Network Virtual LANs (VLANs), Explained Simply (VLANs, Part 1)

Most of the videos and sites I've seen that explain VLANs make it way more complicated than it is. Here's a much simpler description of what they are and how they work.
Affordable switches with VLAN Capability:
TP-Link TL-SG108E 8-Port Easy Smart Switch - amzn.to/3UBq2wp
TL-SG108PE 8-Port Easy Smart PoE Switch - amzn.to/49etilV
TL-SG116E 16-Port Easy Smart Switch - amzn.to/3HTLR2J
NETGEAR GS108T - 8-Port Smart Switch - amzn.to/497LGwU
GS110TP - 10-Port PoE Smart Switch - amzn.to/48bEQ83
Zyxel GS1900-8 8-Port Managed Switch - amzn.to/3OFpW30
GS1900-8HP 8-Port Smart PoE Switch - amzn.to/3OCNmpM
DJP Discord Networking Discussion - djp.li/discordnetwork
--------------
Join this channel for behind-the-scenes, early access to videos, and more:
►KZbin: / @djp_video
►Patreon: / djprod
►Sign up for our video production management website:
www.crewaxis.com/pricing.php?...
As an Amazon Associate, I earn from qualifying purchases.
www.amazon.com/shop/dougjohns...
►Equipment Used for KZbin Videos - djp.li/ytequipment
----------
Follow us online!
►DJP Website - www.djprod.biz/
►Second KZbin Channel - djp.li/youtube2
►Email Mailing List - djp.li/email
►Discord Discussion Server: djp.li/discord
►Social Media Accounts - djp.li/social
►Partial Equipment List - djp.li/gear
►Free Production Tools - djp.li/tools

[@manprinsen8150]

I have been trying to understand vlans for so many years. This video is crazy good!!!!! Wonderful explanation! Thanks 🙏

[@user-zd8wf3pl5i]

I would like to say that this is the 4th time I have had to pull this video to understand VLANs. The video is amazing, the convention of tagging is confusing.

[@nickm8134]

Just wanted to say thanks for this - you saved me a lot of time and frustration with your very clear and simple explanations.

[@lapoubelle77]

I can't believe I finally found THE video!!! The way you explained VLANs going from the simplest/standard configuration to specific use cases, makes it crystal clear how all of this works. Thank you so much!

[@melasonos6132]

For real, I've watched at least 10 and this one made it click.

[@ShadwTrooper]

Ditto! Wish I saw this first. VERY HELPFUL!

[@zyghom]

I wanted to comment but since said 100% what I said... THANK YOU DOUG A LOT FOR MAKING IT THE EASY. I just expanded my local LAN and now I have 2 managed switches, 8x 1.5Gbps (ethernet) + 1x 10Gbps (fiber). I spent some time working on them to make them working. Then I found this video - it would probably save me kind of hours ;-)

[@RomainRiche]

Thank you very much for your video - many videos on this subject but this is the one and only one to watch to fully and easily understand how it works!!

[@joshenders]

I like the way you're using physical visual aids. Very clever.

[@jai-jaihadley1747]

Phenomenal! Watched a few times and now I've got it. Thank you

[@willyfox5597]

This is great to understand the concept of vlans, together with part 2. Awesome, thanks so much.

[@MajorisMons]

Thank you! This explanation was so simple that my caveman mind understood it from start to finish.

[@CyKoSyS]

THANK YOU! Your elementary explanations were exactly what I needed to wrap my head around vlans. I couldn’t digest the higher level tutorials on other channels because the narrator assumes the audience is at a higher level of understanding… which you just provided me. I appreciate your time spent to help us learn. I’m not into AV, but you’ve earned my follow.

[@thereisnojuanlikeme]

I was reading documentation on several websites and couldn't get a simple answer. You made this really easy to understand. Thank you so much!

[@lithgowlights859]

The most audio thing you did - gaffer taping the 2 switches together - love it. You really helped me understand the trunking side too, thanks

[@fekraagabtny2929]

thank you so much, this is the first time i understand tagged and untagged usage

[@NaturebyGus]

Finally a good video explaining the freaking tagged vs untagged. All clear now. Cheers.

[@fekraagabtny2929]

exactly, never understood usage of tagged and untagged until watching this video

[@pjqziggy]

Well done young fella! It wasn't Dark Magic after all.

[@theaudioroom2228]

Thank you Doug, you really have a great way of explaining things. Appreciate all your content.

[@Bijlsmaa]

This is exactly how my net TP-Link managed switch works! Awesome. Other vids make the concept clear, but this vid 'made the quarter drop' (let it sink in) as we say in The Netherlands. Now I finally get that the Untag en Tag feature tells what the switch does with internal packets going out of the port and PVID into the port.

[@palindrome8742]

This is such a great video, an excellent crash course intro "in-a-nutshell" illustration of what's going on with these devices. Thank you, Doug :)

[@kostasstigas]

It was realy hard to understand the whole consept of taging and vids of ports, the amazing thing is that you managed to explain the whole configuration of vlans in a very simple and easy way to understand. Thank you very much for sharing your knowledge in such an amazing way.

[@iamtemo]

This video was way better than all the other ones I saw. I mostly came in to ask about the PVID but you explain vlans better than the other videos. Thank you

[@glennosborne4555]

Great job explaining Vlans. Simple and effective method with clear talk through. Keep up the good work!

[@enregistreur]

This video is of perfect timing, as I'm just starting to redo my home network with some "smart" switches. Your explanations help *a lot*, thank you! :)

[@hugoshooter24]

Spectacular explanation,wish I’d have found it BEFORE my net+ and sec+ but great work! Mike Myers, Jason Dion and Professor Messer would be duly impressed!

[@batterynow]

Very nice! simple but actually explained something that I understand VLan ID, Trunking, Tag and Untag. You are wonderful. Thank you!

[@wm437]

I can't understand why people make videos on how to setup vlans for people who already know how to setup vlans.😡 Thank you for making a video for us noobs.😊

[@AM-dn4lk]

This was an excellent description of VLANs. Thank you.

[@peterthefoxx]

Such a good explanation of how they really work, I have been using VLANs for years but I still wanted to really understand it since some parts were a grey area still.

[@jules.marshall]

A great video, a colleague was asking about VLANS. Got them to watch this instead of me explaining it! Thank you.

[@romanlee8287]

Thanks DJ - the way you taught all that was super helpful!

[@claude77573]

Great video. I had to watch it several times and make flash cards in remnote to make sure I absorbed this information as well as I could! Now on to Part 2!

[@mahler2112]

I like this explanation. It's going to take a couple of more times watching but my brain didn't melt the first time lol.

[@Neolantis]

Thank you I've been looking for this exact video for 2 weeks

[@mru8056]

Love the way you explained it. This will help a lot of people . Good Job

[@AghoshBPrasad]

Amazing video on vlans!!! This is exactly whay we needed. Thankyou so much. Your explanantion is so clear, simple and to the point. Thank you

[@pavelbartosz8237]

I very appreciate this explanation about VLANs. Thank you!

[@fizmon3439]

Thank you Doug. I think I finally get it and I have watched a lot of videos. Great explanation.

[@CBSimien]

Hello. This video was extremely helpful, especially with the visuals. Thank you very much!

[@lloydburgher]

Thank you, Doug. Your explanation was concise and very easy to follow and understand

[@Tony-xc5sk]

That was the best explanation I've seen so far. I'm just gonna watch this a few more times if you don't mind. Lol.

[@nigelholland24]

Great video and clearly explained I think I get it more now.

[@Salute86]

Great explanation. Has become my go to video to revising VLans.

[@VicenteXimenez]

Thanks a lot Doug! I was really missing your videos...

[@SportFlow]

New video from Dough means hitting the like button and watching it immediately because it will be well worth it for sure

[@dreeastwood2500]

Thank you so much. You were very clear and easy to follow.

[@8510Entertainment]

Love the videos thanks for doing this!

[@dalesmith8666]

Very good explanation. I have two Avaya 4548GT-PWR switches on my property. One in my main cabin, an other located some distance away at my tower building, interconnected with fiber. Of course there are PC's in both structures, and in the main cabin, there is access to the internet, via the main switch to a router. As I wanted to send regular data and also some "audio over IP", at each end there are AudioScience asi6685 Live wire cards. I had a hell of a time trying to get this to work, as I'm sure you can appreciate! The solution is of course VLAN, but never having any experience with such, made it not so fun! So I did a search and came across you channel. It has made it clear to me, as how I can get this to work. You're explanations are simple and easy to understand....Many other channels, just over complicated the subject! LOL! Cheers.

[@RodJ58]

Thx for providing the Discord plug. Joined the server.

[@phatdpc]

This was great, thank you

[@austinmcloughlin8270]

Good stuff, Thank you!

[@powerstation8141]

i need to watch repeatly to understand it better , and it's one of the best and simple explanation video

[@Ecovictorian]

Great and helpful video!

[@jasonrock2804]

So I don't know anything about computers, networks or tech. However, I have been watching SEVERAL videos about all this stuff and found your video EXTREMELY helpful. However advanced this is, you made it understandable. Seems my home network doesn't need this level of sophistication...I feel like I want to do it anyways. Lol. Thanks that was great.

[@djp_video]

I'm glad the video helped to clarify things for you. Most people don't need this functionality... even when they think they might. It's a cool technology, but there are often simpler solutions that are much easier to comprehend, setup, and maintain.

[@AKLM24]

Very good explanation thank you

[@SomewhatAbnormal]

This is a great video! I think I may have to watch it several times so that it sinks in, but it’s the best I’ve seen so far. Beyond the paper, I think that real world examples with actual devices would be great!

[@djp_video]

This video was already pretty long... demonstrating with real devices would have made it dramatically longer. I have a second video in this series showing how to setup several brands of switches: kzbin.info/www/bejne/bmWlYZx5psablcU

[@SomewhatAbnormal]

@@djp_video I agree, the length was long, but informative nonetheless. I'll check out your other video as well. Thanks!

[@Hindsight101]

This was amazing thank you

[@bobkoss280]

I've watched a ton of videos about vlans. This one is the best.

[@djp_video]

Thank you! I tried to take a different but simpler approach

[@theminer49erz]

Thanks! I am about to finally embark on setting up a bigger home network and wanna split my main internet connection via VLAN. I knew a good but, but this helped me confirm what I thought and cook it all up. Will che kmout your configuration videos later when I'm closer to doing it.

[@brianwestfall8105]

Great video, Doug! You might could demo a practical example of this with your Starlink testing.

[@j00500hall]

Thank you! I was trying to explain what I was doing to someone and i couldn't find a way to do it without overloading them and seemingling making it confusing. I will definitely be using this method and refering back to this video to explain it if I fail.

[@smthsmth111]

it was helpful, thanks!

[@rolandoalmaguer]

Great Video

[@jimboelterdotcomm9153]

Very well done. Hosts on different vlans can't talk to each other. As simple as that. Thank you!

[@djp_video]

…unless you have a router to route data between them.

[@Scruit]

Have been struggling with trying to set up trunked vlans for over a full day simply because the online help and forum posts all say thing like "It's simple - VLAN tags are the tags you want to assign to a VLAN!". ORLY? This video explains it in a way that makes SO much more sense. To make sure I understood this correctly.... When a packet ARRIVES at a port: - If it does NOT have a vlan tag then the packet is allowed IN and is tagged with the port's PVID value. - If it already has a vlan tag that is in the port's TAG list then the packet is allowed IN and the tag is preserved. - If it already has a vlan tag that is NOT in the port's TAG list then packet is... (edited per feedback) handled differently on different switches. Some always drop, some always allowed, and some let the user configure what to do. Ideally, both sides of the link are configured to know which tags should be there. - The UNTAG setting is ignored. When a packet tries to DEPART from a port: - If it has a vlan tag that is n the port's UNTAG list then it will have the vlan tag removed and is allowed OUT. - If it has a vlan tag that is in the port's TAG list then the packet is allowed OUT and the tag is preserved. - If it has a vlan tag that is NOT in the port's tag list then packet (edited per feedback) would not have be directed to that port in the first place. - The PVID setting is ignored.

[@djp_video]

That's mostly right, with two small tweaks. #1: There's a piece that I intentionally didn't cover in this video, and that is how ingress (incoming) packets are handled. I wante to keep this video relatively simple. - Some switches do not filter incoming packets based on VLAN tag. So if a port is set to Untagged 1, Tagged 2, 3, and 4, and a packet tagged with VLAN 10 is received, it is still accepted and routed to ports which are members of VLAN 10. - Some switches do filter incoming packets. So a packet tagged with VLAN 5 is discarded/ignored. - Some switches let you choose whether to filter incoming packets or not. It depends on the model and how 'fancy' it is. But in practice it doesn't matter that much whether they filter ingress packets or not, since you're usually in control of the configuration of the device of the other end of that connection. #2: Outgoing packets aren't so much dropped when their tag doesn't match one of the untag/tag settings -- they just aren't directed to the port at all in the first place. The internal switching mechanism (why they are called 'switches' in the first place) knows that a packet isn't intended for a particular port based on its VLAN tag so it doesn't try to send it there. That's an important distinction because it prevents slowdowns if the total bandwidth of all VLANs within the switch exceeds what a single port can handle, filtering outgoing packets at the port would mean you wouldn't be able to use the full speed of the port. So if VLANs 1-5 each were receiving 250 Mbps of data, a port which is only included in VLANs 1-4 would (hypothetically) be able to output the combined 250+250+250+250 = 1 Gb of data rather than slowing down 20% by having to filter out the 250 Mbps from VLAN 5 -- the data for VLAN 5 just doesn't ever get directed to that port in the first place, if that makes sense. This means that switches can handle a lot more data than 1 Gbps. Each port can handle 1 Gbps, and the combined bandwidth of all ports and VLANs can be considerably higher. How much higher depends on the model of switch, but it's nice to know that we can get a lot more data through a switch than the rating of any one particular port.

[@Scruit]

@@djp_video Thank you for the clarifications, and I appreciate you taking the time to respond. Pojnt #1, regarding: "So if a port is set to Untagged 1, Tagged 2, 3, and 4, and a packet tagged with VLAN 10 is received, it is still accepted and routed to ports which are members of VLAN 5.: Did you mean to say "a packet tagged with VLAN 5"? Or is there an implicit relationship between 10 and 5? Point #2 is well made and understood. Part of my problem was I was trying to configure VLANs for the first time on network that spans 3 buildings, 8 managed switches, with laggs between each floor of each building, by configuring it all in one go and hoping it worked. As it turns out, my understanding of tag and untag settings was off just enough to doom me to failure. The fact that my switches don't seemingly provide any logging of what it did with a packet based upon vlan settings made troubleshooting impossible. After watching your video I decided to take the time to break it down and start small, successfully configure one switch based upon your advice, and build slowly upon each success by adding one switch at a time into the vlan configuration. I am making progress now and am well on the way to completing the configuration. Thank you again!

[@djp_video]

You caught my error. I had originally written VLAN 5 but decided to change it to 10 and only changed the one reference. It has been edited so both reference 10. I don’t know of any switches which log dropped packets based on VLAN tag. That could be a LOT of log entries if it did. Congrats on getting things working!

[@broosky333]

Made it easy for an idiot like me to understand! Great explanation and thanks.

[@12329226TheRandomiserCharter]

A concise and simple video about the theory of vLANs applied into the practical networking environment! (A valentine's gift to the channel fans!?😋)

[@Lesterandsons]

The most clear explanation? 👍

[@BentUlleland]

Great video Doug. I am using Allen & Heat dLive incl. Dante, and with the video I will try setting up two switches VLAN with trunk 10Gb fiber, and set up Vlans for both gigaAce (point-to-point, own Vlan), and vlan for Dante, and Vlan for genral network. In theory it should be possible to set up VLAN for the gigaACE between the A&H mixer DM32 and A&H c1500 surface (require level 2 switching). I also have the DT168 dante stagebox. Looking forward to the video with practical configuration of the switches.

[@johnrevival626]

How did this turn out?

[@BentUlleland]

@@johnrevival626 Not done testing just yet. Hopefully within a couple of dags… :-)

[@BentUlleland]

@@johnrevival626 Now I have tested this - and it works great! 2 pcs of Ubiquiti USW-PRO-24-POE Switches, devided into 3 VLAN’s (one for data, one for Dante, one for A&H gigaAce). 10GB lc-lc single-mode fiber SFP+ in between (250 meters). All tested, all works fine!

[@steve9992000]

thanks!

[@StefanReisener]

Thanks!

[@djp_video]

Thank you!

[@agwandacharles995]

I have been struggling with this concept finally i have gotten the video. Thanks a lot

[@byronjohnson2920]

Where can I find the planning sheet you used in the video? I would like a blank copy so I can plan my own vlans. You video turned on the lights on deployment of vlans!!! Thank you!

[@djp_video]

I didn't save it. It's just something I threw together in Microsoft Word in a couple minutes.

[@byronjohnson2920]

Okay thank you for responding! I’m glad I found your video. I am a bone head on simple things like vlans! Big complicated things I see quickly!!! I’m a 60 some old computer geek that IT stuff. Most my age have no idea. I’m always wanting to learn. Please pray for peace! Take care!

[@powerstation8141]

edit: just figured it out , it makes sense to me now XD, so what it does is to change packets coming from switch 1 VLAN 1, untagged it, then bringing untagged and tagged 2,3 traffics to switch 2, untagged packets will be tagged as vlan 4 to communicate other vlan 4 hosts and tagged 2,3 traffic will communicate with vlan 2,3 hosts in switch 2. correct me if I got it wrong.

[@djp_video]

The traffic from VLAN 1 coming out of the first switch on that port is untagged so it has no VLAN ID associated with it when it leaves that switch. When it arrives in the second switch, it is tagged with VLAN ID 4 because that is the PVID value of that port on that switch. Traffic in reverse is similar... if it's VLAN 4 in switch #2, when it leaves that switch its VLAN tag is removed (untagged) and it gets tagged with VLAN ID 1 when it enters switch #1. VLAN IDs are only preserved leaving a switch when that port's configuration is set to leave them tagged. If the port is set as Untagged that VLAN ID is removed from the network packet as it leaves. Untagged = remove the VLAN ID when leaving the port, Tag = preserve the VLAN ID when leaving the port. PVID = tag with a particular VLAN ID when it enters a port and doesn't already have a VLAN ID tag.

[@skillmanmusic1305]

Dear Doug, thank you! Question, if we are using DHCP Server for each of the Vlan, does it matter which switch is the server? Should the other switch be DHCP client or static? Thank you!!!

[@djp_video]

It doesn't really matter what device(s) are acting as your DHCP server(s), as long as there is no more than one per VLAN.

[@skillmanmusic1305]

@@djp_video thanks!

[@niyisamuel7789]

thanks

[@paulweatherford5256]

Hi Dough! Thank You for this amazing VLAN video, I wish I had found this back before I purchased my first switch now that I am wanting to add VLANS to my home setup. That said I currently only have two UNMANAGED switches a TP-Link TL-SG105, 5 Port Gigabit Unmanaged Ethernet Switch & a TP-Link TL-SG108 8 Port Gigabit Unmanaged Ethernet Network Switch. Can theses still be used without being managed in my setup? and will I have to have a managed ethernet switch (at both ends) where devices plug in then get passed by cable (a tunnel I think you called it) to my first managed ethernet switch that will be the one that is plugged directly into my ISP (Internet source)? or can I use one of the unmanaged switches at the far end and connect it to a manged swith just before the modem? I plan to buy some soon using your links in this video, that said do you have newer recommendations and links now? I am on a budget and considering something like the TP-Link TL-SG108E 8-Port Easy Smart Switch in your list, that and I have had good luck with TP-Link. Thank you again for this AMAZING VLAN Video and any advice you can provide!

[@paulweatherford5256]

Hi again Doug, after reading deeper into post here I have discovered I may not be able to setup VLANS to help make things more secure & better manage traffic/congestion if I am understanding the post correctly. Like another person my thoughts/goal is to separate out my home into 3 sections for my main computer, iot devices, and then guest. I have an ASUS RT-AC68U Router that has the WiFI turned off since I have a standalone Ubiquiti UAP-AC-LITE UniFi AP AC LITE 802.11ac Gigabit Dual-Radio PoE plugged into it for better WiFi in and around my home. I am learning how to use Home Assistant (currently in a Windows Oracle VM on an old Laptop, and trying to learn Proxmox VE that I am testing on an old PC to possibly use as my main Home Assistant setup for better performance). I am on a hard learning curve for me, doing a Texas Two Step (One Step Forward, Two Steps Back) mostly because of having to use videos to learn and do many of the programming steps to achieve my objectives. So I am not sure if I should or should not tackle even more programming dependent equipment or software or even if my brain can handle more lol. I have watched a few videos on setting up the Unifi Edge Router X and while I may eventually get it to work, I am guessing I would really struggle when I break it adding or moving things around on the network! You might want to add a Noobie disclaimer about the need for something greater than a basic home router to the VLAN Videos so that may be you will not have to keep letting new folks know if they do not read through the post fully and miss the dozens of times you mention this! Your VLAN Videos are AWESOME, but the Modem issue burst my bubble again..

[@djp_video]

You can have unmanaged switches on your network, connected to a managed switch, but each unmanaged switch would have to be on exactly one VLAN (since they don't recognize or support VLAN IDs). And in that case you'd assign the port on the upstream managed (or "smart") switch that they're connected to to just one VLAN ID, and set it to Unmanaged just like you would do with a computer so the VLAN tags are removed before being sent to your unmanaged switch (or other device). If you want to provide internet access to multiple VLANs, each one needs a device to act as a router. And that router needs Internet access to share with its associated VLAN(s). There are routers out there that can handle multiple VLANs, but that normally doesn't include consumer routers like you'd pick up at your local big box store. Those devices almost always only provide Internet for a single network.

[@paulweatherford5256]

@@djp_video Thank You Doug for the reply and helpful information. I am thinking about setting up a BareMetal router using a small foot print device running OPNSense and then put my first managed switch off of that and a second managed switch off that for devices in another area. The only place for now that I will probably keep an unmanaged switch is at the far end of the house where I have an unmanaged POE switch setup for a couple security cameras, and was considered maybe in the future adding a Unifi Ap-AC Lite to that POE switch for better WiFi there to some tv's and pc's etc. I know I said I wanted to avoid adding more programing into my life but I have been researching a lot and feel pretty confident that I will be able to figure it out. These are the first managed switches I am looking to use. TP-Link 8 Port Gigabit Switch | Easy Smart Managed | Plug & Play | Desktop/Wall-Mount | Sturdy Metal w/ Shielded Ports | Support QoS, Vlan, IGMP and LAG (TL-SG108E) Thank you for the suggestions!

[@Douglas_Gillette]

If you don’t mind, I would like to clarify something. Sorry if this sounds harsh. Ports configured to be on the same VLAN do not ‘talk to each other.’ I know what he is saying, but a more accurate and better way to say it is: ‘Traffic entering these ports can be forwarded out of these ports.’

[@Douglas_Gillette]

To me, ‘talk’ is conditional on a source and a destination. It involves a back-and-forth. You could say ‘client/server.’ There is an odd exception, which is ‘in-band’ communication to the switch to configure it. Some switches have a hidden virtual interface with a MAC address and IP address. Actually most switches. That virtual interface can receive traffic entering any of the ports on the switch. The traffic from the switch is sourced from the virtual interface and not any of the physical ports.

[@djp_video]

This video is targeted at networking novices. I don't want to get too deep in to technical jargon.

[@juanmondragon]

So just to make sure, does the vlan communication between vlans happen at the router or at the managed switch? For example, lets say you are have two computers wired directly to a managed switch that is wired to a router as well and both of them are on different vlans, does the data get sent to the managed switch only so it can be routed to the other port or does it get sent to the managed switch and then to the router and then back to the managed switch so it can go to the correct port? And since vlan switching happens at layer 3 then what is the true purpose of a mananged switch vs an unmanaged switch?

[@djp_video]

Think of VLANs as if they are entirely separate switches for separate networks. VLAN 1 would be its own network with its own switch, VLAN 2 would be its own network, etc. The not only don't talk to each other, they don't even know of each others existence. With managed switches, you can put multiple networks on a single switch by assigning different ports to different VLANs. But the end result is that they are entirely separate networks, just as if you setup multiple separate networks on mulitple switches. Each one gets its own range of IP addresses and without some additional help they can't talk to one another at all. If you haven't seen my video on IP networking, I'd highly recommend taking the time to watch that. This will all make more sense if you have that foundation. kzbin.info/www/bejne/m4TEfK1ngrCmjK8 If you need devices to communicate across VLANs you need either a router or a Layer 3 managed switch. And by router I don't mean the consumer devices you can pick up at your local big box store. You need a router that can support multiple subnets, which almost no consumer routers can do on their own. Personally I use the Ubiquiti Edge Router X, but it's only one example. The GL.iNET routers I've mentioned on this channel before can do it as well. But in both cases the configuration is done at a command line interface, and can't really be setup through the web interface... at least not easily. And it's not for the faint of heart without a strong knowledge of IP. If you just need Internet access on the VLANs, you can do it with multiple consumer routers... one for each VLAN, plus one additional router to aggregate data from those routers into one to go to your ISP. It's kind of an ugly solution, but it is one that doesn't require intimate knowledge of IP networking to make it work. The VLANs still never be able to see one another with this solution, though.

[@MyTimeFuture]

"Simple is the best!"

[@sekritskworl-sekrit_studios]

HOW do you plug in the router from the venue which you are at? I mean, do the separate addressing systems not cause conflicts?

[@djp_video]

The devices I'm using are switches rather than routers. They don't have DHCP servers or NAT routing capability.

[@sekritskworl-sekrit_studios]

@@djp_video Thank you for taking time to respond. I'm a little bit stuck. I'm trying to figure out some solutions for my girlfriend's dad. He plays in a band, and wants to ramp up content on youtube for marketing. I've heard of PFsense and believe that I could "stumble my way" into getting his video (USB cams to laptop) paired via ethernet/RJ45/1gbps with another laptop (connected to a USB audio interface) which could push via another ethernet cable to my laptop, so that I can use NDI to capture the event for recording and/or streams. However, I can't seem to find anything about whether PFsense can operate without internet connection. Unless (in the future) I would work toward streaming his events, i'd like to be able to just record the audio & video via NDI, disconnected from the venue's internet. They are only performing in restaurants and birthday parties and stuff for the most part... So, i'm wondering if PFsense could resolve the different laptops internally (without an outside DNS connection to Cloudflare or something). Is that possible? Please advise, i'm learning as much as I can about Audio Engineering/Networking/Video Production as I can... But GOOD LORD, those are some FIERCE learning curves. LOL 😂😂😂

[@pizall1440]

If I were using the network in your example and my laptop was on VLAN 1 so I can surf the internet, then I need to log into a piece of gear on a different VLAN to change a setup or something. Is there a way to connect from the laptop on VLAN1 to gear on other VLAN?

[@djp_video]

That's where routers come into play. Routers route traffic from one subnet to another. Some layer 2 managed switches have basic routing functionality as well, even though this is a layer 3 function. The rack-mount TP Link switches that I use, for example, can route between subnets, and I use that capability all the time to communicate between different networks.

[@pizall1440]

@@djp_video Thanks. So on your network the switches handle it. If not, would you simple put a router between the two VLANs? Would a router between to actual LANs do the same?

[@djp_video]

Yes, a router is what you'd need. You'll probably want one that doesn't require you to use Network Address Translation if you want traffic to be routed both directions. Most consumer routers don't have that option.

[@pizall1440]

@@djp_video I'm looking forward to that next video.

[@domantlen6231]

12:20 Wait a minute. So setting PVID not only adds tag to (any untagged) packet but also adds such port to VLAN? I thought that you have to set Tagged/Untagged as well to do so

[@djp_video]

That depends on the switch you're using. Some will automatically make sure that the VLAN ID used for the PVID is also set as Untagged (or PVID is set the same as the Untagged VLAN ID), but there isn't any requirement for a switch to do so. It wouldn't make much sense to have a different PVID value than the Untagged VLAN ID, so some switches will automatically adjust one when you set the other. Others will happily let you create a configuration which doesn't actually work and not complain. This is more common than not.

[@huntereubanks1325]

Would if you needed to send audio from the mixer to both the stage box and PC1?

[@djp_video]

The easiest solution is to put PC1 on both networks with two network interfaces, usually by adding a USB-to-Ethernet adapter.

[@ellmo69]

Hi, so i have a question or questions- So if i have 3 managed switches, 1 router, 12 Access Points...and 1 Broadband Circuit. 12 Apartments so 1 AP in each Apartment, I dont want the apartments to see each other on the network, so i assume 1vlan for each Apartment, Is this all handled by the Switches or does the router need to be able to assign 12vlans as well... Thanks...

[@djp_video]

Consider each VLAN as if it was its own independent network, and they can't talk to each other. But that also means that they can't talk to the Internet either without a router. Consumer routers are not VLAN aware and can only provide Internet access for one network (or VLAN). If you step up to something more purpose built for this you can indeed get a single router to provide Internet access for multiple networks. One inexpensive option is the Ubiquiti Edge Router X. It also supports VLANs, so the traffic from the 12 independent networks can come in on one port using a single cable utilizing VLAN trunking (which is essentially preserving the VLAN tags when they exit the connected switch so the router knows which VLAN each packet belongs to and can route them independently even though it is a single cable). The easier solution, though, is to put routers in each of the apartments, and have them connect to a single router upstream which provides Internet access for those 12 separate routers. No VLAN configuration required in that case. On the flip side, if you do end up using VLANs and have access points which support VLAN tagging (most do at this point), you could have each access point provide WiFi for multiple VLANs -- they don't technically need to be limited to just one. In my home, for example, I have three access points but they each provide Internet for 6 different VLANs -- each serves multiple SSIDs, and each SSID can be assigned to any VLAN. So you could have an AP in Apartment 9 that not only provides WiFi for Apartment 9 but also serves as a backup or additional coverage for the other apartments as well. If that makes sense. A universal administration SSID could also be added, just for you, and have its SSID broadcasts disabled so nobody besides you even knows that it is there. Or setup a universal guest network available to everyone. You get options that way.

[@scottb721]

If I'm only using one switch, is the link back to the router still called trunking? And when using a single switch, does each VLAN need its own link back to the router?

[@djp_video]

Trunking is the feature that lets you send the network traffic for multiple VLANs over a single cable, between any types of devices whether those be switches, a router, or something else. If you need multiple subnets to have internet access (not just one), you'll either need a router which has that capability, or multiple routers (one for each subnet plus one central one to combine traffic from the other routers). If you have a router which supports multiple subnets/VLANs, it would either need multiple Ethernet ports (one per VLAN) or to support VLAN tags.

[@Watch4Me]

Is it assume that all traffic is IP traffic? I haven't HDMI over CAT5 network that I'm told is not supposed to coexist with IP traffic. Can i put that on the same switch?

[@djp_video]

Most HDMI over CAT5 devices don't use Ethernet, let alone IP. But it depends on the devices being used. Look into the details of the product you have to see how it handles sending data over a CAT5 cable. If your device doesn't use Ethernet it shouldn't be put on an Ethernet network (and wouldn't work). If it uses Ethernet but not IP, I'd recommend keeping it separated as they can tend to flood and overwhelm a network with more traffic than it can handle. But, again, it depends on the device.

[@Watch4Me]

@@djp_video thank you for the reply. I understand that it is not ethernet/IP It is broadcast only. Not a manageable protocol. Therein is my answer. 🙂

[@notta3d]

Something I am banging my head on is allowing specific devices on one vlan to talk to specific devices on another vlan. For example, let's say you had a laptop plugged into the second port that is on vlan 1. There are other systems on the other ports on vlan 1 but you only want the laptop on port 2 to be able to talk to for example port 9 which is the Stage Box in vlan 2. Maybe there is software on the laptop that's used to control that audio device. Would port 9 have to be a trunk port? I always here trunk ports used for between switches but what about on the same switch? I know there is routing that has to be done but I'm trying to keep my example simple. This concept is holding me up big time and for some reason I can't grasp it.

[@djp_video]

VLANs, by definition, are isolated networks that don't talk to each other. Devices on one VLAN can't talk directly to devices on another VLAN. You can add a router into the mix to allow *some* communication between devices on different VLANs, but that is a bit of a special case. And when I say router, I'm not talking about the consumer devices that you can pick up at your local big box store -- I'm referring to actual real routers that can handle multiple subnets, not just limited to providing Internet access for a single network. For my own networks I use the Ubiquiti Edge Router X to do this. It's pretty inexpensive, but it isn't something that someone without significant networking experience would be able to set up and maintain effectively. You don't just turn it on and have communication between networks -- it has to be manually configured to support multiple virtual switches, each with its own IP subnet, the device's ports have to be assigned to those virtual switches, and you have to build and configure routing tables each with its own IP address range to get it up and going at all. And then if you want Internet access it's also your responsibility to setup the DHCP, DNS, and NAT services for each VLAN to make all of that work. It will do all of that and more, but it's not a plug-and-play affair. In your example, to allow the laptop on port 2 to talk to a stage box on port 9 properly, you'd have to put those two ports on the same VLAN. And those ports shouldn't be on any other VLANs. But doing so would cause the laptop would lose access to VLAN 1. Probably not what you want. There are two ways around this, and the one to use depends on what kind of communication you're doing between your two devices. But I suspect that for what you're trying to do the devices need to be connected to the same VLAN, so I'll go with that solution... and that is to add a second network adapter to the laptop so it is connected to two different ports of your switch, one for each VLAN. That's usually my preferred approach, using USB to Ethernet adapters, because it's simple and doesn't require any special configuration. The other way would be to use a router to route traffic between the two VLANs, but set it up so that only specific IP or MAC addresses can be routed. That would work for some types of network communication like using a web browser to configure a device, but it would not work for all types of communication. In that scenario you should think of the two devices as being on different networks (because they are) and the only communication allowed between them, even with a router, would be effectively the same as what is allowed to go across the Internet. The normal techniques used by devices to find each other on a network don't work across VLANs, even with a router in place. Trunking is the act of putting network from multiple VLANs onto a single port. The data coming out of the port is tagged with the IDs for the VLANs where that data originated. But the trouble with that is that the connected device needs to know how to handle tagged Ethernet traffic, and most doesn't. It's technically possible in Windows or macOS or Linux to make it work with some network adapters, but it isn't for the faint of heart and it's usually an unsupported configuration that is likely to break. You literally have to add multiple virtual network adapters, one for each VLAN ID, to make it work, and that's usually only accomplished through administrative command line utilities and/or editing text configuration files, if the network adapter you're using even happens to support it at all, which is kind of rare. Consumer versions of Windows really don't like you trying to do that; it fights you and it will literally break the next time you get a driver update. And some software outright refuses to talk to a virtual network adapter if you do get it setup, making all of that effort a waste of time. For all intents and purposes, trunking should be thought of solely as a way to get traffic from multiple VLANs on one managed switch to another managed switch. Computers and other client devices normally wouldn't connect to a trunk port. But the bottom line is that VLANs should really be thought of as completely disconnected networks for most situations. Just like having two separate, completely unconnected network switches. They just happen to be connected to one physical device, but the networks are separate. If you haven't seen my video on IP networking, it would be helpful to watch that before we dig any deeper into this conversation.

[@nobeltnium]

23:54 you have VLAN 1 untagged and VLAN 2 and 3 tagged on port 18. But since audio devices and phones (which you are using in the example) can't understand tagged packet, what is the point of tagging it anyway? To my understanding, in this configuration port #18 can only connect directly to a computer OR trunking to another switch. Any audio device plugged into this port will be consider a PC and will be assigned with VLAN 1. Is this correct?

[@djp_video]

Most of the time computers don't understand VLAN tags either. They can be made to, but it isn't common. Leaving packets as 'tagged' is for sending to another switch. Devices which don't understand tags will ignore the packet entirely. The structure of the packet is a little bit different and they won't be recognized by devices not setup to handle tags.

[@nobeltnium]

@@djp_video My confusion is that: When a phone or audio device is plugged into this port, will it ignore the packets all together, or will it get treated as a member of VLAN1?

[@djp_video]

It will only see packets that are not tagged. And any packets that the device generates are tagged with the PVID setting of that port. So if the port is set as 1 Untagged and PVID of 1, it will act as a member of VLAN 1. If it is set as 3 Untagged and PVID of 3, it will act as a member of VLAN 3.

[@nobeltnium]

@@djp_video thank you for your explaination. I have one other question in mind: Can a port be a member of 2 VLAN? Like both VLAN 1 and 2 in your example, and if both of them are untagged. Then a computer or any device that plugged into this port can see packets from both VLAN 1 and 2. Is this correct?

[@deeyadeli1435]

So you can't have multiple vlans from one managed switch going out to the router and then the internet? Or can you have multiple untags on one port?

[@djp_video]

Some switches will let you set 'Untag' for multiple VLANs, but they really shouldn't. Once you mix traffic like that there's no way for response traffic to be re-assigned back to the proper VLAN. There are some routers that support multiple VLANs, but that feature is next to non-existent in consumer routers, or at a minimum requires you to into Linux command-line configuration. It's certainly not for the faint of heart. The easy way to provide Internet access for multiple VLANs is to setup multiple routers -- one for each VLAN, and then another one that combines the signals from those VLAN-specific routers. It's not an ideal situation but it is cheap and it does work. At some point I might do a video on how to setup VLAN configuration on some affordable router options.

[@deeyadeli1435]

@@djp_video wow, thank you for the fast reply. This is all good info to know. You have definitely presented the info the most clear and understandable than any other video I have watched. Maybe it's overkill, but I have been wanting to separate out my home into 3 sections for my main computer, iot devices, and then guest. I have been looking into the Protectli router with pfsense. Looks like the easiest for me might be to get the router with 4 ports and firewall off each port from each other. Then just use a switch if needed on each router port.

[@djp_video]

If you would still like to use a single cable (trunk cable) from your switch to router, pfSense is definitely capable of supporting multiple VLANs. But you still have to check to see if the hardware is VLAN-capable. Not all Ethernet devices are. The router that I use and is most certainly VLAN capable is the Ubiquiti Edge Router X. Pretty inexpensive for what it is too. The GL-iNET routers can be made to be VLAN capable, but it isn't an officially supported configuration. Many routers which allow you to download third party firmware can also be made VLAN aware, but again you're on your own getting them configured to do so. The other thing to consider is your WiFi networks. Most Access Points support VLANs (but not consumer routers with WiFi). You can setup multiple networks, and point each one of them to a specific VLAN. I do that in my home and trailer... I have at least 6 networks running on each.

[@deeyadeli1435]

@@djp_video Thank you sir for the responses back. I appreciate the help and advice!

[@Neolantis]

Am i understanding it correctly... If I only have the one switch I do not need to use tagging? I have similar equip. like pc1, pc2, printer, nvidea shield, and a NAS. So 5 vlans, all untagged. Sound right? Thank you again for the great explanation and any reply you make here....😎

[@djp_video]

You are correct. Tagging is only useful when sending data between switches. You want the tags removed when data is sent to any other type of device.

[@Neolantis]

@@djp_video Excellent, thank you. Does setting the network printer on a different vlan sever the communication or should it be on the same vlan as the two pc's? I appreciate the response Doug.

[@djp_video]

You could put it on a different VLAN, but you'd need to setup routing between the two VLANs/subnets. Usually we would leave it on the same VLAN though.

[@Neolantis]

@@djp_video I'll leave it in the same vlan then, thank you for your help. It's been very helpful.

[@JorgieMathew]

Just bought tplink tl470+ to do something like this and ISP failover.

[@Tom-jd1rm]

Would like to move all my video cameras into VLAN. Will I still have access to view the cameras?

[@djp_video]

That depends on how you set things up. Considering how each VLAN is really a completely separate network, you'd need to do something to grant that network Internet access. If you're using consumer routers, that means using three -- one for your main network, one for your video network, and another one to combine those two networks into one to go out to the Internet. Or a single proper router that can handle multiple subnets. I use the Ubiquiti Edge Router X for that purpose -- but unless you are or know a proper networking professional, that solution might not be for you, as it's not quite a "plug it in and it works" device. It might also be possible to route data between your camera network and your regular network if the cameras don't need Internet access. That usually means using a router, and by which I mean a real router, not a consumer wireless "router," or layer 3 switch. Or at a minimum a layer 2 switch that has IP routing capability. Real routers can handle all of these functions in a single device. They can provide Internet access for multiple VLANs. The bottom line is that you need a way to grant Internet access to multiple networks simultaneously, something that consumer routers don't do on their own.

[@tecnologiainternacional]

so pc1 and pc 2 are tagged by just being plugged in ? and you untagged it all, if you want to sent it to the other router ?

[@djp_video]

The tagging is usually done by the switch. You configure it to tag all network traffic (data) coming from the connected device. So any device plugged into a port with a PVID of 2 will be tagged for VLAN 2. The PVID value determines what VLAN data is tagged with. If you want the tags to be preserved when going between two routers you set those ports to be tagged (so the tags aren't removed). Setting a port as Untagged removes the tags before the data leaves the switch.

[@tecnologiainternacional]

@@djp_video so if I want another PC from the other router to have access to let's say a hard drive or a Nas through the port I can do that. Or maybe transfer data like pictures between PC'S is that possible ? just the way you have it set up ?

[@djp_video]

@@tecnologiainternacional If you want data to be transferred between VLANs you have to configure a router (or layer 2.5 or layer 3 switch) which is on both VLANs to route between the two. Setting up and putting devices on separate VLANs disconnects devices and, without a router, prevents them from talking to one another. Devices on the same VLAN can talk to one another, but devices on separate VLANs normally can’t.

[@tecnologiainternacional]

@@djp_video thank you. I'll be back with more questions after I get my oc300. thank you so much.

[@SeanTolan_illuminated_imaging]

We lost ethernet connection at my church but we have wifi. What was weird is the ethernet cable going to the switch and then ethernet to the EEVO wireless works fine, but plug a computer in and there is no DHCP server, or there is a problem there. It was frustrating yesterday to say the least. We have 240Mbps up wirelessly so getting the livestream out was not an issue, but as a tech guy for a small church networking is a weak spot I need to beef up. We tried an iMac, a Macbook Pro, and a Dell Windows laptop. Cables are fine, just could not get ethernet to connect. We had a wind storm last week and the power blinked 5 or 6 times...not sure if that could do it, or has anything to do with it, but it was fine before. Power cycled everything, and checked all cables too. If we turned Wifi off on any machine there was no internet...so later today will be fun. lol

[@sexyeur]

Cue the Miami Vice soundtrack

[@jaysonxilero8520]

May I know how can I assign a gateway IP on each one of the vlan?

[@djp_video]

That will be setup on a router. Some managed switches can act as routers, but not all do. You might have to add your own router to each VLAN subnet if the switch doesn't have its own routing capabilities, or its routing capabilities don't provide all of the functionality you need.

[@jaysonxilero8520]

@@djp_video So meaning to say if I have a 3 VLANS setup in my 24 port manage switch I will also have to use 3 individual routers that has a patch cord cable on each that are connected going thru each one of those VLANs?

[@drifter2341]

@@jaysonxilero8520 No. That's where "router on a stick" comes in.

[@claudiobge5493]

iiiiiiiii man. Thanks, a lot.

[@WhooTAZ]

Where did you get the shirt?

[@djp_video]

A friend of mine gave that to me. I think he got it at Old Navy if I remember right?

[@tac73]

Not sure why you'd want to mismatch the native VLAN on the trunk between the two switches? What would be the purpose of that?

[@djp_video]

If you have switches that move between different networks this can be handy.

[@tac73]

@@djp_video Okay, I can see how that would work. I've just never seen anyone do that before. 😁

[@huseyinyavuz2765]

In some vendors this will lead to errors. For example, Cisco switches would detect it and give you native vlan mismatch warning.

[@djp_video]

Out of curiosity, how is it detected if the VLAN tag is removed? They’re just untagged frames at that point?

[@huseyinyavuz2765]

@@djp_video Afaik, the only way to have an untagged vlan on a trunk port is to have it configured as the native vlan. When you have a link between two Cisco switches and their native vlans mismatch, the neighbor discovery protocol called CDP detects it and gives you repeated warnings.

[@drifter2341]

👍👍

[@TheChyamp]

How does switch 2 get access to the internet?

[@djp_video]

You'd need a router somewhere to do that for you.

[@TheChyamp]

A router on the same switch? Or can it route through switch 1?@@djp_video

[@attaque71]

So, in order to set it up, you need at least a vlan capable managed switch, a cheap non managed switch simply would not work, even if your router is vlan capable.

[@djp_video]

Yes. The switch has to know how to deal with the VLAN tags.