For a basic introduction to virtual local area networks (VLANs), see the following knowledge base articles:
How can I add VLANs to my network?
Before setting up VLANs, best practice is to plan the entire network’s physical and logical setup (known as network topology) carefully. VLAN configuration mistakes can cause serious connectivity and security problems on your network. If you do not have experience setting up computer networks, consider hiring an IT or networking professional.
NETGEAR recommends planning your network’s logical topology (which devices need to be connected to each other) before you plan the physical topology (where each device should go, how to run the Ethernet cables).
When you have multiple VLANs on your network, you must decide which ports will be members of each VLAN. All ports that are members of a VLAN receive traffic that is sent on that VLAN. Then, you must decide whether each port will be a tagged member or an untagged member of the VLAN. A port is tagged for a VLAN when traffic that leaves the switch through that port has an IEEE 802.1Q header with that VLAN’s numerical identifier (VLAN ID) on it. If a port is an untagged member of a VLAN, the switch removes the existing 802.1Q header before sending traffic through that port.
What do I need to know about VLAN membership and tagging?
The following are basic principles of VLAN membership and tagging:
- Each port can be a member of an unlimited number of VLANs, but traffic on that port will be slow if it is a member of several busy VLANs. If you plan to make a port a member of multiple VLANs, consider setting up a link aggregation group (LAG) for increased bandwidth and throughput over that connection.
- Each port can only be an untagged member of a single VLAN. If a port is already an untagged member of a VLAN, you cannot add it as an untagged member of any other VLANs.
- All untagged traffic that enters the switch is assigned to the default or native VLAN, which is VLAN 1. VLAN 1 is also the management VLAN on switches that support management VLANs. For more information, see What is a management VLAN?.
- If a port is a member of a link aggregation group (LAG) or you plan to add it to a LAG, do not add it to a VLAN or tag it individually. You must add the LAG to the VLAN as a single unit.
- Best practice involves classifying each port as either an access port or a trunk port. An access port is a member of a single VLAN and connects to a computer, printer, or other device on the edge of a network. A trunk port connects the switch to a router or to other switches; it must participate in multiple VLANs because all traffic that passes between the switch and the rest of the network must go through that port.
- Some networked devices recognize 802.1Q tagging, and some do not. If a device does not recognize tags, it rejects any tagged traffic that it receives, so it can only be an untagged member of a VLAN.
- If you are not sure whether a device supports 802.1Q tagging, see the device’s documentation. The following list contains general guidelines that are not applicable in all cases:
- Most printers do not recognize 802.1Q tags.
- If a computer needs to be a tagged member of a VLAN, you must configure a VLAN ID on the network interface controller (NIC) of the computer. All other computers must be untagged.
- Most network attached storage (NAS) devices either support 802.1Q tagging, have multiple NICs with multiple Ethernet ports (which can be added to different VLANs), or both.
- Most Voice Over Internet Protocol (VOIP) phones recognize 802.1Q tags.
- Most wireless access points recognize 802.1Q tags.
- Unmanaged switches and some switches with limited management functions do not recognize 802.1Q tags.
- Most business routers recognize 802.1Q tags. Most home routers do not.
For device-specific information and detailed instructions on setting up VLANs, see the user manual or support page for your NETGEAR product.