I have the following setup:
Internet -> Modem/Router (192.168.0.0/24) -> Switch (TL-SG105E) -> WiFi Router -> Any other network device
Note: Switch spans to a passive IDS
My WiFi Router does not support a guest network but I have a bunch of old WiFi routers that I figured I can use it to place all IoT devices on a different network.
The switch supports VLAN 802.1Q I am just not sure if with my current setup I can setup two VLANs that both share a common port (the edge router's port), e.g.,: VLAN 1 - 1,2,3,5 VLAN 2 - 1,4
This way ARP requests and effectively MAC packets from port 4 (the IoT VLAN) will never see the other ports except for the edge router.
Is this possible? If not, what else do I need to make this work?
1 Answer
802.1Q VLANs can use tagging when sharing a port (VLAN trunk). One of the VLANs can remain untagged (sometimes called the native VLAN), all others need to be tagged.
E.g. if you configure switch port 1 as VLAN 1 untagged and port 2 as VLAN 2 untagged, you can trunk both VLANs to a router using a single port, with both VLANs tagged or one of them untagged and the other tagged. The router needs to support 802.1Q and requires appropriate configuration to match the switch's trunk setup.
If the router doesn't support 802.1Q VLANs you could use a dedicated router on a second port. Without trunking you're using port-based VLANs with each VLAN representing a separate, logical switch.
Of course, 802.1Q VLANs can also be used between switches. You could configure a guest VLAN port on your living room switch, trunk your normal VLAN and the guest VLAN to a basement switch, and then fan out the VLANs to two routers.
