I want to share a FO/Internet connection among three separate small offices.

Internet provider modem/router has LAN, with its gateway at and serving IPs ( via DHCP to all its LAN PORTS.


I would like to serve the following separate subnetworks:




I am thinking in the following setup, with either a Ubiquity EdgeRouter or a SMB Cisco:

|         CPE INTERNET PROVIDER            |
|                     |
|                   /16                    |    
|                     |
|                   /16                    |
|                WAN PORT1                 |
|                                          |
|               CISCO OR UBIQUITI          |
|                                          |
| LAN PORT2      LAN PORT3     LAN PORT4   |
| |
|     /24            /24           /24     |
|   (VLAN2)        (VLAN3)       (VLAN4)   |
     .               .              .
     .               .              .
     .               .              .
     .               .              .
  1. configuring the Internet CPE modem/router LAN to
  2. disable DHCP in that CPE.
  3. attach a Cisco SMB RV325 or a Ubiquiti EdgeRouter, with:

    a) its WAN interface configured to
    b) VLAN2 configured in LAN Port 2 with network
    c) VLAN3 configured in LAN Port 3 with network
    d) VLAN4 configured in LAN Port 4 with network
    e) DHCP Pool configured in LAN Port 2 with IP Range
    f) DHCP Pool configured in LAN Port 3 with IP Range
    g) DHCP Pool configured in LAN Port 4 with IP Range

LAN ETH ports 2,3,4 would serve via ethernet cables the small offices, where a regular switch at the ends would allow connect all devices.

My doubts are:

  1. does this setup make sense?
  2. Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?
  3. How do I ensure that VLANs/subnetworks are not reachable between them?


  • Your setup looks good to me.
    – user36472
    Commented Sep 12, 2017 at 5:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Feb 19, 2018 at 18:31

2 Answers 2


1 - the setup make sense, but there's one potential issue: The ISP provided CPE may not NAT networks others than to the Public IP address. I.E. it will not perform NAT for the 3 subnetworks. If this is the case, you may have to NAT those 3 networks with IP from the network.

(btw there's a discrepancy between the text Internet provider modem/router has LAN and the schema where it is noted as /16, I assume the correct one is /24 as it is the most common case)

2 - For DHCP

  • Cisco SMB RV325
    It is not clear from this user manual that you can configure separate DHCP pools, but there's 90% chance it is the case.

    In the CLI reference guide it is not explicit either but the syntax use seems to imply it is possible.

interface vlan modify 25 dhcp dns static wins option66 tftp.server.org option150 option67 file.txt

In the worst case, it supports DHCP relay so you can relay DHCP requests from all VLAN to an external DHCP server

  • Ubiquity Edge pro
    I'm not familiar with EdgeOs but it's based on Vyatta, which I used a lot, and it is possible without a doubt.

3 - To ensure that VLAN can not communicate together, you have to configure ACL (Cisco) or Firewall Rules (Ubiquity).

The SMB RV325 support 50 ACL rules, while the Ubiquity should not have limitation (other than memory) and you can either use interface based firewall or zone based firewall.

  • CPEs are normally configured with /24, but my plan is to reconfigure CPE LAN for /16, so three /24 subnetworks would be routed
    – M.E.
    Commented Sep 13, 2017 at 4:41
  • Doing this would overlap network. I.E you will have 1 subnet on an interface and 3 networks that are subnets of the first one on other interfaces. This is not recommended, and a Cisco device will not allow it (Vyatta allow it so maybe EdgeOs allow it too, not sure). You need first to check if the CPE can NAT different networks, if yes no need to go to a weird config.
    – JFL
    Commented Sep 13, 2017 at 6:11
  • Ho also you need to check if you can add routes to the subnets on the CPE.
    – JFL
    Commented Sep 13, 2017 at 6:31

does this setup make sense?

I see no problem with the basic premise, as long as you meant and not for the "middle" network (unless you are planning to utilize proxy ARP - bad idea). Also assuming you are planning on performing NAT on the Cisco/EdgeRouter (or else you will need either dynamic routing such as OSPF or static routes on the CPE device).

A few suggestions, with the setup you describe you could configure a second EdgeRouter to provide redundancy (not sure if the Cisco platform is capable of this). With both devices connected to the CPE device, you would simply need to run VRRP on the internal LAN interfaces. This is more complex, but you can take a failure of one device without any of the offices being adversely affected.

If you don't go with a redundant setup (or if you have multiple WAN IP addresses from your provider) and if the CPE device can be configured to do so, then you could operate it in a bridge/bypass mode so the Cisco/EdgeRouer handles all the outside traffic directly. Eliminates a L3 network that isn't needed, avoids a double NAT situation on your side and gives you more control overall on your gateway device.

Finally, if you have the interface available, set up a fourth LAN network that you can plug into directly if needed, especially if you are not one of the three office tenants. That way you won't have to connect to one of the office networks (which they may object to) anytime you need to do maintenance.

Do CISCO SMB RV325 or Ubiquiti EdgePro allow to configure separate DHCP pools per VLAN/PORT?

Yes, I believe they both do; although I have never used that particular Cisco product, that is a relatively basic feature for this level of device.

Note: the Cisco RV325 is End of Sale as I type this. You should instead be looking at the RV345 which is the replacement for the RV325.

How do I ensure that VLANs/subnetworks are not reachable between them?

Specifics depend on chosen vendor/product, but the basic premise would be through the use of ACLs and/or firewall features. While there may also be means of simply not routing any traffic from one VLAN to another on the Cisco/EdgeRouter, depending on how the CPE device plays in the mix it may allow traffic to get "redirected" back into a different VLAN.

  • About the end of sales, this notice list only the RV325-K9-AR I.E. the Argentina model as E.O.S. Regarding VRRP, very good advice, but for the CISCO both the CLI reference guide and the use manual don't contain the word "vrrp" nor "hsrp" so it seems it's not supported. (see my answer for the links to the manuals)
    – JFL
    Commented Sep 12, 2017 at 7:00
  • @JFL, true, I didn't catch that it was only the Argentina model. However, this is still a likely indication it is on the tail end of it's life as a platform even for other models (along with the platform release date in 2013) and it would be better to look at the RV345.
    – YLearn
    Commented Sep 12, 2017 at 7:14
  • I have find in the past that internet provider's CPEs would not route to LAN other than the LAN subnetwork. So CPEs LAN must be /16.
    – M.E.
    Commented Sep 13, 2017 at 4:43
  • @M.E., then the only way this would work is if you are doing proxy ARP on the Cisco/EdgeRouter and proxy ARP is not a good solution. Rather you should look at setting the CPE device in bridge mode and allow your router to handle all the traffic.
    – YLearn
    Commented Sep 13, 2017 at 4:47
  • Why is proxy ARP needed?
    – M.E.
    Commented Sep 13, 2017 at 4:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.