Lets say that I have internet connection brought on port 8 of the switch. I want ports 6 and 7 to use this connection, while ports from 1-5 to be able to communicate with each other, but not to use internet connection.
Main Topics
Browse All TopicsI have this switch http://www.tp-link.com/pro
To my understanding, vlan will allow me to have two networks that will not be able to communicate with each other. For example ports 1-5 will be part of vlan1 and ports 6-8 vlan2, so devices that is attached to port1-5 will not be able to communicate with devices attached to port 6-8. If this is true, then I would need to create two vlans and assign ports to them. What exactly is the procedure for this task? I have tried a few times, but I end up with not being able to access witch to web interface. What confuses me the most in this defalt vlan, for which I cannot change default membership settings (or at least I dont know how). I kniow that you possibly havent used in practice this switch, but I believe there is some general guidance that you can give me.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
It depends on the capabilities of the switch.
Generally what you do with a Layer 2 switch like this, is you set an IP interface on the switch for management: it appears that by default, the management interface is set to Vlan 1 on this switch, which is also the default VLAN.
Plug it into a suitable router (referred to as a 'router on a stick') of a type that can form an 802.1q trunk or "tagged port" with the switch, and route traffic between multiple different VLANs over _one_ physical link between the switch and the Router.
Create an 802.1q subinterface on the router, give that subinterface on the router an IP address, and the switch another IP address on the "management vlan" subnet.
Set the switch's default gateway to the router's IP on the management VLAN.
Now, for every additional VLAN you create on the switch, you create a new subinterface on the router, with a different IP subnet.
You assign all hosts connected to that VLAN on the switch, an IP address within your 'designated subnet' for that VLAN on the router.
Then you have full proper connectivity between all your VLANs at Layer 3.
But of course, since they are on separate VLANs, they are in different broadcast domains, and do not connect directly at Layer 2, which is the primary benefit of using VLANs.
You can now apply access lists to the various subinterfaces on your router to control what packets are allowed to be forwarded from different VLANs to other VLANs.
A good first step is to include an ACL that only IP traffic for IP addresses in that VLAN's IP range can be forwarded.
If you want to prevent certain VLANs from accessing outside hosts, give certain VLANs priority (QoS) when communicating each other, apply rate limits, etc, you can do that.
Using plain old router access lists, route maps, etc.
As long as your router has those capabilities.
This is the manner in which it is typically done.
Well, another possibility is to plug a router in as an access port, connected to only one VLAN, and place the switch's IP management interface in that VLAN.
But then you have _no way_ of connecting other VLANs to each other, other than bridging (which destroys the advantage of VLANs), or getting more routers and connecting them together, and they can't talk to the switch either (unless your switch allows you to add multiple management IPs in different VLANs)...
This is not recommended...
It's best to have at least one Layer 3 device capable of inter-VLAN routing.
Unless you only have 2 VLANs,
One that can connect to everything not in the other VLAN
And one VLAN that is completely isolated and can never talk to the internet or any other host in your network, other than ones in this isolated VLAN.
Business Accounts
Answer for Membership
by: benhansonPosted on 2009-11-07 at 15:50:36ID: 25768679
You just have to be aware of what VLAN you are on as you access the switch web interface. If you change the default vlan without changing the ip address of the switch to match that VLAN, you will get nocked off. Do you want the switch management functions to be available to one vlan and not the other?