Can a VLAN have a Smart Switch downstream from an Unmanaged Switch?

adoucette

OK, thank you for that. Sounds like I would need smart switches at every point where a split between trusted and untrusted VLANs needs to be made.

(Trusted PCs get LAN access. Untrusted PCs get internet only access.)

Thanks again,
Ari

stephenw10

A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

Steve

JKnott

@stephenw10:

A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

Steve

The only difference between a VLAN frame and a regular frame is the VLAN tag inserted where the Ethertype/Length field normally is. Except in managed switches there should be no filtering based on VLANs. As for the extra 4 bytes in a VLAN tag, unless a switch is limited to the 1500 byte MTU sized frame, there should be no problem. Frame expansion has been around for years and any Gb switch is likely capable of jumbo frames, which are much larger than normal size VLAN frames.

stephenw10

I agree it probably will. But you can't be 100% sure until you try.

Your 'unmanged' switch might in fact be a managed switch IC with no exposed interface such as those found in soho routers. In which case does it drop the VLAN tagged packets? Probably.

The worst case it where it passes the packets but strips the tags.

Personally I would avoid it if at all possible. It's just ugly. ;)

Steve

johnpoz

^ Exactly..

And even if does pass the frames you now have zero isolation between those vlans that pass over that dumb switch, someone connected to said switch would be able to access any vlan they want. Which might not be an issue in something like a home setup. But in general it's a HORRIBLE idea to promote such setups.

If everyone here was experienced in such technology then sure we could debate all kinds of ways to MacGyver something in a pinch.. But suggesting things that "can" be done is not doing anyone any favors..

You can for sure get a smart switch that does vlans for same price point as dumb these days. So suggesting that user can get by with just dumb switch vs a vlan capable switch when they want to do vlans is not something to promote.. It might be different if you were talking having to spend hundreds of dollars more to get a managed switch, etc. Shoot I have seen many the low end smart switches for less than the dumb model, etc.

You would hope that they would just stop making the dumb ones and all of them should be capable of basic feature set like vlans, etc. Since any of these switches out of the box are just dumb with all ports in vlan 1.. So user not needing to do vlans wouldn't know any different..

adoucette

Thanks for the great info. Smart switches have just been purchased…

johnpoz

what did you go with? Sure hope not the tp-link low end ones. They do not as of last time I checked actually do vlans correctly - they force all ports into vlan 1 so you can not really isolate and ports will see all broadcast traffic, etc.

Last I saw on their forums they were suppose to be "fixing" that - but wouldn't hold your breath, etc.

The netgear or dlink ones should be fine - or did you go with something with a bit more pizzazz?

Huge fan of the sg300 small business line from Cisco - great feature set and price point is good, but a bit high for some home budgets.

JKnott

@adoucette:

Thanks for the great info. Smart switches have just been purchased…

Hopefully not TP-Link. They don't handle VLANs properly.

adoucette

Good to know that, thanks.
I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

JKnott

@adoucette:

Good to know that, thanks.
I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

Yep, the warranty lasts until it dies. ;)

johnpoz

Did you look at the dlink 1100?

Show it for like 5-6 bucks cheaper on amazon currently and also lifetime warranty..

https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I

I have both on a shelf.. If I recall I liked the dlink interface better. I had the netgear in my av cab for awhile, replaced it with sg300-10..

I pickup such cheap smart switches now and then to be able to help users in setting them up and be able to test things that people say they do or don't do.. I had picked up the tplink for just that reason - and yeah its a POS…. I was like can not be that hard to setup vlans on the thing - but sure enough its really junk how they have it where you can not remove vlan 1.. I should prob see if they have new firmware out for it yet to fix that.

JKnott

At least you can use that TP-Link for port mirroring. It works OK in that role.