1

my small office has two networks, each of them are connected to a switch, those switches then connect to a central switch which then connect to a router ADSL capable.

The router is connected to the WAN which provides the internet connection to all devices on this network.

I plan to have these two networks which is connected to the same central switch be isolated from each other since the other network is a public network. We don't want the traffic to be mixed up.

Since both network shares the same internet connection. how can I isolate these two networks?

I appreciate any advice on this.

Improve this question
1
  • From Tim_Stewart: Cisco routers and switches are VLAN capable. If your router is newer then 2004 most likely it supports it. What kind of switches do you have? Cisco small business switches are relatively cheap and support what you are trying to do. Are these managed switches? I.e do they have console access? If they don't you should probably replace them anyway. Model numbers would help here!
    – fixer1234
    Jan 20, 2018 at 1:19

2 Answers 2

Reset to default
1

As long as your IP addresses are well defined you may not have any collisions, but a good approach may be using subnet masks and ACLs on the router so that traffic from one subnet has no access to traffic of the other subnet. I only know how to configure ACLs on cisco routers so if it's another brand I can't help you very much. But subnetting can be used on (almost) any router, you just have to set up your network like this:

Subnet A

Gateway: 192.168.1.127 and subnet 255.255.255.128

Only IPs in the range of .1 up to .127 will have direct access between them.

Subnet B

Gateway: 192.168.1.254 and subnet 255.255.255.128

Likewise, only IPs in the range of .129 up to .254 will have direct access between them.

If any computer inside Subnet A wants to communicate with any computer inside the Subnet B they'll have to pass through the router, and that's where ACLs come into action, they may block or let access for certain IPs or block any IP of a certain subnet completely.

Of course the swicthes must connect to different ethernet ports of the router (each one is the respective gateway for each subnet, the router must let you specify an IP address for each port), otherwise you must implement VLANs and use a trunk port to connect.

I'm a little too rusty now regarding networking but I hope this helps you.

Good luck.

Improve this answer
9
  • great advice, I will look more into ACL, I'm using CISCO 857-K9 router. I want to ask, why IPs in the range of .129 up to .254 have direct access between them?
    – ETAN
    May 31, 2014 at 9:28
  • For direct access I mean that they don't have to pass through the router to communicate since they're in the same subnet and they're under the same broadcast domain.
    – arielnmz
    May 31, 2014 at 9:33
  • Because they are in the smell subnet range. It's the nature of the addressing system.
    – Kinnectus
    May 31, 2014 at 9:35
  • Oh, sorry I misunderstood, thanks.do you have any tutorials I can use for setting ACL for this scenario?
    – ETAN
    May 31, 2014 at 9:35
  • It's just a basic ACL configuration where all communication coming from a certain subnet is blocked. Any tutorial or basic ACL guide would serve you well. And I'm on my phone right now.
    – arielnmz
    May 31, 2014 at 9:37
1

You should look into using VLANs. Can your router do this? It can create two or more logical networks that are completely separated from one another. The two VLANs should have different subnets so one network cannot connect to devices on the other.

An example device that can do VLANs at a reasonable price (it can do wifi and ethernet VLANs) is a DrayTek Vigor 2920n. For a small business this is OK.

If your have an Active Directory (Windows Server) on your network then this should be used to provide DHCP to your office network. Your guest network should be separated from this network completely.

Improve this answer
1
  • is there any cons of using VLANs? will it require to have a higher end router?
    – ETAN
    May 31, 2014 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .