut it.

 

I am trying to allow all device full network access but block the CCTV data stream from the rest of the network however the NVR

will require full network access for remote viewing.

 

I have attached a pdf of the suggested topology and VLAN setup. Done a lot of reading over the last few days trying to get me head around the concept of VLAN's and came up with (what I see as) a possible solution.

 

A quick breakdown,

 

VLAN 2 

CCTV cameras can communicate with NVR but no communication outside VLAN 2 (all un-tagged)

NVR on VLAN2 but allowed outside access via Native VLAN (pvid1 and tagged port)

 

All Other devices

Allowed full access to router and internet (so all untagged) and all on Native VLAN (pvid1)

 

All devices on same subnet (inc cctv & nvr)

 

Hopefully the attached pdf will make it clear what I am trying to achieve.

 

Obviously there will be a fair amount of work involved in cabling, lan sockets etc. and the cost of the switch.

I thought it best to check before starting such a project.

Can anyone advise if this would be a suitable solution and if my understanding of VLAN's and setup a correct (or not).

 

Many thanks in advance.

 

 

 

 

 

 

File:
Network topology.pdfDownload
0
0
#1
Options
5 Reply
Re:New to VLANs
2022-05-21 17:47:26

  @graham-b 

 

Sorry having to tell you, but your drawing on page 2 is not going to work.

1. You should put all of the cameras and the NVR into the same VLAN (VLAN 2 in your case). In your drawing the NVR and the cameras cannot communicate.

2. If the NVR does not have two LAN ports or allows configuration of tagged VLANs (and I don't assume this), to access the NVR from VLAN 1 you need a device which is capable of VLAN routing. This can either be done with software e.g. pfsense or you need a better switch with L2+ support e.g. TL-SG2218.

 

If you don't have a server running already 24/7 in the office where you can simply add a pfsense VM, I'd go with the better switch.

 

Kind regards

Martin

 

0
0
#2
Options
Re:New to VLANs
2022-05-23 19:37:40

  @mwo 

 

Hi Martin,

 

Many thanks for taking the time to reply, much appreciated.

 

I bought the TL-SG1016DE with a view to using it anyway. If the setup I wanted wasn't going to work I'd probably just employ some flow control to lighten the network load.

 

Had a good play about with the new switch yesterday, between the manual and trying different setting just to get my head around everything having absolutely no experience of managed switches.

 

During this I stumbled accross a solution that seem to work perfectly in line with what I was after.

 

I created VLAN 2 for ports 1 to 5, all un-tagged ports 1-4 (cameras) PVID = 2 , Port 5 (NVR) PVID = 1. Then re-enabled all ports in VLAN 1 again all un-tagged

 

Port 16 linked to router

 

Using a laptop in port 5 (instead of the NVR I can ping all 4 cameras and get internet and also ping my desktop (not on the switch but attached router)

 

With the laptop in port 1 to 4 no internet and no access to desktop or internet.

 

All VLAN 1 ports with the exception of 1 - 4 have full internet access and all devices on same subnet.

 

Possibly what I have configured is not deemed as correct, however it works for me.

 

Again, many thanks for your reply to my query.

 

Kind regards, Graham

 

8f9219a233b5463a8f4fad0f5c64bef32d8be139f70643b7bab07c634d69cb66a4e08dd1be094515bdb7a466ea06add7

0
0
#3
Options
Re:New to VLANs
2022-05-23 20:45:11

  @graham-b 

Dear Graham.

 

Thanks for sharing. And congratulations for finding a working solution although it is quite surprising.

 

From my understanding, the cameras and the NVR transmit untagged packets, so the switch will do the tagging according to the given PVID. Thus, all camera packets are on VLAN 2. The NVR is able to receive such packets because VLAN 2 is enabled at port 5, but all packets from the NVR should be tagged with 1 and therefore not be sent to the cameras. As I said, quite surprising.

D-Link offers an option to active asymmetric VLAN which is mainly for using a single server or router in two separate VLANs. But during activation you'll be notified that this does not comply with standard VLAN rules. Maybe TP-Link offers the same by default without notification which I would consider a potential security breach. Or maybe this works by mistake and is corrected in the next firmware update.

 

Anyway, enjoy your working setup.

 

Kind regards

Martin

 

 

 

0
0
#4
Options
Re:New to VLANs
2022-05-24 02:27:15

  @graham-b 

 

I would not recommend your solution to anybody. It is not correct and I do not think it works the way you want. Here’s what  most likely happened.

 

You wrote “All devices on same subnet (inc cctv & nvr) so I understand you use one and the same subnet in both VLANs. This is a fundamental error. This, together with making all ports members of the default VLAN, explains why you were able to reach the cameras from Port 5. When you plugged the laptop into that port, the laptop got an IP address from the router within the intended subnet. However when you plugged the laptop into Ports 1-4, the laptop did not get an IP address from the router and thus you were not able access anything.

Kris K
0
0
#5
Options
Re:New to VLANs
2022-05-24 06:28:16

  @KJK 

 

Hi Kris,

 

Thanks for the reply.

 

To clarify, although all devices are on the same subnet they ALL have static address so DHCP and the router are out of the equation.The devices will use ARP to resolve addresses.

 

I can see when and where different subnets are used to segregate networks and be useful in large networks but in my scenario this is not needed.

I know many people state VLANs must be of different subnets and many other say this is not required. So I think we will have to agree to disagree on that subject.

 

I have spent many hours trying different methods and iterations of crossing the boundary between vlan1 and vlan2 and found it not to be possible and the network behaves EXACTLY as I wanted.

 

If all ports as you suggest are part of VLAN 1 then I should be able to access the camera feeds from vlan1 or anywhere else in the network which I can not.

I am unsure how the switch performs this but the only difference in vlan2 namely port 5 is the PVID set to VLAN 1. When set to VLAN 2 (ie port 5 PVID 2) I loose outside access to port 5.

 

May not be pretty but it works for me.

 

Thanks again.

 

Kind regards, Graham

 

 

 

 

 

 

0
0
#6
Options