Netgear, Switching
The Views Expressed Below Do not in any way reflect Internal Doctorine or Official Statements of Netgear Inc. These are just my notes – Use at your own Risk.
 
Tip: Look on support.netgear.com for VLAN configuration examples.
Another Article: Building off of this article. Making 2 Vlans.

VLANS ON NETGEAR LAYER2 SWITCHES

First read the main article (scroll down to [original main article – read this first] START READING HERE) then follow thru with reading the updates [update DATE]. The [main article] is at the bottom. Updates get added to the top of the article
update 2015-05-26: HP and NETGEAR switches handle 802.1q VLANs similarly with the concept of vlan tagging, untagging (or neither), and setting port PVIDs. So what you read here will apply to both Vendors. Cisco switches have the same end result, which is a working implementation of 802.1q, however they use “switchport mode access” and “switchport mode trunk” to do similar moves.
 

[update 1/17/2014 – read this fourth ]

VLANS with NETGEAR Routers and Firewalls.
Please read this article: HERE
Most environments contain switches and routers (firewalls). Some routers/firewalls understand VLANS, and some dont. For the ones that do its important to understand how they work with VLANS and how they understand them.
What about Layer 3 Switches?
The concept is the same as INTERVLAN routing from the above article – the configuration will just be different as the GUI is completely different – also configuration with CLI is possible. Layer 3 Routing connects different subnets together by routing. This layer 3 routing concept sits on top of the Layer 2 vlans (See OSI Layers). The Routing on Layer 3 Switchs is configured different then it is on Router/Firewalls.

[update 11/19/2013 – read this third ]

 
Access Points and WC7520
(For this piece on accesspoints and wc6520 pretend management vlan is 1)
Tag SSID VLANs: For the access points you need to (from the switch) tag the vlans that are used in the SSID profiles
Untag Management VLANS (even if its 1 of the SSIDs): If the access point management vlan is 1 then untag 1 from the switch to it
The WC7520 is an access point controller and if your using it, it just needs management communication with the access points.
WC7520 just need Management VLAN information (so only untag 1 to it, thats if 1 is the managment vlan)
 
[update 2/27/2013 – read this second] 
 
This note should be read after reading the full article
NOTE: The article below deals strictly with the Layer 2 setup. Here is what you should get out of it:
1) a tiny change in the network means you have to do the tags/untag/pvids differently
2)
a) pvids dont really matter on trunk links
b) 1 pvid per port, 0 to Alot of tags per port possible, 0 to Alot of untags per port possible
c) In laymans terms the PVID: sets the vlan of the port, the TAGS/UNTAGS set who the ports can talk to (hence its called membership), being a none member means there is no tag or untag there.
3) there are exceptions to the rules
a)  especially with default vlans ( I dont mention them below but its important to realize that all a default or management vlan is, it automatically untags it self at every port so that it transverses it self accross every port with no vlan header in the packet )
b) Ingress filtering – this is not on all of the switches but its really an easy concept – if its enabled it changes the decision tree of the Ingress portion
* If its Enabled – Frames are discarded if the port is not a member(tag/untag setting means membership) of the incoming packets vlan tag ( incoming packets vlan tag – simply meaning – the vlan id )
* If its Disabled – regular rules for 802.1Q ingress – the ones in the decission tree below – The packet goes into the switch and not dropped on input (if tag is on packet, dont touch the tag – and – if no tag/vlan header is on the packet then attach a tag/vlan header to the packet with the vlan number equal to the PVID )
c) Acceptable frame types
* Acceptable frame types: Admit All – untagged frames or priority tagged frames received on this port are accepted and assigned the value of the Port VLAN ID for this port.
* Acceptable frame types: VLAN only – all packets accepted
d) There are alot of other kind of vlans that are not covered in this article but they are mostly of the dynamic type (meaning they change from port to port, the setting varies per port – in fact it has nothing to do with the port but more of what the frame or packet contains)
4) Other types of Vlans – layer 2 technology (some looks at layer 3 information to assign the layer 2 vlan)
a) MAC based vlans: looks at the mac address to see what vlan something belongs in – this is like Voice Vlans
b) Voice Vlans – look for the OUI of a frame and tag the ports accordingly – thats it – they dont set the phones to the vlan – they simply tag the packet/frame if they detect a certain OUI on the frame. Voice vlans have the options to play with the QoS settings to make the voice vlan more important. Think of Voice VLAN like a friendly wizard that set up automatic Tags  – or  – mac based vlans for you – and – also set up QoS for that vlan.
c) IP Subnet based vlans – like mac based vlans accept the vlan is determined by the ip address of a packet
WHATS THE POINT OF THIS?
IP Subnet Based VLAN Configuration
when we have vlan routing already
* IP Subnet Based VLAN is a dynamic vlan (vlan can move from port to port) and it looks at the layer 3 information of the packet (source ip) to set the vlan id (layer 2)
* Routing VLAN 3 just associates a vlan to an ip gateway sort of mechanish – its all layer 3 (layer 3)
 
[original main article – read this first] START READING HERE
 
VLANS 

2 Types in with NETGEAR

·         Port Based Vlans

And

·         802.1Q Vlans ß MOST COMMON AND CURRENT INDUSTRY STANDARD

Port Based Vlans

–      Rare and on old switchs

–      VLAN information determined by the port its received on

–      Frames don’t get tagged

–      1 Port can only belong to 1 VLAN

–      Ports in a port-based VLAN are referred to as untagged ports and frames received on the ports as untagged frames

–      Frames received on a port hold no info on what VLAN it belongs to. Where the switch forwards the frame depends on the ports PVID (Port VLAN ID).

–      Each port has PVID and switch forwards frame to all other ports with same PVID

802.1Q Vlans

–      Industry Standard

–      VLAN information determined by the frame instead of port

–      On Ingress (as frame enters switch)

•       Does this frame have an 802.1Q tag?

•       No: Assign the VLAN ID (VID) of the Port VLAN ID (PVID) to the frame. [In other words: Tags the frame]

•       Yes: Let the frame Ingress [In other words the frame stays tagged and leaves the switch]

–      On Egress (as frame leaves switch)

•       Is this port participating [tagged or untagged] in this VLAN?

•       No [In GUI: VLAN configured BLANK]: Drop the frame

•       Yes: Is this port configured to tag (port tagging)?

•       Yes (Participating TAG): Preserve the Tag & egress [Leaves w/ Tag]

•       No (Participating UNTAG): Strip the Tag & egress [Leaves w/out TAG]

 

 

Interesting Things to Note

•       All traffic in a managed switch has an 802.1q tag on it

•       Even if no VLANs are created, everything still is tagged for VLAN 1

•       Avoid using VLAN 1 – leave it for management and trunk ports pvids

•       On some switches you will see an Audio and Video VLAN. That cant be deleted. They have QoS settings and make Audio VLAN more important. So avoid both of them if you don’t want the QoS effect.

•       PVID determines what VLAN a port belongs to

•       Tagging and Untagging determines who can talk to who

Firewall/Routers

•       With Firewalls/Routers: The firewall should have all the same VLANs created on it as are on the switch.

–      Firewall and Routers:

•       Membership:  This is like auto tagging and untagging

–      When it connects to a switch it tags

–      When it connects to a host it untags

•       Default VLAN: This is like the PVID

–      If firewall/router doesn’t have the the VLAN:

•       Create VLAN on the switch to disperse the internet out, by untagging all the ports with it and setting the PVID on the port uplinking to the router/firewall as the Internet VLAN PVID

 

 

 

 

Trunks between switches

•       Trunk Links Connecting Switchs

–      PVID doesn’t matter so just leave it as 1.

–      Because all traffic that leaves out of it is tagged previously therefore PVID doesn’t matter.  (Look at Above)

 

 

VoIP

–      Good to have Data and Voice VLAN separate

•       Security: So computers cant record phone data

•       Can apply QoS (Quality of Service) on it so that Phone traffic is more important

•       VoIP traffic is sensitive to delays and differences in delays (jitter) both measured in units of time (millisecond to microsecond)

•       Best quality = minimizing delay as much as possible and having 0 jitter

–      Phones: VoIP phones tag their traffic so PVID doesn’t matter for the performance of the phone. However set PVID to computer VLAN, if computer is attached to phone

–      Think of a VoIP phone as a 2 port switch. All voice traffic is tagged automatically by the phone and computer traffic goes through it untagged.

•       So on the switch we catch the untagged computer traffic with a PVID

•       And distribute VoIP data by tagging

 


 
Connecting With Cisco

•      Trunk Port – Cisco will Tag all VLANs across (Since PVID doesn’t matter here its just like Tagging every VLAN), can control with pruning or “allowed VLANs” command

•      Access Port – Cisco untags the appropriate VLAN here and also sets the PVID (this is like a PVID and Untagging at the same time)

•      Native VLAN in Cisco is similar to PVID. Tags traffic that comes in without a tag.

•      On Cisco when connecting to a Phone-PC combo set the Cisco port as a Trunk Port and the Native VLAN on that port to match the PCs VLAN

•      In the configuration process just treat the Cisco switches as if it were Netgear device, Untagging and Tagging as needed

•      Do not configure a Cisco device, let the customer configure it. (We are not CISCO Tech Support)

Connecting With DHCP Server

•       3 Scenarios

–      Netgear Device has the VLANs configured on it

•       Just as Example: Gateway that understands VLANs, except configure the VLANs to have DHCP Server Enabled

–      PC has DHCP Scope for 1 VLAN, Each VLAN has its own dedicated PC to give out DHCP

•       Untag & PVID that port for the VLAN # that DHCP server is in

–      1 DHCP Server for the entire Network

•       Untag all VLANs that need DHCP on that port

•       Set the PVID to whatever VLAN that DHCP server belongs in

•       Use IP-HELPER or DHCP RELAY to point the other VLANs to the DHCP Servers IP

 

 

Wireless VLANs

•      Usually want to have a Guest VLAN and Main Office VLAN

•      Each SSID on the Access Point gets its own VLAN ID

–      GUEST SSID – VLAN 3

–      MAIN SSID – VLAN 2

•      Tag Wireless VLANs to the Access points

•      Make sure VLANs have a path thru all the switches to get to all the Access points, controller/s (?) and to the gateway

–      Make sure gateway has both VLANs created on it

–      If gateway doesn’t have VLANs created on it then make sure there is an internet VLAN used to disperse the internet

 

 

 

 

 

 

Summary [corrections on 11/19/2013 listed below]

•      PC1 and PC2 cant communicate

–      To PC1: Untag PC1 VLAN, PVID PC1 VLAN

–      To PC2: Untag PC2 VLAN, PVID PC2 VLAN

•      PC1 and PC2 can communicate with each other

–      To PC1: Untag PC1 & PC2 VLANs, PVID PC1 VLAN

–      To PC2: Untag PC1 & PC2 VLANs, PVID PC2 VLAN

•      Trunk to Switch handling VLANs: Tag all VLAN, PVID 1 (Doesn’t matter)

•      Trunk to unmanaged switch serving VLAN PC1: Untag PC1 VLAN, PVID PC1

•      PC-1+Phone: Untag DATA PC1 VLAN, Tag PHONE VLAN, PVID DATA PC1

•      Phone: Tag PHONE VLAN, PVID 1 (Doesn’t matter)

•      DHCP Server Serving many VLANs:  Untag ALL VLANs, PVID PC1 VLAN

•      Gateway which has VLANs: Tag ALL VLANs, PVID 1 (doesn’t matter)

•      Gateway which has no VLANs: Untag ALL VLANs, PVID INTERNET VLAN

•      Access Point: Tag ALL VLANs that SSIDs talk with, PVID 1 (doesn’t matter) – Correction on 11/19/2013: untag mgmt vlan,pvid mgmt vlan, tag ssids

•       To Controller: Tag ALL VLANs that SSIDs talk with, PVID 1 (doesn’t matter) – Correction on 11/19/2013: only untag mgmt vlan and pvid mgmt vlan

 

EXTRA GUIDES – EXAMPLE CONFIGS – FOR NETGEAR L2 AND L3 SWITCHES (found on support.netgear.com as well): 

SWITCH-EXAMPLES-L2L3.7z

2 thoughts on “VLANS on Netgear & HP Switches (How they work 802.1q) – Layer 2 VLANS”

  1. Hi Boss, I love the blog. Best info I have found yet on Netgear “T”, “U” and blank. I have a difficult time with the concept of every frame being tagged. I thought that 802.1q comes into play on Trunk Ports only. I’m sorry but I am speaking from a Cisco point of view.

    802.1Q Vlans
    – On Ingress (as frame enters switch)

    • Does this frame have an 802.1Q tag?

    • No: Assign the VLAN ID (VID) of the Port VLAN ID (PVID) to the frame. [In other words: Tags the frame]

    In Cisco I don’t think un-tagged frames coming into access port get tagged at all. Which sound different than what NetGear does. The Cisco switch does know that the port it came in (but by some other logic) on belongs to VLAN x, so it looks in the MACPort table for entries on that VLAN only. If it doesn’t see a MACPort entry for that destination MAC, it sends out a broadcast ARP request to every port in that VLAN (except the port it came in on). And then it learns it and can forward to the correct egress port. I believe the 802.1Q tagging only happens when it leaves a Trunk Port (cisco speak).

    Are Netgear and Cisco implementing tagging differently?

    I know you mentioned you are not Cisco support, but I was hoping you might be able to clarify.

    Thanks for the great article.

    Brett

    Reply

    1. Its just the way that switch was engineered, and it has no change on the end result. The only thing that matters with VLANS is what is going in & where, and what is going out & where (nothing in between as that has no effect).
      Imagine a frame is supposed to get into the switch untagged and leave untagged (thats the scenerio your talking about). If a frame enters the switch and gets tagged with VID 1 per say, but on the way out it gets untagged 1 (you will notice that every port is untagged, “U”, with 1 by default). The end result is the same as the frame not getting tagged at all. So leaving a frame alone, is the same as tagging that frame with arbitrary VID 1 and then untagging it. Why do that extra 2 steps of tagging and untagging? I dont know. perhaps its easier in the coding of the ASICs? perhaps something else, in the end the results are the same so it doesnt really matter. Also im not 100% sure if all Netgear switches do this trivial thing – it probably depends on the firmware and switch model (is something that we can find out by looking at any data sheet? no because it has no change on any end result)

      In the end CISCO _might_ do it as well, and just not mention it, as it has no result / change on anything.
      The 802.1Q tagging is done internally the same with NETGEAR and CISCO (VIDs get tagged and untagged in the same place on the frame etc…), its just the commands that are different, and the commands go about it differently. Also the implementation might be different (like CISCO might not tag everything on the way in, where as some NETGEAR switches might tag on the way in)

      NOTE: its important to note that Netgear has alot of switches and different firmwares, whether or not every frame is tagged on the way in, depends on switch model and firmware, in the end that information doesnt matter as it has no end results.

      The functionality of 802.1Q is the same: (1) CISCO and NETGEAR tag incoming packets with VID X when we ask for it (The way we ask for it might be different between NETGEAR and CISCO, and either or might tag all or not all on the way in – as I said if we tag all or not all it doesnt matter) (2) Both VENDORS need to properly untag frames on the way out (again both vendors could do this differently) (3) Both VENDORS need to properly keep the tag on the frames on the way out (Again both vendors could do this differently)…

      *For example when cisco says lets TRUNK port 5, thats the same as NETGEAR saying Tag all VLANS on port 5 (it would be really annoying to put a T on all vlans on port 5 using the GUI, luckily in reality we realize that only certain vlans need to be “tagged” out on trunk ports).
      *When cisco says “access port” 5 with VLAN 10 thats the same as netgear saying make port 10 with PVID 10 and UNTAG 10 (meaning untagged frames going in get VID 10 tag, and only frames with a TAG of 10 can come out of the port, and when they do come out of that port make sure to remove the VID 10 tag)

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *