2

I have a network that consists of 3 VLANs:

  • 1 -> Desktops and Laptops
  • 50 -> IP Cameras
  • 200 -> Servers

Just to make this simple, treat all devices in a VLAN the same:

  • 1 is a member of 200, as computers here need to talk to Servers
  • 50 is a member of 200, as the IP Cameras stream to a NAS
  • 200 is a member of 50, as the NAS controls attributes of the cameras

  • 200 is a member of 1, as the servers and computers talk to each other

    VLAN 1 <---------> VLAN 200 <---------> VLAN 50

All devices have an IP of 10.1.1.x (x is device dependent)

In this configuration, the primary goal of having IP Cameras in a separate VLAN is so that this traffic is not seen by the desktops and laptops in VLAN 1. This works fine, however, when the NAS sends an ACK for the IP Camera traffic, and because its port on the switch is mapped to VLAN 200, devices on VLAN 1 (bad) and VLAN 50 (good) are seeing the same packets. Because this is IP Camera related, I would prefer that this traffic only to VLAN 50 (e.g. 200 -> 50 and not 200 -> 1)

How can I get traffic from VLAN 200 devices to route to the VLAN they are intended for?

I'm hoping for a solution that doesn't require a dedicated router and my switch is a Netgear GS108T, but if necessary upgrading a step to something like a Netgear M4100 or even to an Enterprise class switch is not an issue - I am just looking for the best configuration right now.

Improve this question
3
  • 1
    Netgear Prosafe is on topic, but it would help to have a diagram annotated with port numbers and vlan numbers – Mike Pennington Sep 17 '13 at 18:23
  • Can you expand on the IP addressing, you said that "All devices have an IP of 10.1.1.X". How are you breaking out address assignment if there are three separate VLANs? What does your subnetting look like? – Brett Lykins Sep 17 '13 at 18:25
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Aug 8 '17 at 15:03
8

Each VLAN should have its own subnet. Example:

  • VLAN1: 10.1.1.0/24
  • VLAN50: 10.1.50.0/24
  • VLAN200: 10.1.200.0/24

Then you will need a device to route between them. A quick lookup on your switch did not show it as supporting layer 3 routing. So you may need an upgrade or a dedicated router.

Once you have a router, you would configure 3 interfaces, one per VLAN for routing. On these interfaces you can apply an ACL to block traffic you don't want.

  • ACL Laptop/Desktop Traffic: permit access to servers
  • ACL IP Cameras: permit access to servers
  • ACL Servers: Permit all access
Improve this answer
3

Each VLAN can be viewed as an independent LAN, without connections to each other.

If one device from one VLAN needs to communicate with a device of any other VLAN, you'll need routing among the VLANs.

This can be done by a layer-3 switch (and I think yours doesn't support it), or by using any external router.

Improve this answer
1

As legioxi mentioned:

You will need to have proper segmentation. If your switch does not do L3, consider a router on a stick approach. LAN interface of router would connect to switch port set up as a trunk. Configure sub-interfaces on the router for each VLAN and DOT1Q tag the traffic. Only trunk the necessary vlans from the switch that you need.

At this point you should be able to implement ACL's to permit/block traffic from hosts in one VLAN to another.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.