To separate guest and production networks, you can segment a network and create two Layer 3 networks. In this way, you achieve complete separation between both networks, while each network can have full access to the Internet.
When you create VLANs, be sure to use numbers and names that clearly identify each VLAN and its purpose. The scenario described in this example is as follows:
- Existing default VLAN 1: 192.168.1.0/255.255.255.0
- Example VLAN 5 as Guest: 192.168.5.1/255.255.255.0
- LAN 11 port on the Smart Switch: connected to a computer in VLAN 5
- LAN 1 port on the PR60X Pro Router: connected to the LAN 1 port on the Smart Switch
In this example we are using a NETGEAR PR60X Pro Router and a NETGEAR fully managed switch. However, you can use any router and Layer 2 switch that support VLANs. Consult the documentation for your router and switch.
To set up VLAN 5 with the name Guest on the PR60X Pro Router and fully managed switch, and assign ports to the VLAN:
Step 1. Log in to the PR60X Pro Router:
- Launch a web browser from a computer or mobile device that is connected to the router network.
- In the address field of your browser, enter https://www.routerlogin.net.
The login page displays - Your browser might display a security warning. For more information, see What do I do if I my browser displays a security message?
- Type one of the following passwords:
- Type the router user name and password. The user name is admin.
The password is the one that you specified when you set up the router. The user name and password are case-sensitive. - If you are managing the router through the Insight Cloud Portal or Insight app,
type the Insight network password for the Insight network location to which the router is added.
The Dashboard displays.
Step 2. On the PR60X Pro Router, create VLAN 5 with the name Guest and assign the VLAN to LAN port 1:
- Select LAN > VLAN Settings.
The VLAN Settings page displays. - Click the Add VLAN Profile button.
The Add New VLAN Profile pop-up window displays. - In the VLAN ID field, type 5.
- In the VLAN Name field, type Guest.
- Keep the Inter VLAN Routing toggle gray and position to the left.
Traffic between this VLAN and other VLANs on the router is restricted. - In the IP Address field, type 192.168.5.1.
- In the Subnet Mask field, type 255.255.255.0.
- In the DHCP Server section, click the Status toggle so that it is blue and positioned to the right.
The DHCP server is enabled and assigns an IP address to the devices on this VLAN. - In the Start Address field, type 192.168.5.20 as the start address for the DHCP server.
- In the End Address field, type 192.168.5.100 as the start address for the DHCP server.
- Click the Apply button.
Your settings are saved. The new VLAN profile is added to the VLAN Settings page. - Remain on the same page but scroll down to the Assign VLANs to Wired Ports section at the bottom of the page.
- For VLAN 5, select Tagged in the LAN 1 column.
The LAN 1 port is already an untagged member of VLAN 1, so for VLAN 5, the LAN 1 port must be a tagged member. - Click the Apply button.
Your settings are saved.
Step 3: Log in to the fully managed switch:
- Launch a web browser and enter the IP address of the switch in the address field of your web browser.
The login page displays. - Click the Main UI Login button.
The main UI login page displays in a new tab. - Enter admin as the user name and enter one of the following passwords:
- Enter your local device password.
The first time that you log in, no password is required. However, you then must specify
a local device password to use each subsequent time that you log in. - If you are managing the switch through the Engage controller, enter the site password
for the Engage site to which the switch is onboarded. - If, in addition to the main UI, you are also managing the switch through the Insight Cloud Portal
or Insight app, enter the Insight network password for the Insight network to which the switch is added.
- Click the Login button.
The System Information page displays.
Step 4. On the fully managed switch, create VLAN 5 with the name Guest:
- Select Switching > VLAN > Advanced > VLAN Configuration.
The VLAN Configuration page displays. - In the VLAN ID field, type 5.
- In the VLAN Name field, type Guest.
- Click the Add button.
Your settings are saved.
Step 5. On the fully managed switch, add port 11 to VLAN 5 and remove port 11 from VLAN 1:
- Select Switching > VLAN > Advanced > VLAN Membership.
The VLAN Membership page displays. - From the VLAN ID menu, select 5.
- Click port 11 until a U displays.
The selected port is added as an untagged member of VLAN 5. - Click the Apply button.
Your settings are saved. - From the VLAN ID menu, select 1.
- Click port 11 until neither a T or a U displays, indicating that the port is removed.
- Click the Apply button.
Your settings are saved.
Step 6. On the fully managed switch, change the PVID for port 11 to 5 (for VLAN 5):
- Select Switching > VLAN > Advanced > Port PVID Configuration.
The PVID Configuration page displays. - Select the check box for port 11.
- In the PVID field, type 5, which is the ID of the VLAN to which untagged or priority-tagged frames
received on interface 11 must be assigned. - Click the Apply button.
Your settings are saved.
Step 7. Test that both VLANS are online and segregated:
- Connect a cable from a switch port in VLAN 1 to a computer that must manage the switch in VLAN 1.
- Connect a cable from switch port 11 to a computer that must be connected in Guest VLAN 5.
- Confirm that the computers are connected to the Internet by navigating to any website or pinging the two remote computers.
If a computer cannot connect, double-check that you followed each step correctly and that the cables are in the correct ports. - Confirm that the VLANS are segregated by using a command prompt or terminal to send a ping packet from the computer that is
connected to a port in default VLAN 1 to the computer that is connected to port 11 in the guest VLAN. The ping should time out because the VLANs are segregated.
Last Updated:07/07/2025
|
Article ID: 000066755