Set up 2 VLANs and rate limit Internet bandwith

Question

I generally work with software instead of networking so please bear with me.

I have a good understanding of simple network principles like subnetting, DHCP, DNS and the like but have a slightly more complicated task at hand involving VLANs and a Cisco router.

We currently have a simple network architecture which involves a rack-mounted fibre termination point(?) that then has a RJ-45 cable to a Cisco 4300 series router. The router is then connected to a Linksys Velop which acts as a wi-fi access point and a DHCP server for our network.

We have a new team joining our building and we'd like to move them onto their own subnet, isolated from our devices. To do this, we have purchased a managed switch (Netgear JGS524E) where we're creating a couple of VLANs and tagging the relevant ports to each VLAN. Then, for each VLAN, we'd like to rate limit the Internet traffic so it's fair for all users.

The 2 questions I need help with are: 1. Once I have the VLANs created on the managed switch, what needs to happen on the Cisco 4300 for it to act as a gateway for both VLANs, but to also enable rate limiting to the gateway? 2. Where should we be doing DHCP for the VLANs? The Velop seems like an unusual place for this and will only be able to do 1 of the networks.

Lastly, one of the things I'm struggling with is how the Velop communicates with the 4300 as I cannot see the 4300 anywhere on our local network (192.168.1.x). Instead, the Velop has the Internet settings set up as a static IP address and a gateway which are both public internet IP addresses provided to us by our ISP. I thought routers have to have a local IP and a remote IP and handle the routing within the router, just like most home routers. i.e. a router will usually be 192.168.1.1 and will have a public IP address assigned to it as well.

Really appreciate your help with this!

Answer 1

we're creating a couple of VLANs and tagging the relevant ports to each VLAN.

Actually, you do not tag on the access interfaces (those connecting to the host devices, like PCs and printers) because most end-devices do not understand VLAN tags. You tag on trunk interfaces (those carrying multiple VLANs, like the connections between switches or from the switch to the router) in order for the network device receiving traffic from multiple VLANs to be able to separate the traffic back into the correct VLANs.

Once I have the VLANs created on the managed switch, what needs to happen on the Cisco 4300 for it to act as a gateway for both VLANs, but to also enable rate limiting to the gateway?

You need to define the interface for each VLAN on the router. The link between the router and switch will be a trunk link. You will create a subinterface for each VLAN, and you will address each subinterface with the gateway for the VLAN it serves. If any VLAN does not have a DHCP server, then you will add a helper address pointing to the DHCP server.

Then, for each VLAN, we'd like to rate limit the Internet traffic so it's fair for all users.

You are asking about QoS, which is a huge topic that covers everything from classifying/marking traffic to what to do with the traffic based on the markings. This is really too broad to answer here, and entire books have been written on the subject. We can try to answer specific questions, but we cannot just explain QoS in this type of site.

Where should we be doing DHCP for the VLANs?

You have a DHCP server. The DHCP server can be on any one of the networks, and you would use DHCP relay (ip helper-address) for any network that does not have a DHCP server on the network. On the DHCP server, you create a scope for each VLAN it serves, even if the network is not directly connected to the DHCP server. The Cisco router has rudimentary DHCP server capabilities, and we could help you configure that, otherwise server configurations are off-topic here.

I thought routers have to have a local IP and a remote IP and handle the routing within the router, just like most home routers. i.e. a router will usually be 192.168.1.1 and will have a public IP address assigned to it as well.

Home routers (consumer-grade devices) are off-topic here. Business-grade routers will have an address for each interface (whether physical or logical) used, and they will route between any of them. With VLANs you will be creating logical interfaces for each VLAN, and each VLAN will need a router address for the VLAN it serves, and those addresses are the gateways for the VLANs they serve.