Can a VLAN have a Smart Switch downstream from an Unmanaged Switch?

adoucette · May 16, 2018, 11:25 AM

Greetings,
I am curious if I can pass a VLAN through an unmanaged switch? This will influence how many "smart" switches I need to purchase.
The topography I hope to achieve is

By trusted, I mean LAN access. By untrusted I mean internet only access.

Can I do this? Or do I need three smart switches? (Or one smart switch by the pfSense box with two unmanaged switches downstream?)
If not, what is the best option as I have PCs in two locations separated by a couple hundred feet, and need trusted and untrusted PCs at each?
Thanks,
Ari

JKnott · May 16, 2018, 1:09 AM

An unmanaged switch will pass the VLAN frames. However, you won't be able to do anything with the VLANs, such as assigning one to a port, as you could do with a managed switch.

cenriq · May 16, 2018, 2:31 AM

I'd get one managed switch and connect it to ETH1 of PFsense box. You can then connect un-managed switches the VLAN ports. Cheaper that way too!

kapara · May 16, 2018, 3:54 AM

unless this is cost related due to endpoints connected meaning your initial switch is like 48 port unmanaged POE (Not very likely) managed/smart switches are pretty cheap now days! If you did not that many ports you can even get quality smart switches with 5-8 ports for a decent price! Agree with both posts. Go with managed!

adoucette · May 16, 2018, 12:24 PM

Thank you for the replies.
What I'm understanding from them is that the VLAN can pass through unmanaged switches, and so I could do this with one smart switch:

(Trusted PCs get LAN access. Untrusted PCs get internet only access.)

So would that work with just one smart switch and two unmanaged switches? And with just a single cable going from the smart switch to each unmanaged switch?
Thanks again,
Ari

johnpoz · May 16, 2018, 1:08 PM

Your drawing would be correct way to do it.. Where the smart switch is connected to pfsense. Yes you can connected dumb switches downstream of a smart(vlan switch) just all ports on these downstream dumb switches will be in whatever vlan you connect them to on the smart switch.

So in your drawing you can not do trusted and untrusted on the same dumb switch… Would be like attached.

If you want to put multiple vlans on the same switch then you need vlan capable switches all the way up the tree on that path. See attached drawing 2

adoucette · May 16, 2018, 1:19 PM

OK, thank you for that. Sounds like I would need smart switches at every point where a split between trusted and untrusted VLANs needs to be made.

(Trusted PCs get LAN access. Untrusted PCs get internet only access.)

Thanks again,
Ari

stephenw10 · May 16, 2018, 5:31 PM

A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

Steve

JKnott · May 16, 2018, 5:35 PM

@stephenw10:

A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

Steve

The only difference between a VLAN frame and a regular frame is the VLAN tag inserted where the Ethertype/Length field normally is. Except in managed switches there should be no filtering based on VLANs. As for the extra 4 bytes in a VLAN tag, unless a switch is limited to the 1500 byte MTU sized frame, there should be no problem. Frame expansion has been around for years and any Gb switch is likely capable of jumbo frames, which are much larger than normal size VLAN frames.

stephenw10 · May 16, 2018, 5:53 PM

I agree it probably will. But you can't be 100% sure until you try.

Your 'unmanged' switch might in fact be a managed switch IC with no exposed interface such as those found in soho routers. In which case does it drop the VLAN tagged packets? Probably.

The worst case it where it passes the packets but strips the tags.

Personally I would avoid it if at all possible. It's just ugly. ;)

Steve

johnpoz · May 16, 2018, 6:07 PM

^ Exactly..

And even if does pass the frames you now have zero isolation between those vlans that pass over that dumb switch, someone connected to said switch would be able to access any vlan they want. Which might not be an issue in something like a home setup. But in general it's a HORRIBLE idea to promote such setups.

If everyone here was experienced in such technology then sure we could debate all kinds of ways to MacGyver something in a pinch.. But suggesting things that "can" be done is not doing anyone any favors..

You can for sure get a smart switch that does vlans for same price point as dumb these days. So suggesting that user can get by with just dumb switch vs a vlan capable switch when they want to do vlans is not something to promote.. It might be different if you were talking having to spend hundreds of dollars more to get a managed switch, etc. Shoot I have seen many the low end smart switches for less than the dumb model, etc.

You would hope that they would just stop making the dumb ones and all of them should be capable of basic feature set like vlans, etc. Since any of these switches out of the box are just dumb with all ports in vlan 1.. So user not needing to do vlans wouldn't know any different..

adoucette · May 16, 2018, 6:29 PM

Thanks for the great info. Smart switches have just been purchased…

johnpoz · May 16, 2018, 6:43 PM

what did you go with? Sure hope not the tp-link low end ones. They do not as of last time I checked actually do vlans correctly - they force all ports into vlan 1 so you can not really isolate and ports will see all broadcast traffic, etc.

Last I saw on their forums they were suppose to be "fixing" that - but wouldn't hold your breath, etc.

The netgear or dlink ones should be fine - or did you go with something with a bit more pizzazz?

Huge fan of the sg300 small business line from Cisco - great feature set and price point is good, but a bit high for some home budgets.

JKnott · May 16, 2018, 6:56 PM

@adoucette:

Thanks for the great info. Smart switches have just been purchased…

Hopefully not TP-Link. They don't handle VLANs properly.

adoucette · May 16, 2018, 7:17 PM

Good to know that, thanks.
I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

JKnott · May 17, 2018, 1:34 AM

@adoucette:

Good to know that, thanks.
I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

Yep, the warranty lasts until it dies. ;)

johnpoz · May 17, 2018, 10:40 AM

Did you look at the dlink 1100?

Show it for like 5-6 bucks cheaper on amazon currently and also lifetime warranty..

https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I

I have both on a shelf.. If I recall I liked the dlink interface better. I had the netgear in my av cab for awhile, replaced it with sg300-10..

I pickup such cheap smart switches now and then to be able to help users in setting them up and be able to test things that people say they do or don't do.. I had picked up the tplink for just that reason - and yeah its a POS…. I was like can not be that hard to setup vlans on the thing - but sure enough its really junk how they have it where you can not remove vlan 1.. I should prob see if they have new firmware out for it yet to fix that.

JKnott · May 17, 2018, 11:07 AM

At least you can use that TP-Link for port mirroring. It works OK in that role.