Setting up dedicated network for infected machines - who does this?

[Nerm]

You have piqued my interest
Which specific model of D-Link? ... please.

The DGS-1210-24 to be exact. However after a quick look at the data sheets for both the DGS-1210-24 and the SG200-18 I think I know what the difference is. The DGS-1210 series from D-Link supports Asymmetric VLAN's. I think the cisco similar feature is called Multi-VLAN Port segmentation or something along those lines which the SG200-18 doesn't support.

 

[geekgee]

The DGS-1210-24 to be exact. However after a quick look at the data sheets for both the DGS-1210-24 and the SG200-18 I think I know what the difference is. The DGS-1210 series from D-Link supports Asymmetric VLAN's. I think the cisco similar feature is called Multi-VLAN Port segmentation or something along those lines which the SG200-18 doesn't support.

I came to the same conclusion when looking through the documentation on your switch... Asymmetric VLANs.

It appears the Cisco flavour is called just "Multi-VLAN Port" but it is only supported on a limited number of Cisco switches not including the 300 series either.

I can see the appeal of it for those whose configuration can take advantage of it and are on a limited budget. I still prefer the more traditional segmentation route (pun intended ) but its exactly that… a preference.

I suspect the feature will find its way to 200/300 series switches eventually but being version 1.1 of the O/S was just released, it probably won't be anytime soon.

Allanc, I guess you have a decision to make.

 

[allanc]

I came to the same conclusion when looking through the documentation on your switch... Asymmetric VLANs.

It appears the Cisco flavour is called just "Multi-VLAN Port" but it is only supported on a limited number of Cisco switches not including the 300 series either.

I can see the appeal of it for those whose configuration can take advantage of it and are on a limited budget. I still prefer the more traditional segmentation route (pun intended ) but its exactly that… a preference.

I suspect the feature will find its way to 200/300 series switches eventually but being version 1.1 of the O/S was just released, it probably won't be anytime soon.

Allanc, I guess you have a decision to make.

Well, the SG300-20 is $423 CDN$ and the Dlink DGS-1210-24 is $270.

I am definitely not a networking expert.
Other than '$' - what are the advantages of a layer-3 switch versus 'Asymmetrical Vlans'?

 

[sys-eng]

I was thinking of getting an RMA for the SG200 and 'trading' it in for the SG300. The 8 port SG300 is about the same price as the 16 port SG200.

Dell has a special on that switch for about $90 less than everyone else.

http://accessories.us.dell.com/sna/...=04&sku=A4197481&dgc=SS&cid=52102&lid=1342490

 

[allanc]

Dell has a special on that switch for about $90 less than everyone else.

http://accessories.us.dell.com/sna/...=04&sku=A4197481&dgc=SS&cid=52102&lid=1342490

Tks.
I just ordered the SG300-20.
I decided to treat myself

 

[geekgee]

Tks.
I just ordered the SG300-20.
I decided to treat myself

Cool!!!

I ordered 20 ports today too between a SG300-10 and a SG300-10P.

 

[RobertH]

Seperate domain and restricted firewall

I use a doamin for my systems.

I put the cleaned systems on a seperate Lan Segment with very restricted firewall and internet access only.

Only shared network componnet are switch, router, cables.

 

[BDPCR]

I use an IPCOP firewall with a DMZ interface in addition to the one for my server 192.168.0.0/24, rest of network is on an different subnet .Only allows access to port 80 outbound and is completely isolated from the rest of my network. Viruses are becoming more and more sophisticated especially with most people having their "network" why risk it.

 

[allanc]

It is strange that the SMB layer 2 cisco cannot do what you were trying to do but SMB layer 2's from other brands can, specifically a $200 24-port D-Link. You would think if any brand would be more robust it would be the cisco.

If you can return the SG200-18 and get an SG300-20 for less than the combined price of the sg200-18 and the sg300-10 then that is the way to go I think.

I purchased the SG300-20 and I am having exactly the same problem.
When I specify that the PVID of port 16 is PVID 1016, port 16 is automatically removed from VLAN 1 and therefore looses Internet access.
I am missing something very basic and I do not know what it is that I am not understanding - I do not know the question to ask.
All assistance is greatly appreciated.

 

[TLE]

Can you post your config again Allanc? Should make it easier to see what you are trying to do with each port.

 

[allanc]

Can you post your config again Allanc? Should make it easier to see what you are trying to do with each port.

Let us start with 'baby steps' first.
With this configuration, a PC on port 5 cannot see the router on port 1 and therefore has no Internet access.

 

[Nerm]

Let us start with 'baby steps' first.
With this configuration, a PC on port 5 cannot see the router on port 1 and therefore has no Internet access.

If you change port 1 mode to trunk does the same issue still occur?

 

[allanc]

If you change port 1 mode to trunk does the same issue still occur?

Yes, port 5 cannot obtain a network address.

 

[allanc]

If you change port 1 mode to trunk does the same issue still occur?

After many, many hours of reading and getting nowhere....
I 'think' that layer-3 has to be enabled on this (Cisco SG300-20) switch.
According to what I have been reading - the switch is set to layer-2 out-of-the box.
Does this make sense?

 

[JustMe]

I have 2 Netgear GS108T 8-port smart switches ($99) to segregate my network. On the first switch I have office and work computers on one VLAN, a second VLAN for wireless and a third VLAN going to the second switch.

On the second switch each port is isolated on its own VLAN. It took some trial and error to set it up - about 1 -1.5 hours but I am pleased with the results.

 

[geekgee]

After many, many hours of reading and getting nowhere....
I 'think' that layer-3 has to be enabled on this (Cisco SG300-20) switch.
According to what I have been reading - the switch is set to layer-2 out-of-the box.
Does this make sense?

Yes... that's correct. The switch comes from the factory in "Layer 2 Mode".

You use the "Console Menu Interface" to change it to "Layer 3 Mode". I believe it can be done using the CLI too if on the 1.1 version of the firmware.

 

[allanc]

Yes... that's correct. The switch comes from the factory in "Layer 2 Mode".

You use the "Console Menu Interface" to change it to "Layer 3 Mode". I believe it can be done using the CLI too if on the 1.1 version of the firmware.

Still no success.
I have checked that the switch is in layer-3 mode.
Basically, the only way that a port can see the router is if it is in the same VLAN, untagged with the same PVID.
Are there any other settings that I could be missing at a very basic level?
Is there some check box that I am missing in the 400+ pages of documentation?

Thank you very much in advance.

 

[Nerm]

Still no success.
I have checked that the switch is in layer-3 mode.
Basically, the only way that a port can see the router is if it is in the same VLAN, untagged with the same PVID.
Are there any other settings that I could be missing at a very basic level?
Is there some check box that I am missing in the 400+ pages of documentation?

Thank you very much in advance.

Yes, each port that you want to access the internet would have to be a member of the VLAN the WAN port is in.

Example port memberships: (port1 is WAN port, port2 is connected to PC1, and port3 is connected to PC2. Ports 2 and 3 are in seperate VLAN's so they cannot communicate with each other.)
port1: VLAN1
port2: VLAN1 and VLAN2
port3: VLAN1 and VLAN3

Regardless to accomplish what you are wanting to do you will have to tag ports to multiple VLAN's. Assigning each port on the switch to only one VLAN will not work in this scenario.