Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can a VLAN have a Smart Switch downstream from an Unmanaged Switch?

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 6 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      adoucette
      last edited by

      Greetings,
      I am curious if I can pass a VLAN through an unmanaged switch? This will influence how many "smart" switches I need to purchase.
      The topography I hope to achieve is

      Cable Modem
      |
      |
        eth0
        pfSense Box (only has 2 network ports)
        eth1
      |
      |
      unamanaged switch
      | |
      | |
      smart switch 1 smart switch 2
      | | | |
      | | | |
      trusted PCs untrusted PCs trusted PCs untrusted PCs

      By trusted, I mean LAN access. By untrusted I mean internet only access.

      Can I do this? Or do I need three smart switches? (Or one smart switch by the pfSense box with two unmanaged switches downstream?)
      If not, what is the best option as I have PCs in two locations separated by a couple hundred feet, and need trusted and untrusted PCs at each?
      Thanks,
      Ari

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        An unmanaged switch will pass the VLAN frames.  However, you won't be able to do anything with the VLANs, such as assigning one to a port, as you could do with a managed switch.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • C
          cenriq
          last edited by

          I'd get one managed switch and connect it to ETH1 of PFsense box. You can then connect un-managed switches the VLAN ports. Cheaper  that way too!

          1 Reply Last reply Reply Quote 0
          • K
            kapara
            last edited by

            unless this is cost related due to endpoints connected meaning your initial switch is like 48 port unmanaged POE (Not very likely) managed/smart switches are pretty cheap now days!  If you did not that many ports you can even get quality smart switches with 5-8 ports for a decent price!  Agree with both posts.  Go with managed!

            Skype ID:  Marinhd

            1 Reply Last reply Reply Quote 0
            • A
              adoucette
              last edited by

              Thank you for the replies.
              What I'm understanding from them is that the VLAN can pass through unmanaged switches, and so I could do this with one smart switch:

              Cable Modem
              |
              |
                eth0
                pfSense Box (only has 2 network ports)
                eth1
              |
              |
              –smart switch---
              | |
              | |
              unmanaged switch 1 unmanaged switch 2
              | | | |
              | | | |
              trusted PCs untrusted PCs trusted PCs untrusted PCs

              (Trusted PCs get LAN access. Untrusted PCs get internet only access.)

              So would that work with just one smart switch and two unmanaged switches? And with just a single cable going from the smart switch to each unmanaged switch?
              Thanks again,
              Ari

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Your drawing would be correct way to do it.. Where the smart switch is connected to pfsense.  Yes you can connected dumb switches downstream of a smart(vlan switch) just all ports on these downstream dumb switches will be in whatever vlan you connect them to on the smart switch.

                So in your drawing you  can not do trusted and untrusted on the same dumb switch… Would be like attached.

                If you want to put multiple vlans on the same switch then you need vlan capable switches all the way up the tree on that path.  See attached drawing 2

                smartanddumbswitchespng.png
                smartanddumbswitchespng.png_thumb
                smartswitchdownstream.png
                smartswitchdownstream.png_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • A
                  adoucette
                  last edited by

                  OK, thank you for that. Sounds like I would need smart switches at every point where a split between trusted and untrusted VLANs needs to be made.

                  Cable Modem
                  |
                  |
                    eth0
                    pfSense Box (only has 2 network ports)
                    eth1
                  |
                  |
                  –smart switch 1---
                  | |
                  | |
                  smart switch 2 smart switch 3
                  | | | |
                  | | | |
                  trusted PCs untrusted PCs trusted PCs untrusted PCs

                  (Trusted PCs get LAN access. Untrusted PCs get internet only access.)

                  Thanks again,
                  Ari

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

                    Steve

                    1 Reply Last reply Reply Quote 0
                    • JKnottJ
                      JKnott
                      last edited by

                      @stephenw10:

                      A key point here is that an unmanaged switch will probably pass VLAN tagged packets. But it may not! The behaviour can vary which makes it dangerous to rely on that.

                      Steve

                      The only difference between a VLAN frame and a regular frame is the VLAN tag inserted where the Ethertype/Length field normally is.  Except in managed switches there should be no filtering based on VLANs.  As for the extra 4 bytes in a VLAN tag, unless a switch is limited to the 1500 byte MTU sized frame, there should be no problem.  Frame expansion has been around for years and any Gb switch is likely capable of jumbo frames, which are much larger than normal size VLAN frames.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        I agree it probably will. But you can't be 100% sure until you try.

                        Your 'unmanged' switch might in fact be a managed switch IC with no exposed interface such as those found in soho routers. In which case does it drop the VLAN tagged packets? Probably.

                        The worst case it where it passes the packets but strips the tags.

                        Personally I would avoid it if at all possible. It's just ugly.  ;)

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          ^ Exactly..

                          And even if does pass the frames you now have zero isolation between those vlans that pass over that dumb switch, someone connected to said switch would be able to access any vlan they want.  Which might not be an issue in something like a home setup.  But in general it's a HORRIBLE idea to promote such setups.

                          If everyone here was experienced in such technology then sure we could debate all kinds of ways to MacGyver something in a pinch..  But suggesting things that "can" be done is not doing anyone any favors..

                          You can for sure get a smart switch that does vlans for same price point as dumb these days.  So suggesting that user can get by with just dumb switch vs a vlan capable switch when they want to do vlans is not something to promote.. It might be different if you were talking having to spend hundreds of dollars more to get a managed switch, etc.  Shoot I have seen many the low end smart switches for less than the dumb model, etc.

                          You would hope that they would just stop making the dumb ones and all of them should be capable of basic feature set like vlans, etc.  Since any of these switches out of the box are just dumb with all ports in vlan 1.. So user not needing to do vlans wouldn't know any different..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • A
                            adoucette
                            last edited by

                            Thanks for the great info. Smart switches have just been purchased…

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              what did you go with?  Sure hope not the tp-link low end ones.  They do not as of last time I checked actually do vlans correctly - they force all ports into vlan 1 so you can not really isolate and ports will see all broadcast traffic, etc.

                              Last I saw on their forums they were suppose to be "fixing" that - but wouldn't hold your breath, etc.

                              The netgear or dlink ones should be fine - or did you go with something with a bit more pizzazz?

                              Huge fan of the sg300 small business line from Cisco - great feature set and price point is good, but a bit high for some home budgets.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • JKnottJ
                                JKnott
                                last edited by

                                @adoucette:

                                Thanks for the great info. Smart switches have just been purchased…

                                Hopefully not TP-Link.  They don't handle VLANs properly.

                                PfSense running on Qotom mini PC
                                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                UniFi AC-Lite access point

                                I haven't lost my mind. It's around here...somewhere...

                                1 Reply Last reply Reply Quote 0
                                • A
                                  adoucette
                                  last edited by

                                  Good to know that, thanks.
                                  I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

                                  1 Reply Last reply Reply Quote 0
                                  • JKnottJ
                                    JKnott
                                    last edited by

                                    @adoucette:

                                    Good to know that, thanks.
                                    I went with the Netgear GS108Ev3 because it had better reviews and the lifetime warranty.

                                    Yep, the warranty lasts until it dies.  ;)

                                    PfSense running on Qotom mini PC
                                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                    UniFi AC-Lite access point

                                    I haven't lost my mind. It's around here...somewhere...

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Did you look at the dlink 1100?

                                      Show it for like 5-6 bucks cheaper on amazon currently and also lifetime warranty..

                                      https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I

                                      I have both on a shelf.. If I recall I liked the dlink interface better.  I had the netgear in my av cab for awhile, replaced it with sg300-10..

                                      I pickup such cheap smart switches now and then to be able to help users in setting them up and be able to test things that people say they do or don't do.. I had picked up the tplink for just that reason - and yeah its a POS….  I was like can not be that hard to setup vlans on the thing - but sure enough its really junk how they have it where you can not remove vlan 1.. I should prob see if they have new firmware out for it yet to fix that.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott
                                        last edited by

                                        At least you can use that TP-Link for port mirroring.  It works OK in that role.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.