Question Need help getting Internet to switch...

[snapbug]

I originally thought we would be able to keep our camera network separate from our home Internet network, but as it turns out, the non-Internet methods of controlling our gate are not our best and most reliable options. We will need MyQ, which will require Internet to the switch on the service pole at our gate. Below is a diagram of the network. What will be the most secure method of getting Internet to that switch? Many thanks!

 

[ch33zw1z]

When you say securely, what do you mean?

Are you trying to keep the camera network 100% isolated from the main network AND provide the camera network internet access?

If so, VLAN’s are the answer

 

[snapbug]

Yes... vlan seems to be the consensus.

 

[Fallen Kell]

I also recommend VLANs, and plan for more than you think you need (i.e. a guest network VLAN, a VLAN for IoT devices that require internet, a VLAN for IoT devices that stays local, a VLAN for administration, a VLAN for management, a VLAN for your normal/production devices, and even a VLAN for routing to the internet itself). Then you can setup some basic ACL type rules, such as a default deny, and open up connection from the internet routing VLAN to reach the internet, allow the data from the administration VLAN to access all the other VLANs, allow traffic from the IoT VLAN that needs internet connectivity to access the internet routing VLAN, etc., etc...

Ideally you will want to give each VLAN a known specific subnet range (for keeping it easy to remember, I use the VLAN tag number as the subnet). This way it is also easy to setup the ACL, routing, and firewall rules. Unfortunately with the unmanaged switch in the office, you are going to be limited to using a single, untagged VLAN for all the devices connected to it. So you will need to have firewall rules to prevent a connection from the internet from connecting to any IP addresses associated with your camera system (or replace with a managed switch(es) which you can then pass the different VLANs to the camera system and to the gate control.

Also, the AV Room/Theater switch should be fine with the CAT6 cable for 10gbps at that distance (it should be good for ~50m of length at 10gbps).

 

[snapbug]

Thanks guys.

What should be the order of setting these up. I know when I go to changing subnets and IP addresses devices and clients can become disconnected if not careful.

Do I setup the VLANs first, then start moving the clients?

Or do I need to change the IP address of the client so that the subnet matches the VLAN, then move them. If I change the IP address before I move them, I may lose connection... not sure how all that works. An example of the procedure would be very helpful. Thanks again!

 

[ch33zw1z]

Vlans are configured first. Plan the network ranges, setup a couple vlans to test with. Vlans will have traffic flow between by default, so after you set up a couple, test firewall rules by first blocking inter vlan traffic. Get a feel for it, then roll it out to the other parts of the network

 

[snapbug]

So I don't have to change the IP addresses of the devices moved to another VLAN?

 

[ch33zw1z]

So I don't have to change the IP addresses of the devices moved to another VLAN?

You will at some point, but start with planning the VLAN’s and networks you want to use.

For example, I use the 192.168.1.x/24 for my main network as that was default for my device. But I use 10.0.xx.1 thru .254 for the rest of my networks, and .xx matches the vlan ID. So for vlan 100, it would be 10.0.100.x/24

 

[Fallen Kell]

You will also need to look at your DHCP service provider, and make sure it has address ranges for all the subnets on the various VLANs you create. There are two or three common ways of doing this. One is by configuring a DHCP helper IP (sometimes called dhcp relay ip) in your layer3/layer4 router (where you defined the VLANs in the first place). Alternatively, you can have your DHCP server running on a system that you can pass all the VLANs to it and configure tagged virtual interfaces for each VLAN and setup a local IP on that interface for the DHCP server (this is what I did). Also be sure to properly configure VLAN specific default gateways/routes, DNS service, NTP/time server for each VLAN range (it is easier than it sounds, once you get your head around it).

As has been said above, if you are transitioning an existing configuration to one with VLANs, you first start by setting up and defining the VLANs. Next, go through setting up the routing, ACL, and firewall rules on the VLANs. This will take time and require a system that you can configure software defined tagged interfaces and connect that to a port on a switch that has all the VLANs configured on it (sometimes called a trunk port, as it "trunks" multiple VLANs onto a single physical interface). You can then go about testing through the virtual tagged interfaces using ping, web browsing, and/or ssh to the other tagged interfaces or to the internet (or from the "internet" if you created a VLAN for your internet side like I mentioned earlier) to see that all the rules you have created are properly functioning to isolate the various VLANs and only allow the communications you have defined.

Once you have tested the VLANs, routing rules, firewall rules, etc., you will want to setup your DHCP services for all the VLANs, and then you can use the same test device you previously setup for testing the VLAN routing rules, and firewall rules, and just configure the virtual tagged interfaces to attempt to obtain an IP address via DHCP instead of hard coding it like you would have needed to originally on each VLAN subnet. If it gets proper IP addresses, and functions, you are ready.

You can then start going through your devices and reconfiguring them. This will be a combination of tagging the port on the switch(es) that the device connects into with the appropriate VLAN ID(s) and reconfiguring the device itself to use a new IP on the new VLAN subnet (or if it is already set to DHCP, just update any static IP rules defined in DHCP for the device to the new subnet IP). I am using DD-WRT on a wireless access point to handle my DNS and DHCP and it has had no real problem with handling all my VLANs and VAPs (that is virtual access points, which is essentially a VLAN for wireless, and is how a guest wireless network is created, but I have WAPs for any VLAN that has wireless devices on it).


All of this needs to basically be done on the TP-Link router and switch using the interfaces they provide to you. I really can not tell you how to do that, as I do not own that kind of gear. My main network core switch is a Ruckus/Brocade IPX-6610, which runs FastIronOS (almost a clone of CISCO's IOS in terms of command line configure, but also has a web interface). This switch (and a few others in its family) have an extensive thread about them and how to configure/use over on servethehome forums:

Brocade ICX Series (cheap & powerful 10gbE/40gbE switching)

NOTE #1: do not PM me with switch questions, they will be ignored - post them in this public thread, where hundreds of other members can also answer, and the answer will be public for future users NOTE #2 06-22-2023: Yes, this post is still up to date and nothing has changed: in fact judging by...

forums.servethehome.com

 

[snapbug]

I got my AV/Theater Room switch connected a while ago with the 10G SFP+ connection. It worked for about a minute, and then the entire network went out. I could not even access my Omada OC300 Controller or the Router. I disconnected it and was able to get into the controller long enough to see a log entry with an error: TP-Link Omada SG3218XP-M2 port Te1/0/18 was blocked.

The network has become very sluggish. It appears I have something working because I'm getting on the Internet, but I am no longer able to log into the controller or the 8411 router (which I normally control it with the OC300 controller anyway, but at least can get to the login screen).

Any ideas on what's happening?

 

[snapbug]

I'm definitely not a networking guy, but for some reason that SFP+ port (which is port 18) got blocked. When it happened, it knocked out the network.

The network as stabilized, but I have not reconnected that AV room switch... not sure what it's being blocked.

 

[snapbug]

Odd... that switch is showing connected via WiFi because I have an Access Point connected to it. I wonder if that is causing an issue when connecting the switch by ethernet at that same time and both are trying to connect the switch to the network and perhaps that is why it was blocked?

 

[ch33zw1z]

Odd... that switch is showing connected via WiFi because I have an Access Point connected to it. I wonder if that is causing an issue when connecting the switch by ethernet at that same time and both are trying to connect the switch to the network and perhaps that is why it was blocked?

Yes, if you’re getting two IP’s on the same subnet for the switch IP, then it’s very likely the switch is shutting off one link. It’s a different scenario tho, does the switch itself have a WiFi connection? Or the AP is handing out IP’s?

 

[In2Photos]

I'm likely not as well versed as the other members that have provided help already in this thread so they may correct me.

Did you install the 10G SFP or was it already installed? Do you need to configure the port after you install the SFP or does it automatically recognize the SFP and set the port accordingly? I've seen several switches that require some sort of configuring after an SFP install to get that port working correctly.

Otherwise I suspect ch33zw1z is correct though and you may have 2 connections between the 2 Omada switches. Di the theater room have network/internet access before you installed the SFP? If the AP connected to the 10 port switch is assigning IPs and passing everything wirelessly to the 18 port switch via one of the other APs, you may have to do some re-configuring of the APs.

I also don't see why you needed this connection to get the cameras working on the network. Or maybe you are trying to do multiple things here and I missed something? Seems to me to get the cameras connected to the internet would only require you connecting the 2.5Gb port from the 18 port switch that currently goes to the PC and running it to the 8 port unmanaged switch. Then connect the PC back to the unmanaged switch with the 2.5Gb port on the PC.

 

[snapbug]

Yes, if you’re getting two IP’s on the same subnet for the switch IP, then it’s very likely the switch is shutting off one link. It’s a different scenario tho, does the switch itself have a WiFi connection? Or the AP is handing out IP’s?

I'm likely not as well versed as the other members that have provided help already in this thread so they may correct me.

Did you install the 10G SFP or was it already installed? Do you need to configure the port after you install the SFP or does it automatically recognize the SFP and set the port accordingly? I've seen several switches that require some sort of configuring after an SFP install to get that port working correctly.

Otherwise I suspect ch33zw1z is correct though and you may have 2 connections between the 2 Omada switches. Di the theater room have network/internet access before you installed the SFP? If the AP connected to the 10 port switch is assigning IPs and passing everything wirelessly to the 18 port switch via one of the other APs, you may have to do some re-configuring of the APs.

I also don't see why you needed this connection to get the cameras working on the network. Or maybe you are trying to do multiple things here and I missed something? Seems to me to get the cameras connected to the internet would only require you connecting the 2.5Gb port from the 18 port switch that currently goes to the PC and running it to the 8 port unmanaged switch. Then connect the PC back to the unmanaged switch with the 2.5Gb port on the PC.


View attachment 104522

Originally, I had an unmanaged switch in the AV room connected with an Ethernet cable, and it was not getting an IP address. I also had the AP connected to that switch for better WiFi in the AV room. It was all working fine.

Then... I swapped out the unmanaged switch with a managed switch that has a 10G SPF+ connection so that I can get better speeds out there. None of the switches have WiFi... only the APs I have connected to them.

When I swapped out the switches, that is when the SPF+ port on our main switch (the 16-port switch feeding the AV room switch) got blocked.

I removed the AP from the AV room switch, and the SPF+ port was unblocked. It is working fine now but without the better WiFi in the AV room. I still have WiFi, just not quite as good as it would be if the AP was connected.

The reason for the dual run on the two ports to the PC was an attempt to keep the camera network separate from the rest of the network. I actually had it to where the cameras could not see the Internet, but then decided to change it and just put them behind a VPN so that I could have easier access to them when away from the house. Otherwise, I would have had to log in to another computer in the house and remote into the camera PC, which was more trouble than what I think the protection was worth. The only drawback to running the 2.5Gb connection thru the switch is I lose the 2.5Gb speed because that switch is only a Gigabit switch. I could bump it to a 2.5Gb switch and eliminate the extra run, but I'm not sure there's really any benefit in it over the way I have it run right now.

 

[ch33zw1z]

Ok sounds like the AP is configured as a repeater so it’s passing thru dhcp requests. If you’re going to hang it off the switch that, I recommend making it a AP only. Also set a static IP on the switch that’s outside of the DHCP pool (turn off dhcp for the management connection piece of the switch)

 

[In2Photos]

Originally, I had an unmanaged switch in the AV room connected with an Ethernet cable, and it was not getting an IP address. I also had the AP connected to that switch for better WiFi in the AV room. It was all working fine.

Then... I swapped out the unmanaged switch with a managed switch that has a 10G SPF+ connection so that I can get better speeds out there. None of the switches have WiFi... only the APs I have connected to them.

When I swapped out the switches, that is when the SPF+ port on our main switch (the 16-port switch feeding the AV room switch) got blocked.

I removed the AP from the AV room switch, and the SPF+ port was unblocked. It is working fine now but without the better WiFi in the AV room. I still have WiFi, just not quite as good as it would be if the AP was connected.

The reason for the dual run on the two ports to the PC was an attempt to keep the camera network separate from the rest of the network. I actually had it to where the cameras could not see the Internet, but then decided to change it and just put them behind a VPN so that I could have easier access to them when away from the house. Otherwise, I would have had to log in to another computer in the house and remote into the camera PC, which was more trouble than what I think the protection was worth. The only drawback to running the 2.5Gb connection thru the switch is I lose the 2.5Gb speed because that switch is only a Gigabit switch. I could bump it to a 2.5Gb switch and eliminate the extra run, but I'm not sure there's really any benefit in it over the way I have it run right now.

OK, makes sense. Can you connect the PC directly to the Omada and use a separate run to connect the 8 port switch for the cameras? Or do you only have a single run back to the Omada?

 

[snapbug]

Ok sounds like the AP is configured as a repeater so it’s passing thru dhcp requests. If you’re going to hang it off the switch that, I recommend making it a AP only. Also set a static IP on the switch that’s outside of the DHCP pool (turn off dhcp for the management connection piece of the switch)

I spoke with TP-Link tech support about it, and they said to just plug the AP back in now, and it would work. The problem was I had the AP plugged into the switch before connecting the SFP+ cable, and it was provisioned as being the device to connect the switch. Once I connected the SPF+ cable, the system saw the switch was already connected and blocked it. After disconnecting the AP, the SFP+ became the primary connection, and now the AP won't try to connect the switch once it is plugged back in. Indeed... It's plugged in now, and everything is working fine. Weird stuff for me to fully understand.

OK, makes sense. Can you connect the PC directly to the Omada and use a separate run to connect the 8 port switch for the cameras? Or do you only have a single run back to the Omada?

Yes... the 2.5Gb port on the PC is connected directly to the main switch via a single cable. Then, the 8-port camera switch is connected to that same main switch via a separate cable.

Here's what it looks like now. I can't expand the Client Group for the main switch because it makes the map too small to read, but here's the topology...

 

[snapbug]

Next project is to figure out the VLAN routing to separate the cameras.