Do I need a “smart switch” for VLAN support / VLAN for Multi-WAN

vlanwide-area-network

I have a need to connect a branch office with multiple WAN's to multiple devices:

wan1 modem

Public IP: 2.2.2.2
Private IP: 192.168.20.1
VLAN tag: 20

wan2 modem

Public IP: 3.3.3.3
Private IP: 192.168.30.1
VLAN tag: 30

wan3 modem

Public IP: 4.4.4.4
Private IP: 192.168.40.1
VLAN tag: 40

device 1

Physical Interface eth1
Interface 1 IP: 192.168.20.100 w VLAN tag 20
Interface 2 IP: 192.168.30.100 w VLAN tag 30
Interface 3 IP: 192.168.40.100 w VLAN tag 40

device 2

Physical Interface eth1
Interface 1 IP: 192.168.20.101 w VLAN tag 20
Interface 2 IP: 192.168.30.101 w VLAN tag 30
Interface 3 IP: 192.168.40.101 w VLAN tag 40

Each WAN modem has only one LAN interface available.

I would like to connect each of the three modems to a single switch, tagging traffic as above, so that multiple devices may access the WAN's as needed.

I am totally new to VLANs so I am probably missing the point, but this configuration (in my testing) does not appear to require any configuration of the switch – the devices just all need to agree on VLAN tags.

Why would somebody require a managed or "smart" switch in this configuration? Why might I consider getting one?

Best Answer

The central reason for a smart/managed switch would be to actually implement the vLANs. If you use a "dumb" switch or hub you have no guarantees by that device that the traffic is actually restricted to the participating devices in each vLAN.

A quick and simple example. Say we have three devices on a switch (A, B, and C). A and B are in a vLAN; B and C are in another vLAN. If it's a "dumb" switch then broadcast traffic will be forwarded to all ports (A's broadcast traffic will reach C; and vice versa). If it's a "hub" instead of a switch, then all traffic would be sent to all devices.

The next important question is whether you care. If you fully trust A, B, and C to see and communicate with each other, then there's really no "harm" in this configuration. A and C would know they aren't supposed to be talking on each others vLAN and wouldn't. The problem comes when you can't fully trust one or the other, as in the case where one is an Internet connected CPE. At that point you would have to hope that no malicious packets are transmitted over the Internet, vLAN Hopping or whatever is necessary to compromise your network.

Using vLANs without a smart/managed switch has all the security of overloaded subnets (using two non-overlapping subnets on the same broadcast domain). As mentioned above, the lack of security isn't necessarily a problem, though you don't get the benefits of segmented broadcast domains either. One small potential problem is that other people working on this network may make certain assumptions about the security based on the presence of some vLAN configuration - wrong assumption or otherwise, it could lead to a security problem as well.

Related Solutions

VLAN over WAN

Firstoff, the Cisco 2821 is just a router. I don't know where you've gotten this "layer 2 router" business from (the statement is an oxymoron in itself), but a 2821 is a perfectly capable IP router.

You don't want to extend a layer 2 broadcast domain across a VPN. You won't like how it performs.

Let's call your existing location "site A" and the new location "site B". Let's call the networks:

Site A Data subnet - VLAN id 1 - 192.168.0.0/24
Site A Voice subnet - VLAN id 2 - 192.168.1.0/24
Site B Data subnet - VLAN id 1 - 192.168.2.0/24
Site B Voice subnet - VLAN id 2 - 192.168.3.0/24

In your 2821's, you'd setup an IPSEC tunnel between the sites. Here's a decent example using a static key: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a0080094634.shtml

Once you've got that, you'll create VLAN interfaces on the routers on each end, assigning the routers IP addresses in each VLAN:

Router in Site A:

interface FastEthernet0/0
no ip address
no shutdown
interface FastEthernet0/0.1
encapsulation dot1q 1 native
ip address 192.168.0.1 255.255.255.0 
interface FastEthernet0/0.2
encapsulation dot1q 2
ip address 192.168.1.1 255.255.255.0

Router in Site B:

interface FastEthernet0/0
no ip address
no shutdown
interface FastEthernet0/0.1
encapsulation dot1q 1 native
ip address 192.168.2.1 255.255.255.0 
interface FastEthernet0/0.2
encapsulation dot1q 2
ip address 192.168.3.1 255.255.255.0

Assuming you've set the IPSEC tunnel up properly w/ the proper addresses being excluded from NAT, traffic between the various subnets in the sites will be transparently encrypted and sent to the other end. The routers at each end will, because of their VLAN interfaces and static routing table entries, automatically tag traffic with the appropriate VLAN tags and drop them onto the Ethernet.

You'll need to configure the switches at both ends with trunk ports to connect the routers to, and you'll have to figure out how to integrate the Site A router into your existing routing topology re: the existing ASA-5505, but this should give you enough to go on to get started.

Is A Managed Switch With VLAN Support Required

Putting your public and private networks on 1 VLAN is a security no-no. It will probably work, but it's worth the small investment for a semi-managed switch.