Port Based Vlans - Secure Computing SG300 User Manual

Port Based VLANs

Note
SG560, SG565 and SG580 only.
The SG560, SG565 and SG580 have a VLAN-capable switch built in. This gives you the
flexibility to either use it as a simple switch that allows access between all ports (this is
the default), or use port based VLANs to control access between each individual port in
the switch.
This port based VLAN configuration makes it possible to assign each of the four ports its
own subnet address, declare it to be a LAN, WAN or DMZ independent of the other ports
and generally treat it as if it was a completely separate physical port.
The SnapGear unit may also participate on an existing VLAN. When you add a VLAN
interface to connect to the existing VLAN, you may associate it with one or more of the
SnapGear unit's ports.
Tagged and untagged VLANs
When using port based VLANs, it is important to understand the differences between
tagged and untagged VLANs.
Tagged VLAN interfaces add a VLAN header (see the VLAN Overview section earlier in
this chapter) to outgoing network packets, and only accept incoming network packets that
contain an appropriate VLAN header. Untagged VLAN interfaces do not add a VLAN
header to outgoing network packets, and do not accept incoming packets that contains a
VLAN header.
A port may be a member of either a single untagged VLAN, or one or more tagged
VLANs. A port may not be a member of both tagged and untagged VLANs.
Once switch A has had port based VLANs enabled, ports that have not been explicitly
assigned to one or more VLANs are assigned to the default VLAN. The default VLAN is
untagged.
Typically, a tagged VLAN interface is used when you want to join an existing VLAN on
the network, and an untagged VLAN interface is used when you are using the port based
VLAN feature to isolate the ports so that you can configure each of them individually.
Network Setup
97