-
Join the MyBroadband community
South Africa’s biggest forum. Discuss, discover, and connect with thousands of members.
-
Question of the Day: Will you be subscribing to the new Disney+ R49 streaming package?
A small office & home network project, feedback welcome.
- Thread starter sajunky
- Start date
Everything is working superb, especially ER-X and Unifi AP's, but don't take it as a blank approval without further reading. Everything is still working in basic configuration, KISS, sans VLAN. On the first approach creating VLAN's on ER-X I lost access to the management of ER-X after restart, so I reverted to the basic configuration, thinking ME STUPID, I gave up. Now I learned, what was wrong. It can't be done in GUI alone, it needs some extra CLI instructions for fixing holes of GUI. Shortly after this, the owners have decided that Netflix is not good (and they don't want to pursue for US content nor pirating - Gods-heaven), so they will stay with DSTV. A requirement for a wired VLAN may come back soon for the tenant, will post feedback when implemented. I can also remove one port from the ER-X switch-port and create a separate LAN for the tenant, no problem. For now Unifi AP's give some WiFi guest separation, it maybe not good enough for hackers. For better security read about TP-Link.
TP-Link SG108E works fine, tested some VLAN's as well, but there is a security flaw, a serious one in my opinion. One of the reason of implementing VLAN is a traffic separation. TP-Link does it, except a management interface. sic! Everyone connected to the switch can acces management Web page from any VLAN and attempt to hack it. It doesn't matter whether you change default VLAN from the VLAN1.
Possible further problems. It was a case where TP-Link didn't save user configuration. In the other case the second switch (daisy-chained to the first one) slowed down the entire LAN to the standstill. It was a next morning after power was cut during the night. I noticed that management page was not responding, so I pulled a plug from the uplink and everything returned to normal. At the moment none of the ports were active (no connected devices), I don't know it could be a reason. For now, there are some devices connected, it didn't happen again.
On the positive side, TP-Link do QoS, some traffic limiting per port basis, it can be very useful. Web interface is simple to use. VLAN section looks clean, but is obscure. To avoid a mistake I had to create a different layout of VLAN table on the piece of paper first. Link quality statistics are available, I already picked up one cable connection with extensive error rate. I think it is worth extra R100 comparing to the non-managed version. However security conscious users should look elsewhere.
VoIP phone would benefit from VLAN/QoS, but for now there was no case of saturating the fiber link. I was also adviced by the Switchtel technician to not depend on LLDP-MED auto configuration, so there is no reason to plug it directly to ER-X anymore. I put a base station on the static (reserved) IP with 5060 port open, thats all.
Unifi access points work well with cable connection. There is a short half-second drop-out on the Whatsapp call when walking around the house and AP is changing. AP's may overlap to close, as devices in the office room can use AP located in the living room for no reason. No reason? There is a cable problem in the office, cable link for this AP is switching to 100Mbps at times. Not fixed yet.
A final note is about installing UAP-AC-LITE to the wall. You have to give some free play for the LAN cable, fold it inside the pocket. I glued the cable to the wall very close to the 'saucer'. Then I tried to fix connectivity problem, I couldn't rotate it, things were blocked by the cable, I had to rip the glue out of the wall.
Last edited:
Everything is working superb, especially ER-X and Unifi AP's, but don't take it as a blank approval without further reading....SNIP...
Awesome. Thanks for the detailed feedback! Its interesting following your progress.
Configuration with VLAN's and traffic separation.
Now it is final! Configuration with VLAN's and traffic separation.
I initially took responses on implementing QoS very seriously, but later realized it won't benefiting this installation. Internet traffic is very predictable. During office hours there is no strain on the Internet. After hours TV streaming comes up, but then there is no office traffic and IP phone is used quite rarely. The first few months working in a basic configuration there were absolutely no problems with IP phone. If we had implemented QoS, ER-X would not be a future proof. ER-8 is more suitable, but it costs few times more and there is no space in the cabinet for professional 19" devices. And remember, we can power up ER-X directly from the 12V car battery.
A simple alternative is just increasing line speed. With hardware offloading in place ER-X will push above the 500/500Mbps line, so there is a plenty upgrade room for this router.
It was a right direction. Now the tenant wants to stream 4K TV, so next day we upgraded to 50/50Mbps for additional R150p/m. Do you know what is a problem with IP telephony? A latency. On the 50Mbps line emptying the buffer of 200 packets (1500 Bytes long) takes 50 ms. It affects telephone, but much less than on the 20Mbps line. On the 100Mbps line or above benefits of QoS should be insignificant.
Without QoS our network planning needs some tinkering. Here is how I it works here:
FiberBox <-----> (eth0-WAN) ER-X (eth1) <--trunk--> SW1 <--trunk--> SW2
ER-X is configured using Basic Setup Wizard, VLAN's and trunk port (to the SW1) are added manually. The other 3 switchports on the router can be used for the additional office devices.
IMPORTANT: There is a bug in handling switchport routing on EdgeOS. Once you enable a port as VLAN aware, routing between switch0 (physical interface) and switch0.x (virtual interface) do not work. A workaround is to move all port traffic to the virtual interfaces. To do it, you have to remove IP address from the switch0 first, then add VLAN's with appropriate subnet IP's. When you do the first step, you cut yourself out of the management interface. It is what I learned hard on the first atempt. This is a warning, Edge routers are not consumer devices!
The proper configuration procedure to avoid being cut off is given in this example: https://help.ubnt.com/hc/en-us/articles/115012700967. BTW, it is a very similar case and despite of different port usage, all subsequent router configuration steps are essentially identical. In particular you can copy/paste Firewall/NAT configuration directly to your workbook.
There are 4 VLANS on the ER-X trunk:
1 - Office and LAN management
2 - IP Phone
3 - Guest and TV
4 - Tenant
Switch SW1 carries most of office traffic (from a dumb switch and individual plugs), Yealink WP50 phone base station and 2x Ubiquiti UAP-AC-LITE.
WP50 receives the highest traffic priority on the switch (Port Based QoS). I know it does a little, but it will help pushing the right packets to the uplink during heavy traffic (including internal traffic). The port is configured for VLAN 2 untagged (native).
Ubiquiti WiFi AP's do carry untagged (native) VLAN 1 (Office and LAN management) and a tagged VLAN 3 (Guests and TV). Maybe not really a guest WiFi in the Ubiquiti terminology(?) - it is just a separate SSID wih password. Ports are configured on the switch as hybrid ports, like on the above example, but on the switch instead (see a comment below on TP-Link).
Switch SW2 is tailored for Guest&TV (wired TV and bedrooms) and Tenant's traffic. This physical separation allows for bandwith control tinkering. It can be done on the trunk port for all, but at the moment there is only a need to limit the bandwith for the tenant, who receives 30Mbps maximum. It looks like the switch does a good job on the egress rate (downloading), but not so great on ingress rate. Any thoughts?
Configuring VLANs on the TP-Link switch is really unintuitive and awkward. It prompts me to refresh my memory regarding VLAN principles every time I attempt to configure.the switch. In general we have 3 types of ports: access, trunk and hybrid. Here is example (from the above link) of configuring VLANs on the EdgeRouter: https://help.ubnt.com/hc/article_attachments/115023146847/mceclip3.png
In the example access ports are eth2 and eth3. A hybrid port is eth4 (for WiFi AP). Trunk port would have 'pvid' field empty. UI also prevents user from setting up the same VLAN# on the both 'pvid' and 'vid'. Simple, isn't?
Now lets see how it is made on TP-Link. There are number of VLAN tables, one for each VLAN#. Then on the second screen you can assign a native VLAN (PVID) on each port. It is unintuitive, and a mistake can lead to number of unwanted combinations. In addition UI is awkwardly buggy. On the first screen (VLAN tables) I could not remove VLAN 1 from the port (to make a port non-member), UI silently ignored changes. It accepted changes only after proceeding to the second screen and assigning PVID on that port different than default VLAN 1. It took a time to discover it.
All right, so lets start from PVID table first! Wrong, as VLAN# is undefined, it can only be done on the first screen. The final look of the table is also confusing. Lets look how ordinary access port VLAN 2 looks like:
VLAN table for VID 2: port set to 'untagged'
PVID table: port set to the same 'VID 2'
Repeating information at least, On the trunk port it is even worse, Due to the restriction described above you can't remove VLAN 1 from the trunk port, which makes it either a hybrid port or that setting PVID applies only to the ingress traffic and VLAN table only to the egress traffic. It works with ER-X pure trunk port, so its the later.
The following post from whosmatt explain a principle: https://forum.netgate.com/topic/109686/tp-link-easy-smart-switch-security-question/24
On the positive side, TP-Link properly blocks access to the management interface on ports where VLAN 1 is marked non-membet and PVID set to a different VLAN than #1. It is in contrary to my previous post, maybe firmware upgrade corrected the problem or I missed something.
In addition, losing configuration on the TPLink didn't happen anymore, I hear that the first time it is saved properly, a second time may not. So now after saving configuration I do restart a switch and no problem.
In summary, both EdgeRouter and TP-Link switches presented a bit challenge, but problems turned out to be avoidable, system is running smooth and exactly as planned.
Now it is final! Configuration with VLAN's and traffic separation.
I initially took responses on implementing QoS very seriously, but later realized it won't benefiting this installation. Internet traffic is very predictable. During office hours there is no strain on the Internet. After hours TV streaming comes up, but then there is no office traffic and IP phone is used quite rarely. The first few months working in a basic configuration there were absolutely no problems with IP phone. If we had implemented QoS, ER-X would not be a future proof. ER-8 is more suitable, but it costs few times more and there is no space in the cabinet for professional 19" devices. And remember, we can power up ER-X directly from the 12V car battery.
A simple alternative is just increasing line speed. With hardware offloading in place ER-X will push above the 500/500Mbps line, so there is a plenty upgrade room for this router.
It was a right direction. Now the tenant wants to stream 4K TV, so next day we upgraded to 50/50Mbps for additional R150p/m. Do you know what is a problem with IP telephony? A latency. On the 50Mbps line emptying the buffer of 200 packets (1500 Bytes long) takes 50 ms. It affects telephone, but much less than on the 20Mbps line. On the 100Mbps line or above benefits of QoS should be insignificant.
Without QoS our network planning needs some tinkering. Here is how I it works here:
FiberBox <-----> (eth0-WAN) ER-X (eth1) <--trunk--> SW1 <--trunk--> SW2
ER-X is configured using Basic Setup Wizard, VLAN's and trunk port (to the SW1) are added manually. The other 3 switchports on the router can be used for the additional office devices.
IMPORTANT: There is a bug in handling switchport routing on EdgeOS. Once you enable a port as VLAN aware, routing between switch0 (physical interface) and switch0.x (virtual interface) do not work. A workaround is to move all port traffic to the virtual interfaces. To do it, you have to remove IP address from the switch0 first, then add VLAN's with appropriate subnet IP's. When you do the first step, you cut yourself out of the management interface. It is what I learned hard on the first atempt. This is a warning, Edge routers are not consumer devices!
The proper configuration procedure to avoid being cut off is given in this example: https://help.ubnt.com/hc/en-us/articles/115012700967. BTW, it is a very similar case and despite of different port usage, all subsequent router configuration steps are essentially identical. In particular you can copy/paste Firewall/NAT configuration directly to your workbook.
There are 4 VLANS on the ER-X trunk:
1 - Office and LAN management
2 - IP Phone
3 - Guest and TV
4 - Tenant
Switch SW1 carries most of office traffic (from a dumb switch and individual plugs), Yealink WP50 phone base station and 2x Ubiquiti UAP-AC-LITE.
WP50 receives the highest traffic priority on the switch (Port Based QoS). I know it does a little, but it will help pushing the right packets to the uplink during heavy traffic (including internal traffic). The port is configured for VLAN 2 untagged (native).
Ubiquiti WiFi AP's do carry untagged (native) VLAN 1 (Office and LAN management) and a tagged VLAN 3 (Guests and TV). Maybe not really a guest WiFi in the Ubiquiti terminology(?) - it is just a separate SSID wih password. Ports are configured on the switch as hybrid ports, like on the above example, but on the switch instead (see a comment below on TP-Link).
Switch SW2 is tailored for Guest&TV (wired TV and bedrooms) and Tenant's traffic. This physical separation allows for bandwith control tinkering. It can be done on the trunk port for all, but at the moment there is only a need to limit the bandwith for the tenant, who receives 30Mbps maximum. It looks like the switch does a good job on the egress rate (downloading), but not so great on ingress rate. Any thoughts?
Configuring VLANs on the TP-Link switch is really unintuitive and awkward. It prompts me to refresh my memory regarding VLAN principles every time I attempt to configure.the switch. In general we have 3 types of ports: access, trunk and hybrid. Here is example (from the above link) of configuring VLANs on the EdgeRouter: https://help.ubnt.com/hc/article_attachments/115023146847/mceclip3.png
In the example access ports are eth2 and eth3. A hybrid port is eth4 (for WiFi AP). Trunk port would have 'pvid' field empty. UI also prevents user from setting up the same VLAN# on the both 'pvid' and 'vid'. Simple, isn't?
Now lets see how it is made on TP-Link. There are number of VLAN tables, one for each VLAN#. Then on the second screen you can assign a native VLAN (PVID) on each port. It is unintuitive, and a mistake can lead to number of unwanted combinations. In addition UI is awkwardly buggy. On the first screen (VLAN tables) I could not remove VLAN 1 from the port (to make a port non-member), UI silently ignored changes. It accepted changes only after proceeding to the second screen and assigning PVID on that port different than default VLAN 1. It took a time to discover it.
All right, so lets start from PVID table first! Wrong, as VLAN# is undefined, it can only be done on the first screen. The final look of the table is also confusing. Lets look how ordinary access port VLAN 2 looks like:
VLAN table for VID 2: port set to 'untagged'
PVID table: port set to the same 'VID 2'
Repeating information at least, On the trunk port it is even worse, Due to the restriction described above you can't remove VLAN 1 from the trunk port, which makes it either a hybrid port or that setting PVID applies only to the ingress traffic and VLAN table only to the egress traffic. It works with ER-X pure trunk port, so its the later.
The following post from whosmatt explain a principle: https://forum.netgate.com/topic/109686/tp-link-easy-smart-switch-security-question/24
On the positive side, TP-Link properly blocks access to the management interface on ports where VLAN 1 is marked non-membet and PVID set to a different VLAN than #1. It is in contrary to my previous post, maybe firmware upgrade corrected the problem or I missed something.
In addition, losing configuration on the TPLink didn't happen anymore, I hear that the first time it is saved properly, a second time may not. So now after saving configuration I do restart a switch and no problem.
In summary, both EdgeRouter and TP-Link switches presented a bit challenge, but problems turned out to be avoidable, system is running smooth and exactly as planned.
Last edited:
DrJohnZoidberg
Honorary Master
This guy noted the same thing in his review:
[video=youtube;5ohLAFHnOHg]https://www.youtube.com/watch?v=5ohLAFHnOHg[/video]
Now I verified that my statement was incorrect. With the current firmware SG-108E v3 do not allow strangers to access a switch management Web page. I checked it very simple by configuring network adapter IP address manually to 192.168.1.x. Only switch ports configured for VLAN1 respond to ping and allow accessing Web management page. So, I can say SG108E is safe, unless it is proven otherwise.
There are possibilities of hacking a VLAN networks using sophisticated tools, by example using specially crafted nested VLAN frames (a VLAN frame embedded in inside another VLAN frame of a different ID). It is an intrinsic vulnerability of hybrid switch ports in general. Network security specialists advise avoiding hybrid ports. Ideally there should be only pure access ports or trunks.
Last edited: