Connecting two vlan on L2 switch

Question

I'm about to buy a switch which handles VLANs.
Before I buy that switch, I'd like to know : Is it possible to connect two VLAN on a L2 switch ?

I am aware of the topic : Connecting two VLANs together on a single switch but my situation isn't with a L3 switch.
Herer is my plan : I thought I could connect a cable from VLAN 1 to VLAN 2 to connect them but I found I may need a router to handle the different IP address.
I need to separate one special computer, and control (the most strictly I can) the access to this computer. My boss wants that computer to be on a separate network.

I plan to buy a NETGEAR GS108Ev3 (the model on the image isn't a GS108Ev3)

Is it possible to do so ?

Answer 1

If you are using a separate IP network (ie, with disjoint addresses), then something must have an address, and a connection, on both sides.

• With a router you can filter on IP addresses and many other things, such as the UDP protocol, source and destination port numbers, packet sizes.
• A so-called L3 switch is a switch with router functionality: ie, it's a router too
• With a firewall you can filter on many things including URLs or other higher-level aspects of the interaction
• With a application layer proxy you can filter on all kinds of permissions, time of day, history of transactions, cookies, sessions, and whatever else might be convenient.
• With a wire you can do nothing. If you're joining two VLANs with a wire, it's usually a mistake which just complicates your network without providing any benefit.

You say you want to control access "as strictly as you can", but you don't say what kind of service the special computer is intended to perform, so it's hard to guide any further without guessing. If I were to guess, I'd suggest a small router with two ethernet interfaces. Put special computer on its own on one side, other side into your main LAN.

[EDIT] ... it's also possible to do this kind of thing with private VLANs on some ethernet switches, which make some ports of the switch only able to commuinicate with certain other ones. The purpose of these is, for example, to make it that all hotel guests' laptops can communicate with the router and thus the internet, but not directly communicate nor see each others' broadcasts etc. Different switch manufacturers do these in different ways, and they appear to be non-standard. You'll have to check your switch manual to see what it offers in this. I'd advise against them unless you have compelling reasons. From your description of your task, this won't achieve what you want: you can't filter by protocol UDP and port, for example.

Answer 2

If you connect a cable between two ports, each one in a separate VLAN as access port, then you end up with having a single VLAN

This is exactly the same as having two different physical switches and connecting them together with a cable.

If this computer must be on a separate network, then you have to create a third VLAN for this computer, then route - and filter - the traffic to/from this computer on a router.

So you need a router that is VLAN capable and have the security features needed to reach whatever security level you want to achieve.

Most enterprise grade router do have some way to filter the traffic that can come from or reach a specific network (access lists). If this computer really need a high level of security then you may need a firewall that perform packet inspection.

Answer 3

What you are asking will not be possible without a layer 3 switch or router. You cannot connect two separate networks with different IP addresses with a layer 2 switch.

Moreover connecting a cable between 2 different VLANs pretty much destroys the purpose of the VLAN in the first place. Why not put it all in the same VLAN then? It also pose a security risk to do so as all traffic from both VLANs will flow freely between them.

Answer 4

Yes your difinately required a layer3 devices to ensure communication between Vlan 1 & Vlan 2 . General layer2 devices is a transparent devices communication between same Vlan is feasible with layer2 switch . Based on destination mac address frame is destined to destination based on check with mac - address table .

Inter - Vlan routing configuration is mandate on layer3 device to route traffic between different VLans .

Answer 5

Thanks, I wanted to forbid every IP except one to access the other VLAN, but it looks like it won't be possible with only a "normal" switch – Maxime.D yesterday

Like others have said...every day common access layer switches are layer two. VLANs, like in your graphic are layer two...to bridge VLANs a layer 3 device is needed.

Interconnecting a switch is always a bad idea and should never be done, safegurads exist on the switch but interconnecting a swtich can cripple a network.