Inexpensive Budget Switch: TP Link TL-SG108E HW Rev. 3.0 With VLANS & pfsense Review

[@ronaldbarr1678]

The money shot!! 16 minute mark As a holder of an expired CCNP I credit you for reorienting my understanding about Tag vs Untag. My assumptions were the reverse After hours of frustration as to why I was not receiving an IP address from my firewall through my Netgear mini switch - and watching multiple videos : YOU were the only presenter to “nail it” Tag ports forward trunked VLAN tags between switches. Untag ports - are Members of the VLAN but strip the tag off because , IE: most people do not set the VLAN ID on their Windows NIC, so the tag would prohibit connectivity. You should do a new video specifically hammering home this point. Because Multi-Vendor VLAN trunking is a humbling experience Thank you sir!!

[@MikkoRantalainen]

If you ever need to debug network problems like this, learn to use `tcpdump -e -vvv` and you can use wireshark as the GUI. I had to connect our server to our corporate network and the guy maintaining the switches accidentally had marked our port as untagged (terminology between vendors is practically random) and I was inspecting the outgoing packets to verify that we tagged the traffic correctly so the problem must be at the another end.

[@pygmaelion]

In the past 5 years, nobody has made as comprehensive a video to describe the interconnection between these two exact devices. At least I know that I'm doing the same things someone else did, even if they aren't working. Cheers!

[@pygmaelion]

And 30 minutes later, I found the part of the video where you specifically talk about PVID settings on the switch AND on the NetGate. You're a pre-covid hero, riding out of the past to heal the networks of admins yet to ride.

[@Appelible]

You are the best. I've been struggling to set VLANs up for my home network, and you explained it so clear. "Tagged ports are for smart devices, untagged are for dumb devices" What a genius!

[@bodstrup]

Tom that ‘odd’ cable test says ‘cable fault’. It is there to tell you the distance to a cable fault = broken cable. Gives you an indication on where to examine your walls/cable trays if you loose connection. Like when someone two rooms away decided to drill a whole right where there is a hidden cable channel. behind the plaster wall.

[@SpazHeadSlotVideos]

Thanks Lawrence for posting these videos, this one help me understand VLAN's, and tagged and untagged. Now I have my WIFI on a different VLAN and my Security system on another VLAN.

[@GiorgioAresu]

Thanks for these guides/tutorials/reviews that do not stop at showing the product but actually show the configuration and how to do stuff with pfsense :)

[@ILikeZerg]

I bought one of these to start messing with vlans a couple weeks ago and couldnt figure it out haha you are the only person to have made this video in the last 6 years. so thank you

[@benjaminjames7856]

Thanks for this video, and many of your others too. Im a 100% network noob and 6 weeks after buying a protectli vault for pfsense I still can’t get it working properly and am certain my network is still compromised. None of my slow and painful progress would have been possible without your videos, so once again, Thank you

[@DGTubbs]

Thank you very much! This was succinct and comprehensive. It was also relevant easy to understand. I have Network Chuck, but I've also been looking to add some other quality channels who discuss networking. I look forward to more videos from you.

[@Sapious1]

I just stumbled upon on of these with 4 port POE, appreciate the review and security comments.

[@donireland6218]

Thanks for this video. I have the 5 port version and was having an impossible time getting it set up to use VLANs. I was even working with their tech support and they weren't able to communicate how to get it working. Followed your video and had it working in 5 minutes.

[@arXiv76]

White glove service, my favorite. Thanks for the break down, I was looking at this device.

[@dkode80]

Thank you for the clear example with hardware. This is the first video where I had an ah-hah moment with us tagged/tagged options as I have this switch and was going to start to configure for vlan traffic

[@lmaoroflcopter]

Time domain reflectometery. That's what the faulty line test is doing to determine the length of the broken/open cable. Very very cool feature to be included in the switch. Send a pulse down the cable, time the reflected signal and analyse the phase. A shorted cable, would be inverted. An open cable would not be.

[@bryanarnold8543]

Wow. You're dropping some knowledge here. Sounds like you've worked with low voltage wiring quite a bit.

[@timrobertson8242]

A while back I had the management bleed over problem described and where I had the switch made this a deal breaker. Today, I upgraded the Firmware (I have V3 hardware revision) because I was encouraged by the bug fix text. After wrestling with the .1q VLAN interface, I was able to eliminate access to the MGMT web interface on the non-Default VLAN! The key was assigning the Port as untagged on the new VLAN (add/update button), then removing VLAN 1 from that Port (add/update button) followed by Apply.

[@defilogic6726]

oh. good advice! I will have to try that!

[@TheCoolLama]

Nah, I don't believe that. I got the v5 with latest firmware and still can access management interface from any vlan (even when no ports use default/native vlan1). I just tested it. I checked forums discussing this issue from several years back until now still active (@ netgear forum) and problem is still there for v3 as well. You probably didn't test using same subnet as management, do this and report back. I dare to bet you can still access it.

[@timrobertson8242]

I tested again and you appear to be correct. I have replaced my TP-Link with a D-link DGS-1100 that has an explicit lock down of the MGMT.

[@TheCoolLama]

@@timrobertson8242Thanks for getting back to me so fast. I never heard of the D-link DGS-1100, but I've checked it quickly and it seems this should work from the datasheet and documentation, as you can specify the management interface's vlan under L2 features, so thank you very much for your fast reply, as this managed switch doesn't cost that much more than the tplink and netgear with their security flaws, so I've it on my list to order next (always looking for affordable managed switches that don't break the bank), excellent!

[@Khundire]

I have a TL-SG108E v4.0 but not using VLANs at all (for the time being) and after seeing this video I also wanted to confirm this Admin webUI "leak". The first thing that crossed my mind is precisely that in the video ou keep Default VLAN1 on ALL ports (1-8). I went to my switch, added port 7 to another VLAN, removed port 7 from Default et voilá. No access to webUI (like supposed to). I have seen this comment being repeated all over youtube (other channels) and I would even consider buying another brand Zyxel if it wasn't the fact of already having this little TL-SG108E and being able to test it on the spot.

[@jamesmaine8438]

Love your videos..New to VLANS and your videos give me ahead start...Was able to get my SSID's on different VLANS :)

[@jeffcloninger8725]

No kidding 2 weeks ago I set up my first home pfSense box with this switch and my first unifi ap's. You're running about a week behind when i need you lately! Thanks much though, love the videos.

[@BillZUpZBdZ]

Thanks for this!! Couldn't get an ip assigned because I had the ports tagged wrong. This video helped me get everything working!!

[@red94mr28]

I believe you're able to ping the management interface (21:10) because you left ports 7 & 8 as members of VLAN ID 1. You can see this at 18:50 where you typed in "1" for the VLAN ID making it editable, you can see that ports 7 & 8 are defined as members of the management interface (VLAN 1). You should have removed ports 7 & 8 by clicking the radio buttons for each in the "Not Member" column thus removing them as members of the management interface (VLAN 1). But maybe the firmware at the time (6 years ago) didn't allow it.

[@tobiasputmanphotography5]

I have an 8 port PoE (TL-SG2210P) in my homelab for AP's and VoIP phone and for that it's excellent. It's a little higher end than that one I believe, really like it for home use. Would not put in in a corporate network. Liked the review! Nice overview and very complete. 10/10 for shiny box!

[@zyghom]

21:00 I don't think you are right with saying that when you computer is connected to port 8, switch should prevent your computer to get IP from another subnet - if I am not mistaken, switch has nothing to do with your IP - especially if you set it up manually. What swicht did however is: it blocked you from being able to ping from 1.9 to 1.1 when you were connected to VLAN 30 port. Just saying and maybe I am wrong but switch has nothing to say about which IP you set up manually on your end device.

[@hottroddinn]

Many, many great videos, Lawrence. I think the last combination video to do is have this switch work ESXi where the VLANs are configured on the switch and the firewall is giving out IPs from the DHCP server running on it and the VMs getting them. That's going to be the ultimate video **chef's kiss**

[@rrpedrigal]

Hi Tom, thanks for this. I'm really strungling with setting up unraid, pfsense vm on unraid and this top link switch. I understand now. Thank you. *subscribed*

[@aguyandhiscomputer]

Love how you open the cases. Something I never do but should try sometime.

[@guvanch.o]

Thanks, dude! Successfully configured 2 WLAN & LAN for pfsense with just two NICs.

[@lages5kram]

It seems that port 7 and 8 are "untagged" for both vlan 1 and 30. That might be the reason you can ping 192.168.1.2. Try to mark port 7 and 8 as "non-member" for vlan 1 to see what will happen.

[@Printcrashrepeat]

I'd like to know the same thing, or move management to another vlan besides 1.

[@schossel]

I have a Zyxel switch and that was my first thought, too. It's the same there, you set your pvid etc. but if you don't want the default net to be able to reach the management, you have to unmember VLAN 1 for these ports. I think this is a universal thing and nothing special or is it? As far as I know, Zyxel even mentions this either in the manual or in one of their youtube videos.

[@timstallard468]

I'm not familiar with this exact switch, but it appears to be very similar to the equivalent Netgear product (the GS108Ev3), and I suspect it may use the same chip. On the Netgear at least, the management interface is available on any untagged port, regardless of the pvid and tagged/untagged setting on VLAN1. This also means that ethernet frames with a VLAN tag of 1 will not be treated as management traffic, which can cause issues if you intend to tag all of your VLANs on a link back to a router and then manage the switch from another VLAN, for example. You end up having to leave VLAN 1 (or whatever is your management vlan) untagged, and every other VLAN tagged. I ended up replacing that with a GS108Tv2, which has support for management on a VLAN, SNMP, 802.1x etc as mentioned in another comment.

[@GavinPeters]

It makes no sense to me to be able to have more than one untagged VLAN on a port. However I agree that the Management access 'issue' is linked to this.

[@IvanHall03041986]

I know that you are right, I had the same issue occur on a netgear - if you have multiple untags, it actually bBRIDGES the vlans _ i was super confused until I remembered it wasnt a fully managed switch. where ACCESS/UNTAGGED explicitly means only = 1 vlan on the interface

[@wilikikilika]

Thanks for an easy to watch quick review, just what I was looking for, a managed switch to play with VLANs at home.

[@hannesogrady8920]

FYI. On the cable test. If your plugged in LAN Cable that has any broken strands then it will show up under cable fault. It tells you how far down the cable length you will find the broken aria so you can fix it. That is why it does not show under the cable fault when a working cable is plugged in.

[@PankajSharma-ir7fb]

Finally someone got the logic behind it.

[@SubliminalChaos]

Thank you for the video! You give very good instructions and are easy to understand. I have brain damage and brain cancer and could follow your instructions perfectly. Again, thank you!

[@demabkr]

The NETGEAR GS308E VLAN config works the same way like this. I tried everywhere and could not figure it out. This video was very helpful.

[@cornellrpgdrums]

i have the same netgear sw and unable to do vlans, did you find a way?

[@demabkr]

@@cornellrpgdrums yes I did.

[@wiebowesterhof]

Thanks for the review. It is a very basic looking, but reliable, low power use, bit of gear. I've used it mainly in bedrooms where I just wanted to run a single connection up to the main stack, but have a few drops in a bedroom, one for IOT like a FireTV, another for connecting a printer, another for laptop or other networked stuff. In LATAM, this model plus the unmanaged 24 port GBit switches are pretty popular, with DLink often used for managed switches at 3x the cost. Not ever had a problem, and the firmware has received updates over time. I agree with you that I probably wouldn't put this into a massive network, but for a smaller setup, these things would do the job. As they have no fans and are fairly temperature-robust, they are probably ideal for a small install that needs a VOIP and non-VOIP VLAN, perhaps a wifi for guests. I still have to set up my VLANs at home to do the IOT VLAN with the EdgeRouter Pro I have, but I need to plan that out beforehand. Appreciate you guys making videos and sharing your knowledge.

[@GriffVicious]

still watching the video, only a minute in just purchased this myself a few days ago. From what I can tell so far is that they seem to have taken your review to heart and the box is no longer shiny

[@staaldak]

18:27 Personally I dont think you found a flaw. You misconfigured your vlans. Ports 7 and 8 are also avliable in vlan 1. Go back to your vlan settings, select vlan 1 and set ports 7 and 8 as 'not member' and save. Problem solved. And i am not even an IT specialist, just a hobbyist who prefers setting things up myself as opposed to hiring so called network specialists who miss these details.

[@thedosiusdreamtwister1546]

Untagged traffic defaults to VLAN 1. So does all of your layer 2 control traffic. It's defined in the specification and covered on both the CCNA and Net+ certifications.

[@SomeTechGuy666]

So this switch is not suitable for connecting PCs to directly ? PCs generally send untagged packets. All untagged packets go to the VLAN1 group, which is every port on the switch ? Or how does that work ?

[@skampp]

I know this is an old video, but I enjoyed watching it. Primo content. Thank you sir.

[@RipVanWinkle_Nature_Discovery]

VLAN1 is your default vlan and is enabled when you first create your vlans on the switch. You cannot delete VLAN1 but you can disable it (for security reasons) Works similar to cisco. If you've worked with cisco switches, its not an odd behavior. What is odd though, is that there's no security settings to access the management port. Good breakdown of the switch and thanks for the demo.

[@RipVanWinkle_Nature_Discovery]

@@DistantComputer Have you tried creating other vlans? For ex: VLAN10 or any other number? Make the new vlan you created the default vlan. Remove vlan1 from any prots. Then it's basically disabled.

[@RipVanWinkle_Nature_Discovery]

@@DistantComputer Glad you found it.

[@Wahinies]

The TL-SG1024PE I had configured did not allow removing vlan1 membership of any ports. When consulted, tplink said this was an antilockout feature.

[@Serwer-v3e]

A and he thought he had discovered America! Vlan 1 is crucial here

[@genxguy]

Great video! Really liked your description of tags vs untangled...network engineer myself but its been 15 or so years so I have forgotten a few things :)

[@zenanon7169]

Thanks...this really helped...the PVID part was what I was missing....for home vlans.

[@mattaylor5817]

Brilliant video ... you unpicked the weird ui that was confusing the hell out of me.

[@GrollerG]

I'm not sure if I got this right but in plain terms use TAG for a port if you plan to plug in another switch in that port so the second switch will receive the tagged traffic from the first switch. Use UNTAG for a port if you plug a printer, PC, MAC, ikea controller, etc in that port. Ive set up two vlans in my pfsense 20 and 40 and my PC and mac were getting normal ips .1.10 and.1.11 from pfsense instead of the range allocated in the 20 and 40 vlan. I've set the TAG option for their ports and I didn't understand why the vlans are not working. In all the examples people use virtual machines and those seem to work out of the box and I didn't understand what am I doing wrong. so thanks for this clarification video.

[@JeffHiggins]

I have the Netgear GS108Tv2, the hardware is almost identical, it definitly uses the exact same case, but it does offer a LOT more features in the software, a lot of things you will find on an enterprise switch, things like LLDP, SNMP, STP, 802.1x, ACLs, etc., it does cost a little more though, $70 on Amazon, so it's up to you if you want to spend the extra $30 for more features. I do kinda have it running in an enterprise environment, but as an R&D switch and not as the main switch, it's been running reliably for many years now.

[@BillyDickson]

Jeff Higgins I use the same switch at home, works a treat when combined with a Ubiquiti wireless access point and a pfSense router (Separate SSID and VLAN’s)

[@rajilsaraswat9763]

Jeff Higgins Can you assign a management vlan on it?

[@JeffHiggins]

I just double checked and yes you can.

[@koobydotnet]

I have two of these, the v1 and v2. Every 3 months, VLANs would stop being tagged which is extremely frustrating. I contacted support and they recommended updating the firmware but seeing as it takes 3 months for the issue to occur again, I cannot be bothered. Maybe I can try updating and set up a test bed but I just need my VLAN tags to work because if I am not home and I am trying to access something remotely to which the bug occurs, it sucks. I have a GS724T though and it's practically flawless.

[@koobydotnet]

Moreover, I had Netgear support check the firmware update logs and there's no mention of this issue.

[@Dang_Jim]

I use their 8 port non-managed gigabit switch and it has been working extremely well!

[@pratwurschtgulasch6662]

i would not even bother with unmanaged switches these days, the cost is about the same but you get so much more out of a managed switch, just saying.

[@timkosem3521]

Oh, man, my Netgear ProSafe "Smart Managed" GS116Ev2 has the same issue with the web management. It runs straight HTTP like the TP Link you reviewed; and I was able to connect to the web console from a different VLAN than the one hosting the switch's IP address like you did by just mapping a static IP address in the same range as the switch. Doh. For the moment I guess I'll have to make sure that my admin password (with no user id, BTW), is as complex as I can make it. Thanks for pointing out this deficiency in SOHO VLAN switches!

[@alexd5637]

It is common for switches without "management vlan" option to allow traffic to the management IP on all vlans. It is more of a feature, especially for an office switch. Even when the pvid of 1 is not there .. It could be worse, you could have a Catalyst that forwards any traffic with destination port 179 to the management CPU.. That is fun ..

[@Khundire]

To my understanding Default VLAN is the one that gives access to Admin WebUI. It sort of makes sense to not be able to removed it but you can configure it and limit which ports have access to WebUI. From the other small business/home switches I have seen so far I would still go with TL-SG108E.

[@tims]

Thanks L-man! This is exactly what I was looking for to separate my IOT and guest networks from my main lan.

[@williamlau7179]

Ya, good features and effective

[@RD4888]

I purchased a pre loaded pfsense box and I want to access it Lan port with a laptop. How do I connect

[@populistparty2010]

Excellent review...just the right length and content. I was just about ready to purchase until you talked about the security vulnerabilities. This probably is still just fine for my application (home network), for the price, and for the time being.

[@Greylegato]

Thank you, this really helped me make a decision on what to do in my home network.

[@Bradley-Thomsen]

Shout out to you from a Solarwinds Engineer! Just noticed your sticker!!

[@LAWRENCESYSTEMS]

Hello there!

[@mikebroom1866]

Just picked the 4xPoE version up for a wireless bridge to detached garage with AC LR +2 PoE cameras. Thanks!

[@DozeDaGrove]

I use these switches...they work great for me. But regarding your "VLAN hopping" comment at 24:22...you have the switch misconfigured. Untagged ports should ONLY be in 1x VLAN and under "Untagged Ports" column (and NOT in Tagged Ports column). Tagged ports should ONLY show up in the "Tagged Ports" column (possibly multiple times for each VLAN the trunk is carrying). For "UntaggedPorts", the PVID MUST match the VLAN of that port (There is no ambiguity as untagged ports only should be configured with 1x VLAN). PVID determines what VLAN tag to associate with untagged port traffic. For trunks, the PVID still has to be configured...the reality is no UNTAGGED traffic should exist on a trunk (unless somebody messed up)...but have to put something...in my case, I tag it with an unused/unrouted VLAN. I agree the UI could be improved...but it is what it is. I actually have very similar configuration with pfSense, tp-link switches and unifi-ap...works flawlessly regarding "who can get to what".

[@RottieHaven]

Sorry for my ignorance, just a noob trying to digest your statement above - for untagged ports (let's say a hardwired PC) are you saying that it should be defined as untagged on VLAN 1 (system-vlan) only, with the PVID set to the correct VLAN assigned for it? Rather than, like in this video, it being untagged on the VLAN it's assigned to + the PVID set to the VLAN it's assigned to?

[@shafeisharif7800]

I have learnt so much from you. Thank you

[@globalcharts369]

21:05 normally tplink Devices has the setting in management console to disable the ping to the device. a bit late to party.

[@tommajor2940]

I would think that if you un-assign ports 7 & 8 from the default VLAN (1) you might not be able to connect to that network with a static IP address from ports 7 & 8. Unless of course your static IP address is on the 30 subnet that last comment does not apply.

[@SamLivingLife]

I was thinking the same thing. Seems that the ports 7 and 8 are on both untagged vlans. The screen at 16:00 shows ports 7 and 8 as untagged on both vlans.

[@nukedathlonman]

I'm a little surprised by that - D-Links DGS1100-08 (rev B1) doesn't have https support, but it's very good when it comes to being able to lock out the administration stuff from untrusted sources. I just don't like how limited the D-link is in it's setup (no lag support, but does have trunk aggregation support, but too many limits on configurations like vlans, and some other really confusing things in it's interface if your looking to set up physical port security, etc). It's not bad, but I out grew it extremely fast. Of the budget switches, it's def a step up in price, but honestly for small soho style managed switches for small networks, I find Netgears tiny GS108T (V2) switch to be a real gem. Anyways, thanks for the review!

[@VirendraBG]

10:10 Have you tested Link Aggregation with Synology NAS? (DS 918+ etc.) with this switch?

[@adrianTNT]

0:56 I like to see plain brown cardboard when I buy something, that tells me I paid for the actual product inside and didn't pay for fancy boxes, carring pouch, and so on. Some people feel special when they buy something with a "premium" feel box, something is wrong with them :)

[@ChadAmI80]

I agree. I also own a small manufacturing/retail business and our biggest product expense is packaging. Shiny costs $$$. When I'm looking for network gear I want the most plain jane box possible. No need to waste even $1 on a box.

[@UNcommonSenseAUS]

yes, fools are often overly impressed by shiny things... look at a certian "demographic" that like chrome wheels, diamond "teef" gold chains, big asses, blinged out "gats" and double digit iq's simple things entertain simple minds

[@MikkoRantalainen]

If you connect this device to router with DHCP, it will use whatever IP the router assigns to it. I think dot-one is perfectly fine for out of box configuration for offline configuration (which is the only safe way to configure things like this anyway).

[@alphabanks]

Great video I have been using one of these for a while now so far so good. They also make a poe version that I plan on buying.

[@Wahinies]

I am generally happy with these but I had gotten the 24-port PoE model for a project and found a couple of disturbing things. There was not anywhere to change management VLAN or default from PVID1 and to top it off the switch would allow access from any VLAN *and* someone had found that ALL MANAGEMENT TRAFFIC WAS BROADCASTED ... in all VLANs (wtf?). Ive yet to verify that one but if securing management interface is important, look at equivalent Zyxel or Netgear switches. Then it would not accept alphanumeric characters into login passwords (I hate it when devices don't allow that)

[@marcschweiz]

So informative and the explanations were clear. Thank you!

[@luismarrero9293]

Yes the naming also said sg1 which means unmanaged the e at the end means easy manage which allow you to see some features web base task but it is not manage switch . Good video anyway

[@rabbitcreative]

Love that "Rage against the virtual machine" sticker. :) My 10-year-old Dell 610 whomps on almost every hosted VM I've played with.

[@2acsharp]

I have two of those same switch. One is attached to the firewall with several devices in the livingroom and the second is in my office fed off one of the livingroom ports. How do I set the livingroom switch to trunk the VLAN's to the office and then how do I set the uplink port in the office to provide the VLAN's to the office? I cannot figure out how to push the VLAN's between the switches.

[@davidstievenard6313]

it seems that 8021q pvid vlan settings is something cisco refers as "native vlan" = the vlan that will not be tagged in a trunk port

[@son_go_ma]

This can be a little confusing because terms vary from manufacturer / switch software indeed. Afaik, it's security *gospel* that "VLAN Trunk ports should NEVER be on the native VLAN 1" (by "be on a native VLAN 'x'" we mean their PVID 'x' here), and as a corollary *"Thou shall NOT use native VLAN 1 for anything in prod."* Basically, the underlying idea is that Native VLAN 1 (this means, NO VLAN, it's the default / untagged VLAN) is insecure as an attacker reaching the switch would either reach it untagged or be able to untag itself from any VLAN header. This is why neither data (traffic passing through the switch) nor management (traffic aimed at administrating the switch) should ever be on VLAN 1. Obviously, neither should a trunk port. So take away, compared to Tom's video, where the Trunk to pfSense is Port 1: - PVID for this port should be some VLAN =/= 1, e.g. VLAN 10 named "LAN". - By extension, you'd put all the other used ports PVID to this "base" VLAN 10, and add them as "untagged" for VLAN 10 (do NOT add trunk ports to untagged anything otherwise you "break" the trunk on entry; only tagged traffic goes into trunk ports). This would ensure that all machines connected to the switch are on VLAN 10, never 1. Including pfSense and the Wi-Fi station, which would communicate over VLAN 10, not 1 (for instance if the wifi AP is set to DHCP for its own address, it would get an IP from pfSense's interface on VLAN 10 by default, since port 4 where it's connected, a trunk port, has PVID 10 by default). This means all ARP traffic, DNS, ICMPv6 etc is *always* on some VLAN, 10 by default, another one if specified. ____ You can go 1 step further for security. The management port (should you dedicate one) and IP of the switch itself could be entirely segregated, e.g. port 5 on VLAN 55 (no interference between "data" and "management" traffic, the latter (VLAN 55) never goes into data trunks (VLANs 10, 20, 30, etc). Such a setup is easy and doable with this $40 switch. It's imho the next best thing after "out-of-band" i.e. physically different network for management, using a dedicated VLAN and never sharing ports (you're just "spending" 1 port per switch or router for this. I think it's worth it in terms of security because unprotected switches seem like a low-hanging fruit for hacking bots afaik.

[@keithpetrino]

It's my understanding that LAG only reduces congestion by allowing for more simultaneous transmissions. It does not increase speed.

[@techno_john]

Would love to see you review the DLink DGS-1100-08... It's going for about $35 as of this post, but has quite a few more settings than this does. I picked up one of those for my little home lab and it works GREAT, and the VLAN setup is much more sane.

[@drtweak87]

Been using these switches for yeeaaaars for small 5 and 8 port switches (Usually just get 8 as they are like 10 bucks more than the 5) and never had an issue ever with them! Probably used a hundred of them.

[@MarkHimsley]

Seems to be very similar to the Netgear GS108T, although the GS108T seems to have more features. The TP Link SG108E has very similar features and a more simple user-interface compared to the GS108T. The LAG, QOS and VLAN configuration is almost identical - including the VLAN and PVID settings being on two pages - which means it's super easy to lock yourself out of the switch. But the enhancements on the GS108T includes allowing you to set the VLAN that the management interface is on, which is one security issue you found on the SG108E.

[@Max34557]

I personally use this switch. It’s very good for the money, but the only thing that bothers me is that the management page is accessible from every VLAN.

[@christinolian4972]

that is manage switch? Why the box say Unmanaged ?

[@sitte24]

@@christinolian4972 because names come from the marketing team and they just don't know anything...

[@christinolian4972]

@@sitte24 Thanks

[@mattbunce2509]

I use a similar Netgear VLAN capable switch in conjunction with a SINGLE PORT pfSense server. I then use the following VLAN assignment: VLAN1 (native): LAN VLAN2: WAN VLAN3: Private VLAN4: Public (untrusted devices) VLAN5: VOIP (QOS Priority) There will obviously be some bottlenecks, but with my 50mbps WAN connection it's not something worth worrying about and it can save you buying an additional NIC for the server.

[@spatt833]

Thanks, what's the model number?

[@fearlessknight1343]

Pretty helpful, still kinda confusing the way the GUI is represented. I always thought "Tagged" Vlans are for Vlans you want specific traffic passed through (Vlan30/40/50), whereas "Untagged" is basically any traffic being passed through. ....Guess not. :/ I have 2 of these. 1 connected to my Palo Alto FW and the other in my living room.

[@Undertoedm]

Easy way to remember, tagged means it carries the VLAN ID to the next hop. Untagged means it strips the ID so it's just traffic on the subnet.

[@shanesdiy]

I have an application where I'd like to have devices, lets say 4 devices, set for DHCP each plugged into its own port on a switch/DHCP router and it would be the only device on that port. I would like any DHCP device I plug in to a specific port to always get assigned the same IP address from that port. Essentially, I need to be able to set the DHCP range to a single IP address per port and all devices need to be able to talk to each other between ports. Can I do this with this switch, or comparable, using VLANs and DHCP? If not, what budget friendly device would allow me to do this? Hopefully my desired application description made sense.

[@jvianneyjr]

Hello, I have an sg105E. I'm trying to configure the vlan. Port 1 ISP unttaged. I want to create two vlans the first one on port 2 and 3 and second one in ports 4 and 5 . Both vlans access the internet but the computer in one vlan cannot access the computer in the other vlan. I tried several ways, either one vlan loses internet or computers from different vlans fill up. Do you have any idea what I did wrong and how to do it? Thank you!

[@slaps1]

Nice security discovery at the end there. Worrying yes, I guess but it is ok for a home network.

[@Grand_Alchemist]

How do you actually get the vlans to communicate? I have vlan 1 / port 1 connected to my pfsense router, vlan 11 as my workstation and vlan 12 as my access point. From vlan 11, i cannot access the web interface of vlan 12. I have setup the vlans and firewall rules correctly in pfsense.

[@onlycodered]

I’ve had ver2.0 of this switch for years now. It’s work great and has never given me any issues. Only thing I don’t like it the lack of web-based management GUI but unless you’re reconfiguring it often the Windows-based software is fine.

[@megamaser]

What? He uses the web based management gui in this video.

[@geraldh.8047]

@@megamaser that’s why Jared wrote he owns v2.0 and this review is of version v3.0.

[@linuxdork]

ugh! it was that freaking PVID setting that borked it all. THANK YOU!!!

[@JPEaglesandKatz]

Seems they totally removed the running config/save config settings from later versions of this switch.. It is gone.. Got me into a lot of trouble at times... Having to actually completely reset because of locking myself out of vlan.. last known/saving is gone.

[@davidsteckley8846]

Lag. So can you lag ports 1 and 2. Both of those lines go to the router as redundancy?

[@MrSuperpuss]

Question, I got a TP-link TL-WA1201 access point that supports VLAN. I was assuming it would just work out the box without anything else. Now I think I actually need a switch to configure the VLAN protocols. If I purchase the TP-link TL-SG108PE V3 switch, will I be able to successfully set up a VLAN network/wireless network without anything extra like a Pfsense? Currently have : ISP Router/Modem >> TP-link Acces point.

[@WeiserMaster3]

The management interface is weird though, you can't set on which VLAN it listens. So if you would have it between your router and modem for VLAN tagging, and have it pull its IP from DHCP, it could actually get a internet routable IP adress from your ISP. Or did I miss something obvious? Either way, I just set it to static. It's reachable without problems over HTTP/S, but the ICMP based monitoring is a bit flakey.. But for 30-40 bucks a no brainer. Works great.

[@screenieman]

I have one and it runs really well and stable. Features I use - VLAN, Static LAGG.

[@AcidAlexx]

Towards the end of the video I tried to vlan hop as well. Maybe they patched it? I can't ping the IP or get to the web interface configuration page like you did on port 8 with your laptop.

[@mrlithium69]

Awesome. ive been looking for something managed and very cheap. Great that it has LAGG and VLAN and QOS. I will be buying one of these. To use between my PFSense and FreeNAS boxes and my desktop. That way all 3 can have 2 connections, and still have 2 ports for the rest of my network

[@mrlithium69]

Also, Subbed. Nice to see a fellow networking geek. You really seem to know your stuff

[@James_Knott]

Some TP-Link managed switches have problems with VLANs. Multicasts can leak from VLAN 1 to other VLANs. I have the same problem with my TP-Link TL-WA901N access point.

[@matthewbennett2844]

Probably a stupid question but if your having multiple dhcp pools for vlans. What IP addresses should you use for the AP, would they come under management VLANS? So for example if I had 192.168.10.0 network for management would I set IP address on ap part of that network.

[@scottsingh2123]

Thanks mate! the video is way less complex than all other out there.

[@olivernote9162]

I bought one at Fry's Electronics for just under $20 on sale with my employee discount. They are really cheap switches.

[@andre1987eph]

I remember Fry’s

[@miroslavpaulovic17]

for home network is better this switch TL-SG108E or TL-SG1008P? First one is cheaper - 28 euros, second - 57 euros. desktop model looks better and ports are in back, which is better too, but doesnt have easy smart function....

[@Labs51Research]

the issue with 192.168.1.9 being able to ping the man interface is a feature called untagged management found in a lot of switches.. most only work in the first port.

[@MadMike78]

The unmanaged switch seems to have a few things you can manage lol

[@paulconnelly9206]

Very nice video! Almost perfect for my needs.😎

[@homeaccount344]

Great video as usual Tom..

[@josevalenzuela3680]

I know this is old, so I am going to apologize beforehand about bringing this up again. I tried setting the VLANs just as you mentioned here (I had one of these with hardware V.4 used as a dumb switch) but the moment I set port 1 (from my PFSense) to VLAN 55 Tagged and Port 8 to VLAN 55 Untagged (that's my Wyze cam outdoor hub) every VLAN stopped working on my Aruba AP 22s, they all lost connection to the internet. I left all other port as "Not Member" just to test that port 8 would assign an IP to the Wyze hub, but that never took. Any suggestions? I'm completely lost here.

[@putudipayana841]

the cable fault distance would help to find broken cable (based on the length where it ended)

[@Perplexer1]

Why does it say "Unmanaged Pro" on the box if it's a managed "Easy Smart Switch" switch ?

[@christinolian4972]

I have the same question

[@tadejsadar7033]

Its confusing i agree

[@WatchfulListener]

Its not a smart switch. Thats the SE model. And I assume unmanaged because its just L2... I guess?

[@techguy3424]

Hamburger helper glove comes to mind.

[@bigg1587]

UH 87

[@BrianG61UK]

Quite similar to Netgear GS308E. I don't understand why you left port 7 & 8 as members of VLAN 1 set? I see that the device might be able to figure out for itself that VLAN 1 shouldn't go to ports 7 & 8 from the pvid value but I don't think you can assume that. It might, for instance, send tagged VLAN 1 to ports 7 & 8.

[@andreymozjuhin6220]

TP Link TL-SG108 V6 (I don't know how in smaller versions, I have 6) lacks the specified drawback that the ip of the web interface is available despite the firewall blocking. Currently, when blocking a subnet from the ip of the web interface, there is no access from the vlan to it.

[@TheCoolLama]

Bs, do you know how networks work?? Vlans work on L2, they completely bypass firewalls that work on L3 (like ip's). I can still reach it with inter-vlan setup few managed switches away, as that piece of shit is broadcasting itself on every port that even joe schmo can find with tp link's easy config tool... Maybe you reinvented the internet and you're also smarter than tp link engineers who designed this junk who confirmed this issue and that you should pay premium to get yourself a management vlan, because this sg108 is supposedly for network noobs to not lock themselves out, what a fallacy that is...