I asked this question a few weeks ago: Moving to vlans from a basic network

I think the advice the answerer gave was right but I think I want to move forward with segregating my network and trying to make it more efficent.

I basically have 2 routers. One on the outer network is a "Public Lan" that we allow wifi connections to. I also have an internal "Private Lan".

We have 2 internet connections and 2 seperate routers that load balance.

I want to move to a vlan to simplify my network and hopefully speed it up.

The outer Peplink router is gigabit and handles my 150mb connection without an issue and the inner router is also a peplink but only does 100mb and a fiber connection we use for voip.

Am I correct in thinking that I can use one vlan aware switch out of my router and use that to send my vlans to the dumb switches in each area?

What about this diagram? Is it representative of a setup like this?

I want engineering stuff to be seperate from the office staff stuff but I want the phones for each to reach the voip server as do I want the printer available to everyone. Except some ap users.Network Diagram

Or am I over thinking this? I really think I want to go to one router and just make sure AP users can not reach the private network. That way I can take full advantage of my 150MB connection while still keeping everything simple. I would like to have my phones, my office computers, my engineering gear and my ap users all on seperate subnets just for organization sake.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 12, 2017 at 5:35

2 Answers 2


First all first you should define the policy of your segmentation, starting by defining broadcast domains (ie. VLANs and related subnets) you want to have. In corporate networks, the most diffused reference is the PCI DSS: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf#page11

Anyway, you probably don't need a such formal and strict approach, but still need to define what networks you want to have and how they can communicate between each others.

If I'm reading your question correctly, you want:

  • public
  • engineering
  • office
  • voip
  • server (only for the printer actually)

I can't say if you're over engineering or not without knowledge of your environment, anyway I think it can be pretty complex for most small networks. For instance, a specific network used for printers only, might be an over engineering, but let's say it will scale easily in case of a new DB/file/web/whatever server. On a side note, restricting specific users to access the printer is something I'd manage through authentication rather than with network security.

Also, by looking at your schema, the 802.1Q switch connected to your Peplink seems the only point where these networks meet, with the only exclusion of the phone (voip). If so, (excluding phones) you don't need VLANs that spread into multiple switches making stuff like STP less efficient, you just need a router/firewall.

VLANs are useful when you want an engineer connected to one of the ports of the switch on the left (public), and someone from the office in one of the 2 switches at the bottom (that seems assigned to engineering in the schema), for instance.

In other words, if I'm understanding your requirements properly, why don't you put a firewall with 5 interfaces where you drew the 802.1q switch , putting the VoIP server and the printers in the server LAN? On the firewall you can define the communication policies between these networks than.

Worth to note that VoIP traffic is usually NOT encrypted, if you're concerned about sniffing of calls from office and engineering this solution might not be the best choice.

Finally, in order to balance the WAN traffic many technologies exists to drive Public network out of a specific link; I don't know Peplink honestly, but with Cisco you can use source/policy routing for instance.

  • Thank you for answering this. I am digesting it and will return with either another question or two or selecting this as my answer! Thanks!
    – ahackney
    Commented Sep 1, 2015 at 18:11
  • Any update about?
    – matteo
    Commented Sep 24, 2015 at 9:56
  • Yes, I have made no switches to anything yet. Really what I'm trying to do is simplify the network not complicate it. We have people on computers that have access to engineering machines that are very delicate. What I don't want is someone to plug a computer in to the lan and have access to everything. I thought if I moved the engineering gear to it's own vlan or subnet that it would make the casual user that would try to log in not be aware of the other network. Plus it would be easier to fix a phone issue if I could map the phone to the extension ip. ie ext 100 would be x.x.x.100
    – ahackney
    Commented Sep 25, 2015 at 16:18
  • I'm thinking I'm just going to do a different subnet for each network and then vlan the public lan. This will let me go to one router, secure my private network from the public one and allow me to organize our stuff better.
    – ahackney
    Commented Oct 2, 2015 at 18:52

When approaching design issues, I always follow the KISS principle - keep it simple. I dumb switches are, I assume, layer 2 switches - so call them layer 2 switches. They get offended when you call them dumb.

That diagram shows 2 remote sites, which adds complexity not worded in your post. It is common for ip telephony devices to be on a unique VLAN, so this is inline with your want for all phones to reach their server.

In terms of segregating out the engineering computers, you can certainly do that and you would then have a layer 3 boundary between them and the other computers, ...but why? Security? Are you going to enable some network/router based security? If so, what? I am hinting at the KISS principle here. Do you really need to do all that? A remarkable basic reason to segment a LAN is addressing/DHCP server limitations. So, how many computers on the LAN? If not more than 250 or so, you might rethink adding the complexity. A simple layer 3 boundary is not a significant security measure.

Hope that helps.

  • This makes sense to me. But I am now at 250 network devices and need to add more. So how do I approach this?
    – ahackney
    Commented Jan 8, 2016 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.