vLAN help

[ddrueding]

I can't seem to understand this properly, and need some help.

I have several wireless links chained together linking some of our offices. These links are inside out network, post-firewall, and are tying a bunch of small offices together for network and internet access purposes. At one end of this network is our main office, where our normal internet connections and firewall are. Several links away, on a mountain, I can get some bandwidth cheap. I believe that vLANs will allow me to partition this chunk of traffic through the wireless links until it reaches our firewall at the main office. I've attached a small schematic that may help (or hurt) my explanation.



What I think I want is to use port mapping on all the switches to specify that ports 7-8 are on the "RED" network (pre-firewall traffic), that ports 6-7 are part of the wireless backbone (passing both kinds of traffic), and ports 1-5 are on the "GREEN" network (secure traffic).

I've acquired some Netgear GS108Tv2 switches, and updated them to the latest firmware (5.0.5.4). I've found the vLAN portion of the web interface, and have created some vLANs. (ID "50" for RED and "100" for GREEN). And now I am looking at the vLAN membership page and not understanding the TAG/UNTAG concept. It seems to be asking for one or the other, and I don't know what it means. The port that connects my cheap ISP to a RED port on my switch needs to be tagged coming in and untagged coming out?

This can't be that complex a concept, but I am struggling.

Thanks in advance!

 

[Mercutio]

Well tagging and untagging is just about maintaining VLAN membership where it needs to be maintained and stripped off where it has to be stripped off (e.g. when it's headed to your ISP).

So you have a default VLAN that your switch assumes you're using for everything.
You've created a couple more IDs and you've told it to tag ports XYZ so they're on VLAN Blah.
You go to the VLAN ID page and tell it that port X is ID whatever. If you don't assign a membership, that port stays on the default VLAN. This is separate from your switch tagging them.

If you don't want the VLANs talking over a specific port then you need to tell the switch to deny communication on that port based on the tag value. That will let you restrict communication to the way that you want to segregate things, whatever that is.

As I recall, everything gets to talk on VLAN 1 by default, which doesn't sound like what you want from a security perspective, and that's why you're going to need to mess around with Port IDs as well.

Does that help?

 

[ddrueding]

I appreciate the info, and that states some things that I thought I knew in another way that does make them easier to understand.

My biggest question at the moment is a port either tagging or untagging. How could it do one and not the other? Don't I need packets tagged as they come in and untagged as they go out the same port?

 

[Mercutio]

You could be leaving tags on existing frames so that they can pass to another switch in that state.