VLAN configuration for separate networks sharing a network printer

Posted on 2013-05-14
Medium Priority
Last Modified: 2013-11-14

I have a Netgear FS726T, a Linksys E1200, Linksys E1500 and Linksys 5 port 10/100 switch.  Now, first off, don't blame me for the hardware I'm working with.  I was just thrown into this project.  

I have eight Windows 7 workstations that need to be in their own VLAN.  Another two Windows 7 workstations that need to be separate from the other eight.  The eight can't see the two and the two can't see the eight.  But all ten Windows 7 workstations need to be able to see the Ricoh network printer.  Currently, the Ricoh is plugged into the Linksys 5 port 10/100 switch.  This switch is also connected to a LAN port on both the E1200 (192.168.1.x) and the E1500 (192.168.0.x). I see what the last guy was trying to do but the networks bleed together and both the networks can see each other.  

My first question is, do I have the right hardware for what I want to accomplish?

Second, if I do have the right hardware and able to set it up with VLAN on the Netgear switch.  How do I configure the VLAN for 3 VLANs, groupA, groupB and printer?  Allow groupA and groupB to see printer group but not be able to see each other.

Question by:Matt Kendall
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
LVL 18

Expert Comment

ID: 39166805
There are a few options I can think of.
1. Is to create a static route from the both network to point to the ip of the printer
create an access list to only allow the network 192.168.0.x access to the network 192.168.1.x if the destination is (assuming the printer's ip is

2. Ideal way Is to create a separate vlan for the printer and create an access list to allow traffic from all other vlans.

You definitely do not have the right gears for this. You need an enterprise level switch and router or layer 3 switch by itself to make the most out of this

Author Comment

by:Matt Kendall
ID: 39166831
Thanks Akinsd for your reply and advice.  I was afraid that my equipment wasn't up to the level needed.  I tried several configurations with the Netgear and all the VLAN does is label and group the ports.  There's no other functionality.  Is there anything other than Cisco that you might recommend for this?  Thanks!
LVL 10

Expert Comment

ID: 39168061
*IF* your switch can put two VLANs on one port (without tagging), you should be able to do this..  If that's the case, and you dont have a router, then all the machines need to be on the same subnet..  Make them all 192.168.0.x or 192.168.1.x, but dont mix the two..  We're not going to use IP subnets in this case, we're going to use the VLANs.  Think of the VLANs as separate switches..  Put "group 1" machines into ports connected to one VLAN, and put "group 2" machines into ports configured on a different VLAN.  Put the printer(s) into ports that have both VLANs configured on them.  That way, the printers can accept packets from either VLANs.
Percona Live Europe 2017 | Sep 25 - 27, 2017

The Percona Live Open Source Database Conference Europe 2017 is the premier event for the diverse and active European open source database community, as well as businesses that develop and use open source database software.

LVL 18

Assisted Solution

Akinsd earned 1000 total points
ID: 39170064
I work exclusively on Cisco gears and can only recommend Cisco unfortunately. You may be able to find used switches on eBay at low cost.

There is another vlan concept called private vlans, I think that might be what 172pilotSteve is referring to except that you cannot configure 2 data vlans on 1 port (combination is data, voice or video). It requires some deeper understanding and you current switch definitely doesn't support it like you have described.

There are 3 categories of ports you can assign in private vlan.

Promiscuous, Community and Isolated.
PVLANs provide layer 2 isolation between ports within the same broadcast domain. There are three types of PVLAN ports:

   Promiscuous— A promiscuous port can communicate with all interfaces, including the isolated and community ports within a PVLAN.
    Isolated— An isolated port has complete Layer 2 separation from the other ports within the same PVLAN, but not from the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic from isolated port is forwarded only to promiscuous ports.
    Community— Community ports communicate among themselves and with their promiscuous ports. These interfaces are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.

With this, you would put the printer in the promiscuous ports, you can then use community or isolated as desired.

I chipped this in just to clear up some things but I know this is not an option for you anyways
LVL 10

Accepted Solution

172pilotSteve earned 1000 total points
ID: 39170117
Yes..  That's the current cisco version of what I'm talking about...  When I did it, it was about 1996 on some old switches that actually let you just pick which vlans would be on which ports, and we did EXACTLY what he's talking about... 2 groups of users who shared one printer.  In our case it was because one group of users wasn't allowed to get on the Internet, so this was how we solved it.  It's been so long, I can't remember what brand of switch it was..  I'm quite sure they're out of business or bought by Extreme or something..

The only other way I can think to do it would be to put a typical home class NAT router in between the printer and the two groups of routers...  One router would have group one on the LAN side, and another identical router would have group 2 on the LAN side, and then on the WAN side of both routers would be the subnet with the printer.  That would effectively isolate the two groups, but I don't know if it would break something else that might be in the network.  If the printer is it, then that might work, and old Linksys WRT-54G or even the router version without the wireless would be fine, and they're cheap on ebay if you don't have one sitting around.

If that doesn't make sense, let me know, and I"ll try to whip up a quick drawing, but also let me know if the Internet is involved in any way, and if so, should either or both groups be allowed or restricted from the Internet..??

Author Closing Comment

by:Matt Kendall
ID: 39650248

Featured Post

Ransomware Attacks Keeping You Up at Night?

Will your organization be ransomware's next victim?  The good news is that these attacks are predicable and therefore preventable. Learn more about how you can  stop a ransomware attacks before encryption takes place with our Ransomware Prevention Kit!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question