Reasons for Connecting a Switch to a Router with Multiple Ethernet Cables

Please ignore the comment above, it was supposed to be an answer but I can't delete it.

I have this evening spent some time in a remote session with Deliberant support, and between us we managed to nail down the issues so it now works. I'm posting this information in case it is of help to anyone else in the future.

1) The Deliberant APC web interface will not respond to tagged frames. This requires the switch ports connected to the APC units to have at least one untagged VLAN assigned, and this VLAN to be used for management of the units. By setting the ports at each end to tagged in VLAN2, untagged in VLAN1, and a PVID of 1 the APCs can be managed from VLAN1 while still allowing VLAN2 traffic.

2) Always check your physical switch ports! After trying to get VLAN2 to work over the bridge unsuccessfully the company electrician handily pointed out that he'd moved some cables, but didn't tell the IT department that he'd unplugged anything. He thought he'd put the cables back in the same place, but when we checked during the support call found that the cables were put in the wrong ports.

The support call wasn't a complete waste of time in that it identified (1) as an issue, but had the IT documentation been updated to reflect the remote switch cable configuration having been changed the VLANs would have been working prior to the support call. As it is we would still have had the issue of not being able to manage the Deliberant APC units given that they drop tagged frames directed to their management interface.

Dan

Without knowing what, exactly, has been done by "outside vendor" I'm going to guess that each "company" has a separate VLAN (virtual LAN.) That is the most common way to isolate entities that should not have the ability to snoop on each other's network traffic that share infrastructure.

If you have the password to access the switches you should be able to see if that is the case by examining the switch setup and mapping the port destination to any defined VLANs on the switch ports.

If so, you should be able to make access to any VLAN from any port. Keep your most ethical self in control when doing this. Hmm - actually, if you have "dumb hubs" on the second floor, you may need to upgrade those to a "smart switch" for proper VLAN handling. Or, if there is adequate cabling in the patch between first and second, and switch ports on the first, you just patch on the second floor, using switch ports on the first floor. To know what your options are, you really need to know (or describe) what you actually have, cable-wise.

If you have a VLAN-capable switch on the second floor, one wire can carry 4 VLANs between floors and then the switch can deliver them to the proper wall jacks.

OK. If you only have two cables (which for some reason are both connected from down to up on the "main company - building owner" network, and if you get a smart/managed/vlan capable switch for upstairs (probably only need one, really, at least for the scale of the problem so far) then you will need to set up VLANs on a downstairs switch for the building owner and each client. You'd plug each client into an "untagged" port on the downstairs switch assigned to their VLAN; on (at least one of) the lines running between down and up you have a port on a downstairs switch that is assigned to all 4 VLANS, tagged (which is how one wire carries 4 networks) and that connects to a port on the upstairs switch which also has all 4 of those VLANs, tagged. Then on the upstairs switch you break out the 3 "customer" VLANs to untagged ports which you patch to their assigned wall ports, and the company VLAN to the other ports (or to only the actual ports in use, as a better "best practice" which does require remembering that you need to reconfigure the switch when/if you move cables around.)

With smart/managed switches, the two lines from downstairs to upstairs can be configured as a LACP so that data can move twice as fast over the pair of cables.