0

I've got three sites, let's call them Production Plant, Remote 1 and Remote 2. They're not big networks. The Production Plant has two internal networks that has control systems designed for all being on the internal network. One of the networks has got different VLANs used for logical separation, for ie. automation, CCTV and other stuff. It's okay that they are not physically separated outbound, but how do I keep my VLAN tagging and put it all back together again on the other side?

Can I send the different VLANs as individual VPN connections between the sites? MPLS?

I'm not bound to any kind of equipment here, and price is generally not a big problem.

Improve this question
2
  • It all depends whether you can route traffic (ie. have separate IP subnets across locations) or need to bridge everything together (ie. have subnets spanning multiple locations). Routing doesn't require anything but rule/firewall setup, VLANs are all per location. Reliable bridging is much harder to do.
    – Zac67 ♦
    Oct 14, 2020 at 17:11
  • Is your intent to have a switch on either end and keep their vlan tag? If so, you can trunk the ports connected between both switches (as long as they support it) and can keep the vlan separation that way. solarwindsmsp.com/blog/vlan-trunking and cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/…
    – Josh Jobin
    Oct 14, 2020 at 19:14

1 Answer 1

Reset to default
1

Without a network diagram, I'm going to assume the site with multiple VLANs has a router for inter-VLAN traffic. In that case, there's nothing you need to do.

VLANs stop at the router interface, so they have no meaning at another site. Put differently, "VLAN 10" at one site is different than "VLAN 10" at another.

The router connected to the VLANs will tag the traffic appropriately.

Improve this answer
5
  • Hi Ron, correct, I am intending for a router/firewall to sit at the edge of the network. It will be the same at the other side. I think I just don't fully understand how it works. So in order for this to work.. I should assign an IP address, say 172.4.4.80, to network A. Then for the computer I would like for it to interact with on network B, it should be 172.4.8.82, different subnets and adjusting the netmask so they can see each other? I'm used to there being VLAN segregation for security, so an unrelated computer can in no way affect the other parts of the network, even by mistake.
    – Vincent Vega
    Oct 15, 2020 at 14:25
  • VLANs, by themselves, do not provide any security. You need Access Control Lists to restrict traffic. If you allow routing between networks, then you really don't have any security.
    – Ron Trunk
    Oct 15, 2020 at 14:45
  • We're gonna have deny-all between all VLANs and only allow traffic between specific clients and ports on a strict basis, but not regulating it internally on the VLAN. So that's why I'm kinda fussed about 'mixing together' the VLANs over the WAN connection. But then perhaps I should make similar rules in the router allowing traffic to and from that VLAN to the specific IPs of the other network that need access? But once it hits the WAN, I need to use a public IP address to reach my target router and the machine within, using NAT and rules on the router?
    – Vincent Vega
    Oct 15, 2020 at 15:06
  • Your access lists are all based on IP addresses. VLANs have nothing to do with that. Yes, you will have to account for NATted addresses, but you don't have t worry about VLANs.
    – Ron Trunk
    Oct 15, 2020 at 17:31
  • It might be helpful to think "subnet" rather than "VLAN" you are filtering traffic from one subnet to another.
    – Ron Trunk
    Oct 15, 2020 at 17:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.