How to do vlans with physical nic's to AP's?
-
As another way to skin the cat, maybe you put your physical interfaces into a lagg, and then use the lagg as your uplink from the switch to router.. Where all your vlans ride the lag tagged, or 1 could be native, etc.
Depend on how much control you might want over what specific physical interfaces a specific vlan rides on.. Since once you put the traffic on a lagg you really don't know which vlan will be riding which specific physical interface at any given time... It just becomes a shared pipe, with multiple lanes on it..
Kind of like a 4 lane highway vs a 2 lan.. But you don't know which lane a specific car will take at any given time.
-
No @johnpoz dont make me think too hard!!!
Yes I suppose that is another option, I think tho just separating the network LANs should be fine for my needs.
Its just a household and I've been using the same NIC for all 3 LANs for a few months without issue :) -
Hehe.. Yeah your prob overthink it to be honest... As long as the physical interface does not become a bottleneck it doesn't really matter.
But I deal with this sort of stuff all the time trying to optimize data flow in the data center with lots and lots of traffic and hundreds of different vlans, etc. etc.
-
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Its just a household and I've been using the same NIC for all 3 LANs for a few months without issue :)
If you used multiple NICs to connect to a single access point, you'd then need to add a managed switch to convert the 3 connections into 1 with VLANs.
-
Yeah if you want to break out your traffic into different uplinks into your router a vlan capable switch is a requirement.. You can not just plug the AP into the routers interface directly. But I take you have that already because you mentioned 2 AP..
-
@JKnott said in How to do vlans with physical nic's to AP's?:
If you used multiple NICs to connect to a single access point, you'd then need to add a managed switch to convert the 3 connections into 1 with VLANs.
Yeah I have Unifi managed switches that already allow VLAN tagging and specific port tagging, so I should hopefully be OK.
I have 2x Unifi switches, 1x PoE, and 1x Normal managed switch.
And 2 APs that run off the PoE. Other than Unifi its my pfSense router so I should be good. -
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Yeah I have Unifi managed switches that already allow VLAN tagging and specific port tagging, so I should hopefully be ok.
You can create the VLANs in pfSense and connect the AP to the switch with a trunk port. Other ports can be access ports connected to the appropriate VLAN. You may have heard the term "router on a stick", where VLANs are used to connect a router to the switch, for routing between VLANs. That is what would happen if you used VLANs on pfSense.
-
@JKnott said in How to do vlans with physical nic's to AP's?:
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Yeah I have Unifi managed switches that already allow VLAN tagging and specific port tagging, so I should hopefully be ok.
You can create the VLANs in pfSense and connect the AP to the switch with a trunk port. Other ports can be access ports connected to the appropriate VLAN. You may have heard the term "router on a stick", where VLANs are used to connect a router to the switch, for routing between VLANs. That is what would happen if you used VLANs on pfSense.
Ok I need to look into Trunk Ports now. I've heard it said before, but never looked into it or what it is/does.
-
Trunk port is just a term from cisco that means the interface carries tagged vlans. Vs an access port that only has 1 vlan on it and untagged.
So a port or uplink to another device that understands vlans would be trunk port... Ie to your AP or another switch, or a router that will handle the traffic based on the tags.
But say a host devices, say you PC that is only in 1 vlan - would be connected to an access port.
-
Umm I might just stick to making it a bit simpler.
Do the 3 NICs with 3 different tags and see how I get on.Appreciate all the options tho.
Is there a specific way that is best/better?
-
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Ok I need to look into Trunk Ports now. I've heard it said before, but never looked into it or what it is/does.
As johnpoz mentioned, trunk ports are used to carry VLANs. Access ports generally carry only one network, which may be native or connected to a VLAN as required. However, there are some switches that can recognize, by the MAC prefix, certain devices such as VoIP phones, connected to that access port and put them on a VLAN.
BTW, if you use VLANs, stay away from TP-Link gear. A lot of it doesn't handle VLANs properly.
-
No not really - all comes down to your wants/needs and how you like to do things.
I for example use a native and then vlans on top of that, while others like to only use tagged on a vlan interface with no native network..
So the interface will always have an untagged vlan on it.. If it will carry other vlans then those would be tagged. But one of the vlans would be untagged.. But nothing saying you have to do it one way or the other, there are no rules against either option..
I can make the discussion point that if there native network on the interface, I can always access that interface if need be and don't have to tag traffic. While others might say that if a vlan carry interface they should all be tagged, etc. Derelict I believe a fan of vlan interfaces all tagged, no native network.
Just be sure you understand that you can never have more than 1 untagged vlan on any interface - since there is no way to isolate traffic then..
You can make discussion points about either way, for example if there is no untagged traffic on the interface then any untagged traffic by pretty much default would be blocked, if you didn't set a valid pvid on the interface..
Another point in favor of native is say for example the unifi AP, until recently it was not possible to have management on a tagged vlan... it had to be native... So if you run native on your interface you could connect such devices directly to that interface on your router. And then any tagged on top of that.
-
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Do the 3 NICs with 3 different tags and see how I get on.
That would be a waste of 2 NICs. Configuring VLANs is little different from configuring individual NICs.
-
@JKnott said in How to do vlans with physical nic's to AP's?:
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Do the 3 NICs with 3 different tags and see how I get on.
That would be a waste of 2 NICs. Configuring VLANs is little different from configuring individual NICs.
Thought that was the whole point of this thread?
3 NICs with 3 LANs... -
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
@JKnott said in How to do vlans with physical nic's to AP's?:
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Do the 3 NICs with 3 different tags and see how I get on.
That would be a waste of 2 NICs. Configuring VLANs is little different from configuring individual NICs.
Thought that was the whole point of this thread?
3 NICs with 3 LANs...All connecting to a single lan port on the AP, just wasting lan ports IMO.
Andy
1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22
-
@N0_Klu3 said in How to do vlans with physical nic's to AP's?:
Thought that was the whole point of this thread?
3 NICs with 3 LANs...As I mentioned, if he used 3 separate NICs, he'd have to use a managed switch to combine the 3 into native & 2 VLANs over the same cable. Why not let pfSense do that? I've never heard of an AP with separate connectors for each SSID.
-
@JKnott said in How to do vlans with physical nic's to AP's?:
I've never heard of an AP with separate connectors for each SSID.
They don't
-
@johnpoz said in How to do vlans with physical nic's to AP's?:
They don't
I guess that's why I've never heard of them.
The only other thing is some APs support LAG.
-
@NogBadTheBad said in How to do vlans with physical nic's to AP's?:
All connecting to a single lan port on the AP, just wasting lan ports IMO.
And what else is on these vlans other than wireless.. If you do not understand the traffic flow, nor the amount of data then you can not say that it would be wasting ports..
I already went over 1 example where it was just AP and wifi clients and you could have a bottleneck with hairpinning your intervlan traffic down the same physical interface.
edit: they don't, change that to normally your typical AP they don't. But you might be able to have specific interfaces for specific vlans in this AP
https://inwall-hd.ui.com/edit2: Here is easy example to see where just couple of clients and 1 server could be a bottle neck on a hairpinned shared interface with vlans on it..
The UAP-AC-PRO is rated at 5ghz 1300 and 2.4ghz 450.. So lets cut that in half of the phy your at 650+225, for a total of 875... Which what a gig connection can carry... But now you hairpin it and now your bottleneck is your vlans sharing a uplink.
clients are in say vlan X, this rides uplink A, but so does vlan Y which is where the server they are moving data to and from... So now XY both flow over your single uplink reducing your overall bandwidth so now a bottleneck to what the wireless can actually do.
-
@johnpoz said in How to do vlans with physical nic's to AP's?:
@NogBadTheBad said in How to do vlans with physical nic's to AP's?:
All connecting to a single lan port on the AP, just wasting lan ports IMO.
And what else is on these vlans other than wireless.. If you do not understand the traffic flow, nor the amount of data then you can not say that it would be wasting ports..
Yup agreed but I was going from the subject of the post "How to do vlans with physical nic's to AP's?" and the fact the OP stated "3 networks, Main Lan, Guest, IoT. Guest and IoT use VLANs, 69 and 101 to be exact."
If there's a huge amount of data I'd LAG the 3 lan ports.
