Thank you very much! Your explanation was very clear and confirmed in a way what I was thinking. So I'm really going to leave everything untagged? Should I just turn off Assymetric VLANs. Would that remove the PVID option? COuld you explain the difference, if so?
Furthermore, I believe I am going to use a dedicated unmanaged switch for backup traffic and keep it separate from the DLink and the rest of the network. So, I will just not add the backup_systems vlan and use 17-46 for internal connections. conf vlan internal add untagged 17-46
I will need to connect a separate unmanaged switch to this DLink, for the remainder of our clients internally. Should I have a special port configured for the link from unmanaged switch to DLink? Maybe consider Trunking for additional BW? I have (2) ports open 47-48.
I also want to make sure I have this setup to monitor our network connections and possibly do Qos. I have enabled SNMP and given unique public and private strings.
Thanks again
by: from_expPosted on 2009-04-23 at 05:12:32ID: 24214101
hi!
let us clarify some terms:
vlan (Virtual Lan) is represented by vlan id and in most cases each vlan has it's own IP subnet.
switch port can belong to one or several vlans
if it belongs to a single vlan, than port has pvid (Port Vlan ID) because switch has to understand to which virtula lan unmarked packets should be sent to
if port belongs to multiple vlans, then it is tagged and pvid is used for traffic without vlan markings, tagged packets are send to a particular vlan (if that vlan is allowed on a particular port)
I would try do create a configuration in d-link commands (suitable for des-3526 and others, but I know that syntax can be different in some models)
configure vlan default del 2-48 --- removes all ports except 1st from vlan default (vid=1)
create vlan dmz tag 2
conf vlan dmz add untagged 2-16 -- we create vlan 2 and assign ports 2-16 to it as untagged
create vlan internal tag 3
conf vlan internal add untagged 17-34
create vlan backup_systems tag 4
conf vlan backup_systems add untagged 35-48 -- please note, that you don't need these ports to be tagged, because they belongs to a single vlan only
so what to do next? I expect you to take router(firewall) with 4 interfaces and connect it to your switch in the following way:
switch port 2 - with let's say dmz interface and address 192.168.2.1/24
port 17 - to internal interface with address 192.168.3.1/24
port 35 - to a second internal interface for a backup networks with address of let's say 192.168.4.1/24
wan port - to the ISP's router with an ip provided by your ISP.
so your firewall effectively routes traffic between vlans and internet.