HP 1820 Isolating networks

[sieben]

Hi,

I don’t have any relevant experience with these, but I’m trying to setup an HP 1820 24 port switch in such a way that:

On port 1 I will have a broadband router connected to the internet.

Ports 2-10 share the same network, devices are visible to one another. Also, these should be able to reach devices on ports 11-16 but not the other way around (see below).

Ports 11 to 16 should be for devices that cannot access any other device connected to the switch, other than the broadband router.

Can someone help me out by giving me a gist of what I should be configuring to achieve this setup?

Thank you

[parnassus]

Cheers, given that HPE OfficeConnect 1820 is a basic Layer 2 (VLAN capable) switch...and given that your scenario is going to require ACL and IPv4 Routing (so, at least, basic Layer 3 features) which the 1820 doesn't provide...you need an external Firewall/Router to route and filter ingress/egress traffic for the two VLANs you planned. You could have then two distinct "connectivity" approaches: one link (your port 1) carries two the VLANs as tagged...and your Firewall will be configured for that (generally sub interfaces, one for each VLAN) OR, second case, one port (Untagged) on each VLAN will be used as the dedicated uplink to a LAN port on the Firewall (and configuration will follow this scheme accordingly).

[sieben]

Thanks for the explanation. The router I have on this network is a 4 port Synology RT2600AC which has some VLAN capability but apparently very limited. Through the GUI I have these options, so I was thinking something else:

The manual states:

Manual

If you cannot find your ISP under the IPTV/VoIP profile mode, switch to Manual mode. Internet service providers set VLAN IDs (VID) and priorities to determine the type of service (IPTV/VoIP/Internet) provided. Please contact your ISP and ask them to provide the required information for the VID, Priority and Tagging fields. Ports that are not required can be left blank with the priority set to 0 and they will become Internet ports.

You can use the following syntax to specify VID numbers and range when filling in the VID field:

• Use “,” to separate VIDs, for example: “21,22”.

Note:

• When the Tagging option set to Untagged, only one VID can be entered.

IPTV STB port

If your Internet service provider has not specified a VID for IPTV/VoIP services, please select this mode and connect your IPTV/VoIP devices via LAN 3 and LAN 4. If the port is set to Disabled, it will become an internet port.

I'm wondering if I could use one of the router's LAN ports to forward the router's Guest Network pool (which is only setup for wireless clients though the GUI, but isolated) to a VLAN I would have some of the switch's ports assigned. If found this article that sort of refers to this, though while using their mesh aps. Does this make sense? Do you have any pointers on how to make this happen?

Here's what the guest network interface looks like via SSH:

gbr0      Link encap:Ethernet  HWaddr 02:11:32:9D:XX:XX 

          inet addr:10.8.0.1  Bcast:10.8.0.255  Mask:255.255.255.0

          inet6 addr: fe80::11:32ff:xxxx:xxxx/64 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:34027 errors:0 dropped:0 overruns:0 frame:0

          TX packets:136448 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:1000

          RX bytes:4662370 (4.4 MiB)  TX bytes:129080870 (123.1 MiB)

Thanks once again