Home Network Design

JT40

The stuff you can accomplish at l

Thank you.
You recommended an L2 switch in the end, did you mean L3?
Without L3 I won't have routing capability, L2 VLANs are quite limited, despite the concept of VLAN can be applied also at L2.

I have other questions:

What switch (L2 or L3) do you recommend that doesn't create any kind of conflict with a PfSense Firewall?
I would tag my VLANs, but you said that what happens in PfSense won't have anything to do with a VLAN in the L3/L2 switch...
Did I understand correctly? Is there no way to pair the VLANs IDs?
I'm not sure if I'll need such thing, but initially it seemded to be the right thing to do.

The reason why I'd add an L3 switch is to have more ports, that's it.
The fact that I can block multicast etc, ok, but I thought that also PfSense can do it... Maybe yes but it happens on another layer, and surely on a different device.

Certainly, the fundamental thing seems to be the functionality of private VLAN, without it, it would just be a simple HUB, right?

johnpoz

@jt40 your pfsense can route.. But sure if you really want to route at your switch, there are reasonable L3 switches.. My sg300 does L3, I don't really use it for that, other then if want to lab something for something. My sg4860 handles all my routing needs, and adds the ability of simple firewall rules between vlans - which while you can do acls and such at a L3 switch - the firewall capabilities are normally quite limited.. And difficult to maintain and configure vs just point and click in pfsense.

JT40

@johnpoz So you are suggesting to keep my PfSense box as an L3 firewall, then add up an L2 switch, it seems reasonable to choose 24 ports for the future.

For me, the form factor has to be fanless, what brand do you recommend? Unfortunately, Netgate doesn't make L2 switches.

With 500 pounds budget I could have purchased the Netgate 2100 and an L2 switch with 24 ports :*(

Coming back to the businees:

I had a quick look online, TP-Link seems to be the cheapets, are they good?
What about an AP?
Ubiquiti? These are quite expensive :D , also there I need client isolation!

JT40

I still have few doubts:

I had a quick look online, TP-Link seems to be the cheapest, are they good?
I don't ask only for the price, but also for the availability and the fact that they are quite recent, instead, brands like HP (became Aruba for network appliances) and Cisco are basically all old, for example, your sg300-28 is going to be out of support in 2023... I don't even mention HP...
It's also important to notice that the new TP-Links are available in UK, the others need to be imported, unless I buy something used without warranty in UK...

The idea is one of these 2, most probably the one with 24 ports
https://www.tp-link.com/us/business-networking/managed-switch/t2600g-28ts/#overview
https://www.tp-link.com/us/business-networking/managed-switch/tl-sg3452/#overview (they still release updates for this)

The probelm with TP-Link seems to be the support, after 3 years good bye... When I look at Cisco and HP though, it seems that they both reduced the support, better than TP-Link but this is not the moment to enter first in the timeframe... As an example there is your sg300.

Certainly I'll need to choose an L2 switch that doesn't have PoE ports, they consume much less energy (max 20W ) and 24 ports are enough for me, against 250W+ for a PoE switch .............................................................
I have a doubt on these 2 products, I'm not oriented with these products but I'm curious to discover why that huge difference, I'm not able to understand the reason behind the TDP difference:
https://www.arubanetworks.com/assets/ds/DS_2530SwitchSeries.pdf

Aruba 2530-24G Switch
(J9776A)
Maximum power rating 14.7 W
Idle power 8.4 W
Aruba 2530-24 Switch
(J9782A)
Maximum power rating 48.0 W
Idle power 28.8 W

What about an AP?
Ubiquiti? These are quite expensive :D , also there I need client isolation!
Do you suggest to set 2 different APs for work and home network? Ok client isolation, but I'm not sure about the real isolation that it offers :D , moreover I don't know if I can setup the routing of the devices connected through WIFI in different VLANs.
I have an important requirement, that is to set the VPN on the router for a specific VLAN, I think I can do it with PfSense without troubles.
The question is: can I enable the VPN for a VLAN that is defined in L3, but after that I have an L2 switch that pairs the same VLAN ID?
Probably my networking knowledge should be better :D , but I think that the switch will only switch, I won't create a VLAN at L2, but only in the PfSense box.
If my assumption is correct, then how the PfSense box will get the device ID? Is it only about the MAC?
I also assume that I'll rely on the L2 private VLAN, but it's not the VLAN at L3, right?

The intention is to create VLANs and some of them will have a VPN from the PfSense box.
At the same time, the devices should not talk each other, they should not even see each other, which I believe is the purpose of a private VLAN.
This unfortunately confuses me, until I don't have a switch in front of me I can't test it, so that's why I ask here.
The moment I set the private VLAN functionality in the L2 switch, then is it just about creating VLANs at L3???
Are these things completely indipendent?

johnpoz

@jt40 said in Home Network Design:

TP-Link seems to be the cheapest, are they good?

For a switch - I wouldn't go that route.. There are many a thread even here, and all over the net, even their own forums where they wouldn't let you remove vlan 1 from ports you wanted to put in another vlan, etc. Took them forever to fix, and then didn't port it backwards to their old models.

They said it was normal <rolleyes> on their own forums until they finally fixed it.. They don't seem to understand how vlans are suppose to work ;)

can I enable the VPN for a VLAN that is defined in L3

Yeah could policy route for a network that is downstream of pfsense..

Ubiquiti? These are quite expensive

Guess that is relative, they are very reasonable priced if you ask me - for what they do. You can pick up a lite model for under 100.. I show the uap-ac-lite over at baltic for 80$ currently. I believe they are sold out of their wifi 6 lite model, but that retails for 99$

Sure some of their higher end model are a bit pricey for a home setup, like the SHD which I would love to have to play with, but at $500 I don't want to play with it that much ;)

I have 3 of their AP currently, the UAP-AC-PRO, the lite and the LR.

JT40

@johnpoz Thank you.
The Ubiquiti switch you mentioned is this one?
https://store.ui.com/collections/unifi-network-switching/products/usw-lite-16-poe , 200 dollars/pounds new, not bad, even though I find it much cheaper on unofficial stores...

In this link you find the AP from Ubiquiti, in the bottom of the page, do you mean the first one on the table? U6 Lite?
https://www.ui.com/wi-fi#compare
Will I be able to separate the connection between 2 different devices and put them in 2 different VLANs?
As you understood, I'll have PfSense --> Switch --> AP, so the VLANs creation would be in the switch first, or directly in the PfSense box, not sure what's best :D , but at least I want to be sure that I can do it in somehow.
Basically, my WIFI devices have to be in different VLANs.

johnpoz

@jt40 not switch AP... I didn't recommend a switch.. Not really a fan of their switches..

Yes ALL of their AP support vlans.

stephenw10

@jt40 said in Home Network Design:

The idea is one of these 2, most probably the one with 24 ports
https://www.tp-link.com/us/business-networking/managed-switch/t2600g-28ts/#overview
https://www.tp-link.com/us/business-networking/managed-switch/tl-sg3452/#overview (they still release updates for this)

Those switches would likely be fine. TP-Links 'business' switches are a world away from their SOHO devices, might as well be a different company. I have a T1700G-28TQ and would have no problems recommending it, though only if you need 10G.

A PoE switch is not going to use 250W unless you have a load of PoE devices drawing power from it.

Steve

bingo600

Mixed up posts

~~It was my understanding that the OP already had a PoE switch , that might be "unsafe" to use with multi vlan (as L3 routing can't be disabled.~~

But if all the Cameras that need PoE , would be put in the same Vlan. Then why not try to use that switch for the PoE part, and just run a single "untagged" port from the "core switch" to the PoE switch.

~~Now the "core switch" could be a cheap xx-port L2 managble switch.~~

/Bingo

johnpoz

@bingo600 said in Home Network Design:

(as L3 routing can't be disabled.

huh.. What switch would be like that, even if supports L3 if you do not setup any SVIs it has no way to route.. Mine is in L3 mode, but it only has the 1 SVI used for management, so there is no way it can "route"..

bingo600

@johnpoz
Think i have mixed up this thread with another -- OOPzzz
Forget the above.

/Bingo

johnpoz

@bingo600 no biggy some of these threads are close in nature.. I for sure have done that a few times ;)

JT40

Thanks everyone so far, but this thread will be a bit in this way, I'll keep asking questions :D until I don't saturate your patience :D

I came across Cisco Meraki, I was excited for the price, support and performance, but guess what, this is what you find in the end of this thread: https://forum.netgate.com/topic/160537/pfsense-cisco-switch-ms220-24p/18

A Meraki switch is cloud managed and needs to be able to see the internet for it to work.

Here is what the lights mean: https://documentation.meraki.com/Go/Meraki_Go_-_Decoding_the_LED_Light

I would reset the Meraki switch to default and then connect to pfsense box.

See restore button: https://documentation.meraki.com/MS/MS_Installation_Guides/MS_End_of_Sale/MS220-24%2F%2F48_Series_(EOS)_Installation_Guide

I have number Meraki switches and if they cannot see the internet they do not boot.

I'm speechless, what about if my Internet goes down?? It doesn't even boot?
What about if it's already ON, does it turn OFF?

I'd like to take this switch precisely, if I don't go with TP-Link: cisco meraki ms220-24p
Not easy to find in the list of supported devices, not sure why , but you can find it here: https://meraki.cisco.com/lib/pdf/meraki_datasheet_ms_220_320_only.pdf

I think I like the possibility of having PoE ports for videocameras in the future, and why not, some other IoT device, so I'm also evaluating PoE switches.

bPsdTZpW

@jt40 said in Home Network Design:

Thanks everyone so far, but this thread will be a bit in this way, I'll keep asking questions :D until I don't saturate your patience :D

I came across Cisco Meraki, I was excited for the price, support and performance, but guess what, this is what you find in the end of this thread: https://forum.netgate.com/topic/160537/pfsense-cisco-switch-ms220-24p/18
A Meraki switch is cloud managed and needs to be able to see the internet for it to work....

Ugh indeed. Also cloud-managed devices offer manufacturers more opportunities to spy your network, and hackers more routes in. I chose a Cisco CBS350 several months ago, and have been pleased so far. It's not cheap (~$300 for the 16 port model) but it's full-featured (yes, all the VLAN stuff you're likely to need) and doesn't need any WAN connectivity (or periodic license renewals!) to work. For any switch, but especially more expensive ones, beware fake hardware or grey-market items.

bingo600

AFAIK the Meraki's needs a valid license , that will expire.
And you have to renew ($$$) the license, when it's expired, in order to get the device to work again. The device validates the license on/via the internet.

I did help a friend convert a Meraki AP to OpenWRT (requires a JTAG).

They're a bit like "Ink Jet Printers" ... Cheap hardware , but constant expenses.

/Bingo

AndyRH

I found an old Aruba S2500 on eBay for $120 a while back. 48 port, it has exceeded my need.
Just a thought.

JT40

@andyrh I found them used in UK, but no PoE...

The problem is that PoE became a requirement, the Ubiquiti AP, as well as many others, supports only PoE to power up the device, I'm really sick about this switch search, I couldn't imagine it was so painful...

That PoE model costs 360 used, the one without PoE it's around 150 pounds.
I don't feel to spend 360 pounds for an used item without warranty...

At this point, it makes sense to look at TP-Link or D-link, but guess what, the PoE models cost twice...

I think I'll look other APs in order to remove the need for PoE, but I won't be able to attach any videcamera to it, it's not a requirement now, but in the future it could become handy.
On the other side, I already spent 500 pounds (including import taxes) for my firewall, I exagerated due to the gaming requirement, I didn't want the firewall to cause any delay in DPI functions...
In any case, it seems silly to spend so much for a switch, which does only L2 switch job :D .
Maybe I'm missing something, I can't believe that everyone needs to spend around 1K between used and new hardware just to build home networks...

johnpoz

@jt40 said in Home Network Design:

I think I'll look other APs in order to remove the need for PoE

And then where do you mount them for good coverage? now you have to place them somewhere you have power to plug them in, and now you have not only the device with its network connection, also another power connection, etc. You don't need a poe switch to power poe devices. You can just use injector - when you buy single AP they ship with the injector. Pretty much any good AP is going to be poe..

While sure poe switch is cleaner deployment. If you only have a handful of them its not a problem to use the injectors. I have 2 injectors hanging off my core 28 port switch, but they are hidden behind the desk the switch sits on. And the other one I have coming off my switch in my av cabinet in the living room.. The injector is just in the av cab and not seen, etc.

You could also just get a lower port density switch that does your poe for your poe devices. Vs wanting to find a high port density switch that also does poe, now your talking more cost. Problem you can run into with that sort of setup is bandwidth limitations from the uplink from that switch into your network. But possible you could use lacp into your core from that, or possible a 10ge uplink from the smaller switch to your core switch, etc.

Also do you really need L3, do your routing at your firewall/router - pfsense vs doing it downstream in your network. Finding a high port density L3 switch with poe puts you into enterprise level gear, that is not cheap.. Normally not quiet nor power friendly ;)

Finding the gear that does what you want from networking perspective at home user prices can be a challenge for sure ;)

bingo600

@jt40

I'm using these for my UBI AP-AC-PRO.
And for IP Phones too.
My requirement was Fanless ....
So the C3750-24 PoE switch i was offered for free was not an option.

D-Link DGS-1100-08PV2
https://www.amazon.co.uk/D-Link-DGS-1100-08PV2-Gigabit-Managed-features/dp/B08MWJVWW1/

They have a "Power budget" of 64W , and would easily run around 4 AP's.

Do NOT go cheap , and get the 5-port (only 18W power budget)

/Bingo

johnpoz

@bingo600 said in Home Network Design:

C3750-24 PoE switch

Would of been a great switch - but not quiet nor power friendly that is for sure..

BTW - the whole core, distribution and access layers come into play as you increase the complexity of your network for a reason ;) The access layer switches is were poe would be, and you wouldn't be doing L3 there.. You would be doing L3 most likely at the core, possible at the distribution layer depending on how large your network is, etc. But poe normally not done at either of those 2 layers. Only at access layer.

Welcome to the fun of trying to setup enterprise level sort of network on shoe string / home budget ;) hehehe And also trying to make sure its quiet and power friendly - while enterprise level gear is neither since its normally hidden away in some dc or idf or closet and noise doesn't come into play..

A few years back had some work redo closets for customer - 3 3850s in stack in closets, man it was like jet taking off when you powered those suckers up in that tiny closet room ;)