Understanding The Vpn Firewall's Port-Based Vlans - NETGEAR SRX5308 - ProSafe® Quad WAN Gigabit SSL VPN Firewall Reference Manual

ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 Reference Manual
VLANs have a number of advantages:
• They make it easy to set up network segmentation. Users who communicate most frequently
with each other can be grouped into common VLANs, regardless of physical location. Each
group's traffic is contained largely within the VLAN, reducing extraneous traffic and
improving the efficiency of the whole network.
• They are easy to manage. The addition of nodes, as well as moves and other changes, can be
dealt with quickly and conveniently from a management interface rather than from the wiring
closet.
• They provide increased performance. VLANs free up bandwidth by limiting node-to-node and
broadcast traffic throughout the network.
• They ensure enhanced network security. VLANs create virtual boundaries that can be crossed
only through a router. So standard, router-based security measures can be used to restrict
access to each VLAN.

Understanding the VPN Firewall's Port-Based VLANs

The VPN firewall supports port-based VLANs. Port-based VLANs help to confine broadcast
traffic to the LAN ports. Even though a LAN port can be a member of more than one VLAN, the
port can have only one VLAN ID as its port VLAN identifier (PVID). By default, all four LAN
ports of the VPN firewall are assigned to the default VLAN, or VLAN 1. Therefore, by default, all
four LAN ports have the default PVID 1. However, you can assign another PVID to a LAN port by
selecting a VLAN profile from the drop-down list on the LAN Setup screen.
After you have created a VLAN profile and assigned one or more ports to the profile, you must
first enable the profile to activate it.
The VPN firewall's default VLAN cannot be deleted. All untagged traffic is routed through the
default VLAN (VLAN1), which must be assigned to at least one LAN port.
Note the following about VLANs and PVIDs:
• One physical port is assigned to at least one VLAN.
• One physical port can be assigned to multiple VLANs.
• When one port is assigned to multiple VLANs, the port is used as a trunk port to connect to
another switch or router.
• When a port receives an untagged packet, this packet is forwarded to a VLAN based on the
PVID.
• When a port receives a tagged packet, this packet is forwarded to a VLAN based on the ID that
is extracted from the tagged packet.
3-2
v1.0, April 2010
LAN Configuration