2

What I want to do:

It's small business network setup. I need two separate LANs (LAN1 for developers, LAN2 for marketing and managers). A wifi access is also needed. All network should have access internet. The security policies are as follow: 1- LAN1 host cannot see or communicate with LAN2 hosts. 2- LAN2 can communicate with LAN1 hosts and read or write on their disks. 3- WLAN has only internet access and no access no any LANs.

AS the first solution: I though of using a L2 manageable switch (like D-Link DGS-1210-28 (L2) or D-Link DGS-3620-28SC (L3)) and create two VLANs on it by port-based VLANs. Then use a simple ADSL wifi modem-router (like asus rt-n66u or cisco RV series routers) to share internet and create WLAN.

But I have few questions:

  • Doest this work? IF yes, the routing between two VLANs is performed by L2 switch itself? can I set those security rules on VLANs using the switch configuration?
  • Or I should go for buying a more advanced router and create the two real LANs? I have also budget problem. So a less expensive solution which works is best for me.

Many thanks

Regards

PS: I don not if I should mention that there will be a HP server and NAS storage probably on LAN1.

Improve this question
2
  • I'm not sure a VLAN security policy will help you with this. VLANs offer total seperation. If you do this, you have to allow a routing device to do interVLAN routing. If one vlan can access another vlan, then both will be able to access each other. I think permissions on the computers is a better method to handle what you are trying to accomplish. To seperate your WLAN, just throw that into a vlan and don't offer routes from that vlan into your other vlans. Only offer routes to the Internet.
    – Geruta
    Jul 31, 2015 at 12:30
  • 1
    Your comment is hogwash. You do not want to trust your network security to the devices connected to it. VLAN ACLs were created to allow exactly what the OP is asking.
    – stevieb
    Jul 31, 2015 at 14:41

1 Answer 1

Reset to default
2

An L2 device can not route, so no, inter-vlan routing can not occur on it directly, and aggregating the VLANs on the modem would require that the modem device can trunk and route VLANs.

I'd recommend getting a used cheap Cisco L3 (or equivalent) switch, enable inter-vlan routing, and create VLAN Access Control Lists to define who can see what from where. You'd have three VLANs... marketing, dev and WAN.

You'd allow both VLANs access to WAN (stateful), marketing/management stateful access to dev, and block all inbound from dev to marketing (and likewise block WAN to either internal).

Improve this answer
3
  • So D-Link DGS-3620-28SC which is a L3 router should be a good option. Just a simple question? can I create real separated LANs and connect them with a router and use its internal firewall to set access policies? is it a better idea or VLANS and L3 switch? Many thanks.
    – hs2015
    Jul 31, 2015 at 21:37
  • Yes, using a router as you suggest will do the same thing. However, if there's ever a possibility that a manager/marketing person will be seated in the dev physical area, it's much simpler to just reassign a network port to the opposite VLAN than to have to perform cabling changes upstream to connect it to a different side of the router.
    – stevieb
    Jul 31, 2015 at 21:47
  • Thanks a lot, I appreciate your help. I wonder if I use a firewall-router like (cisco RV220 or Netgear ProSecure UTM) which both support VLANs and setup two VLANs on the router ports and use two simple unmanageable switches one for Lan1 and other for lan2, Does it work too? It seems less expensive than using a firewall-router like cisco RV220 and one L3 switch. I am a little confused. Thanks
    – hs2015
    Jul 31, 2015 at 23:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.