I'm installing the network in an office building that will be used as co-working space by multiple smaller companies.

Since I was hoping to isolate traffic from the different companies I purchased hardware which (supposedly) has VLAN support:

The creation of company SSIDs on the Linksys and assigning them to VLAN IDs created on the L2 switch works fine. However, clients in this VLAN don't get an IP address from the router. The router doesn't know how to handle the VLANs.

The ER-5120 apparently has port-based VLAN support but does that mean it can't trunk the VLANs over a single cable? I only have 4 LAN ports on the router which is not enough for the number of VLANs that I need.

According to this doc on the TP-Link website I need to include a managed L3 switch, which (from TP-Link) costs more than all the equipment I already purchased :(

My question is whether I'm overlooking something. And if I really need an L3 switch for this configuration, could I also use a much cheaper model like HP's 1920 8-port L3 switch, or the Edgeswitch Lite from Ubiquity?

  • Did the answer help you? if so, you should accept it so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Commented Jul 20, 2017 at 13:25
  • @RonMaupin fixed, sorry 'bout that!
    – Wouter
    Commented Jul 24, 2017 at 20:34

1 Answer 1


That router, apparently, only does port based VLANs, not 802.1Q trunks. You either need a different router which can do 802.1Q trunks, or you need to get a layer-3 switch which can connect to this router via a point-to-point routed link. You are trying to use the equipment you have in a way it wasn't designed to be used.

You don't really give all the specifications for what you are trying to do. A layer-3 switch could work; you could get a router that supports trunking; you could get a router with enough ports, etc. You need to decide how you want to design the network, first, then buy equipment which supports your design. It seems you did that backwards (using the wrong tools for the job; don't use a screwdriver to drive nails).

EDIT based on your comment:

A layer-3 switch as a distribution switch is certainly a viable solution. You can set it up to trunk the correct VLANs to the various access switches. The VLANs defined in the Layer-3 switch will have the gateway addresses for the VLANs, and, probably, a static route to the WAN router. You should set up a point-to-point routed link between the layer-3 switch and the WAN router. If the WAN router is the DHCP server, you will need to set up a relay for that on the layer-3 switch for each of the VLANs using DHCP.

  • There's 3 buildings. Building 1 has a load balanced router to support multiple WANs and an L2 switch. Buildings 2 and 3 will get separate L2 switches that will connect to the first building's switch by aggregating 2 gigabit ports. On each switch there will be one or more APs with link aggregation. I checked for the link aggregation possibilities and the VLAN support of the equipment. But apparently I wasn't careful enough while checking the router's VLAN capabilities. Anyway, I will have to find an L3 switch between the router and the L2 switches. Tips welcome, thanks for your reply!
    – Wouter
    Commented Oct 28, 2015 at 21:35
  • @Wouter, see my edit in response to your comment.
    – Ron Maupin
    Commented Oct 28, 2015 at 21:45
  • In the end I sold the ER-5120 and purchased a Fortinet 60D which is doing a really nice job! As you said correctly, the ER-5120 does not support the 802.1Q trunking that I needed for my setup. Sorry for the late answer, this one slipped in my account!
    – Wouter
    Commented Jul 24, 2017 at 20:33
  • OK. It's just that we have so many questions that keep popping up. I am trying to signal to see if any answers should be accepted, and some people are responding. Unfortunately, there are many people that ask a question, get answers, and never get back on. Thanks.
    – Ron Maupin
    Commented Jul 24, 2017 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.