tribunal88
New Around Here
I'll be moving into a new house shortly and plan to run network cable throughout. Using information from this site and coworkers, I've been planning to segment my network for security reasons, and this will require 6 VLANs. The RV320 looks like a good fit, but as I started to get into the details, I realized I might be making some bad assumptions or just plain unaware of details.
What I want to do is segment the network into the following groups
Wired-Secure (VMware ESXi, NAS)
Wired-Private (PCs, Media Players, TVs, etc, Printers)
Wired-Public (Webserver)
Wireless-Private (Family devices)
Wireless-Public (Guest devices)
VPN (mostly just for me to do remote management)
Each would get its own VLAN with a DHCP, and I've got a whole slew of planned ACLs to restrict communication amongst them. I'd planned on using the RV320 as the router/gateway/firewall with Netgear GS108T 8-port switches for a main backbone (so I can LAG certain ports together), then some GS108E and GS105E switches that I already have to expand from there. For wireless, I was looking at the Cisco WAP321. I believe all of these will do 802.1q VLAN.
I would like to be able to stream media from the NAS to multiple devices and PCs throughout the house, so building in LAG to improve bandwidth seemed like a good idea. Similarly, the NAS has 2 NICs which can be bound together. Since it hosts both the media and the iSCSI luns which feed the ESXi host, LAG would help out a lot there as well.
So, one of the first things that popped into my mind was what to do about broadcasts. I know some of my media devices can be controller by apps (with more certain to follow - audio receivers ship with NICs now, can you believe it?). If they are on separate subnets, the broadcast messages for discovery won't reach them, and many of these apps don't allow for specifying IPs for targets. I read online about something called an "ip helper address" rule which overcomes this. Does the RV320 have this capability?
Another concern was that the data sheet says the RV320 can do 7 VLANs, but one of the pages on their website which talks about configuration lists 4 as its max. Can anyone confirm which is correct?
And lastly, given my goals, am I taking the wrong approach?
What I want to do is segment the network into the following groups
Wired-Secure (VMware ESXi, NAS)
Wired-Private (PCs, Media Players, TVs, etc, Printers)
Wired-Public (Webserver)
Wireless-Private (Family devices)
Wireless-Public (Guest devices)
VPN (mostly just for me to do remote management)
Each would get its own VLAN with a DHCP, and I've got a whole slew of planned ACLs to restrict communication amongst them. I'd planned on using the RV320 as the router/gateway/firewall with Netgear GS108T 8-port switches for a main backbone (so I can LAG certain ports together), then some GS108E and GS105E switches that I already have to expand from there. For wireless, I was looking at the Cisco WAP321. I believe all of these will do 802.1q VLAN.
I would like to be able to stream media from the NAS to multiple devices and PCs throughout the house, so building in LAG to improve bandwidth seemed like a good idea. Similarly, the NAS has 2 NICs which can be bound together. Since it hosts both the media and the iSCSI luns which feed the ESXi host, LAG would help out a lot there as well.
So, one of the first things that popped into my mind was what to do about broadcasts. I know some of my media devices can be controller by apps (with more certain to follow - audio receivers ship with NICs now, can you believe it?). If they are on separate subnets, the broadcast messages for discovery won't reach them, and many of these apps don't allow for specifying IPs for targets. I read online about something called an "ip helper address" rule which overcomes this. Does the RV320 have this capability?
Another concern was that the data sheet says the RV320 can do 7 VLANs, but one of the pages on their website which talks about configuration lists 4 as its max. Can anyone confirm which is correct?
And lastly, given my goals, am I taking the wrong approach?