At some point, I'd like to move from a single, flat, network to having a more secure network using VLANs.
I have an idea of what I would want, I just don't fully understand some details of Native VLAN, trunk ports, and having guests on a wireless network. I'll give a breakdown of what I have and what I would like, as well as how I "think" the setup would look. I'd love some feedback/advice or clarification on parts that I may be misunderstanding.
Items I'd be using:
- Netgear cable modem
- Ubiquiti EdgeRouter X
- Netgear GS108PE POE switch
- HP ProCurve 1800-24G (J9028B) switch
- Ubiquiti UAP-AC-Lite access point
- 2 ip cameras
- computer acting as NVR for ip cameras
Ideally, I'd Like the setup to be something like this:
Two SSIDs from the AP, one for myself to surf the web and have access to any network hardware, and one for guests to surf the web, but not have access to network hardware. I think to solve this, I will need a combination of VLANs and firewall rules, correct?
I'm thinking it would look something like this:
- MGT_VLAN 10 - 10.0.10.0/24
- CAM_VLAN 20 - 10.0.20.0/24
- GST_VLAN 30 - 192.168.1.0/24 with DHCP pool 192.168.1.100-192.168.1.254
Does this all seem okay so far?
I'm thinking the router should be setup as follows: Router - vif/subinterface of 10.0.10.1 and 10.0.20.1 and 192.168.1.1
And the networking hardware should be a part of the MGT_VLAN 10 and set as Native VLAN? Such as:
- SW1 - 10.0.10.2
- SW2 - 10.0.10.3
- AP - 10.0.10.4 (not sure if this would be better using DHCP vs static)
The ip cameras and NVR set to CAM_VLAN 20:
- NVRcomp - 10.0.20.2
- IPcam1 - 10.0.20.3
- IPcam2 - 10.0.20.4
If I connect to admin SSID with a 10.0.10.X static ip, I should be able to hit the cameras, NVR, or other network hardware if the router and switches are setup properly to use inter-vlan routing, correct?
If a user connects to the guest network, they should automatically receive a 192.168.1.X ip and be able to surf the web and not hit any hardware, if firewall rules are properly set, correct?
The AP, needing to handle both VLAN 10 for management SSID and VLAN 30 for guests SSID, would need to be connected to a trunk port on the Netgear switch, correct? (not sure if trunk port is the right terminology...seems kinda confusing when looking up the info on Cisco vs other manufacturers.)
I think those are all of my questions. Sorry if this post is unclear. I hope this makes sense, but if not, I can try to draw a picture.
Thank you all for your advice, recommendations, and knowledge.