Help before buying Cisco SG350 series switch

[Filomena]

Hi,

I am looking at a Cisco managed switch to do the following:
- have 3 or 4 VLANs: private, office, guest and optionally shared (that could go in private and be shared via ACL rules)
- Each VLAN in a different subnet
- private VLAN: PC to manage all VLANs and connected devices, NAS-1, router, WLAN-AP, shared clients (NAS-2, printer...), have internet access
- office VLAN: have access to internet and some shared clients (NAS-2, printer...)
- guest VLAN: internet access only
- shared : NAS-2, printer, have internet access

The switch will be cable wired mainly to:
- a home/SOHO router non VLAN aware where the DHCP server will be disabled. It will have the DNS service configured on it
- a UniFi AP AC LR that is VLAN aware and that will broadcast 3 SSIDs: private, office and guest for each VLAN
- the management PC

The Switch should be able to:
- work as a DHCP server for all the VLANs
- do inter-VLAN routing
- have ACL rules if I want to put the shared resources in the private VLAN and allow access via ACL

Exp:

               Cable Modem
                         |
      Home/SOHO Router WAN port
                         +
      Home/SOHO Router LAN 1

                192.168.1.01
                         |
             Managed Switch + DHCP server
                    + Port 1: default VLAN 1 connected to home router: 192.168.1.10
                    + Port 2: VLAN 10 (private / management): 10.0.10.0/24
                    + Ports 3-4: VLAN 20 (office): 10.0.20.0/24
                    + Ports 5-7: VLAN 30 (shared): 10.0.30.0/24
                    + Port 8: VLAN 40 (guest): 10.0.40.0/24

Will the SG350 series fulfil my needs or should I look at another model ?
If yes, I read the manual and I am really uncertain if the DHCP server will serve all the VLANs via dedicated pools:
- what would be the "Default Router IP Address" and the "Domain Name Server IP Address" for each DHCP pool ?
- for my use, do I need to configure the NetBIOS, SNTP and TFTP entries as I am not sure about their purpose in the DHCP setup

Many thanks for your help

[Giuseppe Larosa]

Hello Filomena,

>> Now, if I also enable the inter-VLAN routing on RV345 router, the intranet inter-VLAN routing would still be done on the switch interface at wire speed I guess since all devices are directly connected to the switch, right ? It won't drop to software inter-VLAN communication on the next node, the router in my case !

Thinking of a compromise scenario. It can be the following:

both the RV345 and the SG350 have subinterfaces and SVIs respectively configured for each Vlan / IP subnet.

The RV345 subinterface IP address can be 10.10.10.254 to make an example and switch IP address 10.10.10.1.

The DHCP scope on the SG 350 will provide a default-gateway of 10.10.10.254.

This allows to go to the internet using connected Vlans on the RV345 that can NAT them.

To avoid the bottle neck of using the RV345 for inter vlan routing you need the following:

Each PC or server needs to have configured a more specific static route covering all internal networks using as next-hop the SG350 SVI IP address.

In wndows 7  or Windows 10 shell this means something like:

route add 10.0.0.0  MASK 255.0.0.0  10.10.10.1 -p

where -p means permanent it will be persistent over PC reboot.

This static route is valid until the PC has an IP address in subnet 10.10.10.0/24 and can resolve by ARP the gateway 10.10.10.1.

However, to make this effective you need to make this configuration change on every PC and server.

And you need to use the correct next-hop for each vlan.

Printers can use the default gateway that you set manually on them.

Depending on the number of end users devices this can be feasible/manageable or not.

Hope to help

Giuseppe

[Filomena]

@Giuseppe Larosa

Thank you. I searched in fact and only static nat is possible but only as lan ip per wan ip range. So no way.

I cannot go the static route setup on each device.

Any suggestion on a 1gb wan router that i can setup also through web gui to nat the vlans? I prefer upgrading to decent HW if in a relative accessible price. 

In this case, the acl rules will need to be set twice on the switch and router/firewall? 

Many thanks again

[Giuseppe Larosa]

Hello Filomena,

>> In this case, the acl rules will need to be set twice on the switch and router/firewall? 

Yes, being both the router and the switch directly connected to each Vlan / IP subnet you should deploy the same ACLs on both.

consider the need to configure each PC or server and evaluate if this can be feasible/ manageable or not.

If the "compromise scenario" is acceptable for you, you can consider the RV345 router

https://www.cisco.com/c/en/us/products/collateral/routers/small-business-rv-series-routers/datasheet-c78-742350.html

It provides you also space for a second WAN GE interface and can support interface bundling (without LACP) so you can have a two 2GE bundle between router and switch configured as 802.1Q trunk carrying all Vlans.

The expected performance is in line with your current needs 500 Mbps (bidirectional) -> 980 Mbps on the datasheet for the firewall feature.

Edit:

if you mean that you are looking for a router more powerful then RV345 please ignore my previous considerations.

Hope to help

Giuseppe

[Filomena]

@Giuseppe Larosa 
Yes, i cannot go with the compromise. I cannot setup static routes on each device (guest) and also maintain such a setup.

I prefer opting for a more powerful router, 1Gb WAN, but mainly a gui and user guide. There is no guide for gui on the ISR series! I guess they are cli only. 

I also suppose many smb use vlan and not necessarily cli only complex firewall/routers! So such devices must exist!

Any advise is welcome even another brand if cisco routers are only meant for network professionals. 

Thank you for the precious help and time. 

[Filomena]

I looked at the C921-4P router and it is in my budget.

It provides the 1Gb WAN interface and looks like an upgrade to the 800 series and their 100 Mbps WAN.

Since the decision to buy the SG350 is now done thanks to your advice, I am opening another topic for the router choice:

https://community.cisco.com/t5/routing/advise-before-buying-a-router-rv345-or-upgrade-to-c921-4p/td-p/3915921

I feel I will need some support if I go with the C921 as I really don't master the CLI commands, despite being used to linux cli in general, but not networking.

Many thanks for your help.

[Filomena]

I finally went with the SG350, to run a long a pfsense custom box as router

Many thanks for all your help