Menu
What's new

Looking for Instructions/Steps to Configure VLAN

onyxlinkia

onyxlinkia

Getting the hang of it
Joined
Aug 16, 2015
Messages
158
Reaction score
62
I just bought an used 24 ports Cisco 3560V2 from Ebay. I'm planning to set up VLAN instead of using dual NICs on the BI machine. Any pointers on how to achieve this? Just want to make sure the cameras have no access to internet.

Thanks.
 
T

The Automation Guy

Known around here
Joined
Feb 7, 2019
Messages
1,417
Reaction score
2,820
Location
USA
letmegooglethat.com

Let Me Google That

For all those people that find it more convenient to bother you with their question than to google it for themselves.
letmegooglethat.com letmegooglethat.com

(PS - I'm not trying to be snarky with this response. It's just an easy way to give out Google results....).
 
biggen

biggen

Known around here
Joined
May 6, 2018
Messages
2,607
Reaction score
2,917
The basics are:
  1. You will have to make sure your router can do VLAN routing (which most modern routers should).
  2. Create two subnets on your router (you already have one so create one more). The second one needs to be assigned a VLAN number (e.g. VLAN 10). It will need a different subnet than the one you use now. So if you currently use 192.168.1.0 than the newly created subnet for VLAN 10 could be on 192.168.2.0. This will be your newly tagged VLAN subnet. Your first subnet you have been using is probably untagged (or it defaults to VLAN 1 on some routers)
  3. On the new switch, you will need to set the switch ports you desire to be in this VLAN to VLAN 10. These are generally referred to as tagged ports. The ports you don't want tagged (e.g. the subnet you use now) can be left untagged (also called access ports).
  4. The uplink port on the switch back to the router needs to be set as a "trunk" so it will carry tagged and untagged vlan traffic.
  5. The port on the router may/will also need to be set to trunk.
That is the gist of it. Setup and terminology can vary but that are the basic steps.

After everything is working and you can route (connect) to things in VLAN 10 from your untagged VLAN then it's time to create some firewall rules that blocks all outbound traffic from VLAN 10 to the WAN.
 
Last edited:
onyxlinkia

onyxlinkia

Getting the hang of it
Joined
Aug 16, 2015
Messages
158
Reaction score
62
Thanks for these helpful info. Unfortunately, my router (ASUS RT-AX86U) won't be able to do VLAN:( I guess I will go with the dual NIC route.

biggen said:
The basics are:
  1. You will have to make sure your router can do VLAN routing (which most modern routers should).
  2. Create two subnets on your router (you already have one so create one more). The second one needs to be assigned a VLAN number (e.g. VLAN 10). It will need a different subnet than the one you use now. So if you currently use 192.168.1.0 than the newly created subnet for VLAN 10 could be on 192.168.2.0. This will be your newly tagged VLAN subnet. Your first subnet you have been using is probably untagged (or it defaults to VLAN 1 on some routers)
  3. On the new switch, you will need to set the switch ports you desire to be in this VLAN to VLAN 10. These are generally referred to as tagged ports. The ports you don't want tagged (e.g. the subnet you use now) can be left untagged (also called access ports).
  4. The uplink port on the switch back to the router needs to be set as a "trunk" so it will carry tagged and untagged vlan traffic.
  5. The port on the router may/will also need to be set to trunk.
That is the gist of it. Setup and terminology can vary but that are the basic steps.

After everything is working and you can route (connect) to things in VLAN 10 from your untagged VLAN then it's time to create some firewall rules that blocks all outbound traffic from VLAN 10 to the WAN.
Click to expand...
 
biggen

biggen

Known around here
Joined
May 6, 2018
Messages
2,607
Reaction score
2,917
onyxlinkia said:
Thanks for these helpful info. Unfortunately, my router (ASUS RT-AX86U) won't be able to do VLAN:( I guess I will go with the dual NIC route.
Click to expand...
Buy a new router or see if it's flashable with dd-wrt.
 
S

SpacemanSpiff

Known around here
Joined
Apr 15, 2021
Messages
1,477
Reaction score
2,496
Location
USA
I guess you could always build your VLANS then use ACL's to allow only the IP of the BI server over to the data VLAN and out to the Internet.

That would make for a pretty big/deep puddle of networking to 'fall' into
 
biggen

biggen

Known around here
Joined
May 6, 2018
Messages
2,607
Reaction score
2,917
SpacemanSpiff said:
I guess you could always build your VLANS then use ACL's to allow only the IP of the BI server over to the data VLAN and out to the Internet.

That would make for a pretty big/deep puddle of networking to 'fall' into
Click to expand...
He still has to provide routing though. Are you talking about rolling your own router like building a pfSense server?
 
onyxlinkia

onyxlinkia

Getting the hang of it
Joined
Aug 16, 2015
Messages
158
Reaction score
62
biggen said:
Buy a new router or see if it's flashable with dd-wrt.
Click to expand...
Just bought the router last yr, i checked that dd-wrt doesn't support vlan on this router. Dual NIC is much easier for me.
 
S

SpacemanSpiff

Known around here
Joined
Apr 15, 2021
Messages
1,477
Reaction score
2,496
Location
USA
biggen said:
He still has to provide routing though. Are you talking about rolling your own router like building a pfSense server?
Click to expand...
I was thinking layer 3 switches. I just reviewed the specs on the 3560, and it looks like they are L3 capable.
 
You must log in or register to reply here.
Top