NETGEAR ProSAFE GS724Tv4 User manual

Netgear GS724Tv4
Smart switch
A Tutorial on Use
Ross Maloney
by
4 October 2015

Contents
1 First steps 1
1.1 Necessary networking background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Switchhardware .......................................... 2
1.3 Buttonstoresettheswitch..................................... 2
1.4 Environment used in switch configuration examples . . . . . . . . . . . . . . . . . . . . . . 4
1.5 Basic control of the switch itself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.5.1 Accesstotheswitch .................................... 5
1.5.2 VLAN ............................................ 5
1.6 Initialswitchconfiguration .................................... 6
1.7 Gateway from a simple network on the switch . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.7.1 Implementation....................................... 7
1.8 Warnings............................................... 7
2 Layer 2 8
2.1 All devices on the default VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.1 Implementation....................................... 9
2.1.2 Resultsfromtesting .................................... 9
2.2 A new VLAN holding all devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2.1 Implementation....................................... 10
2.2.2 Resultsfromtesting .................................... 10
2.3 TwoisolatedLANs ......................................... 10
2.3.1 Implementation....................................... 11
2.3.2 Resultsfromtesting .................................... 12
2.4 DividingaLAN........................................... 12
2.4.1 Asinglenetwork ...................................... 13
2.4.2 Dividing the network into two parts . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
i

CONTENTS
2.5 Divided LAN sharing one Internet connection . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.6 Ensuring only known devices can use a network . . . . . . . . . . . . . . . . . . . . . . . . 15
2.6.1 Security designed to give specific devices access to given devices . . . . . . . . . . 16
2.6.2 Aspects common to each implementation alternative . . . . . . . . . . . . . . . . . 16
2.6.3 Implementation Alternative 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.6.4 Implementation Alternative 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.6.5 Testing............................................ 19
3 Layer 3 20
3.1 Routing between LANs and to the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.1.1 Implementation....................................... 21
3.1.2 Testing............................................ 22
3.1.3 Removing Internet access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.1.4 Important to note from this example . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
3.2 Securingthenetwork........................................ 23
3.2.1 Implementation overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.2.2 WirelessandInternet.................................... 23
3.2.3 Allowing PC 1 access but with limitation . . . . . . . . . . . . . . . . . . . . . . . . 24
3.2.4 AllowPC2toaccessPC1................................. 25
ii

Chapter 1
First steps
This document is not a definative User Guide for the Netgear GS724Tv4 smart switch. It grow out of
the observed lack of a User Guide as opposed to a number of good Reference Manuals. Those manuals
showed how to perform operations on the switch but not the reason why they could be performed. The
why is approached here by posing a problem, or an example situation, and then configuring the switch
to provide a solution. Further detail of the how can be obtained from a Reference Manual.
The application examples used have resulted from need. As the need to know more has grown so too
this User Guide has evolved. This evolution is expected to continue resulting also in this document
evolving. The examples are set up to show the switch setting used and the consequence of such setting
on the behaviour of the network containing the switch. Not having knowledge of the consequence of a
setting can make an appropriate switch selection setting time consuming.
Emphasis is placed on the GS724Tv4 switch as a network element. Testing of the network resulting from
each switch setting is described together briefly with how the switch can be configured to produce such
a setting. Further detail of the mechanics of performing setting of this switch is contained in the switch’s
manual.
The majority of the information contained here should also apply to the GS716Tv3 smart switch, and
maybe the GS748T5, although this has not been verified.
The reader is assumed to have access to the Netgear GS716Tv3, GS724Tv4, and GS748Tv5 Smart
Switches Sofware Adminstration Manual available from www.downloads.netgear.com/files/
GDC/GS716TV3/GS716Tv3_GS724Tv4_GS748Tv5_SWA_25Sept2013.pdf for information to sup-
pliment that given here.
1.1 Necessary networking background
The Open Systems Interconnection (OSI) model is a means of describing networks. That description
is divided into 7 layers: physical, data link, network, transport, session, presentation, and application.
The physical layer is layer 1, the application layer is layer 7, and the others are consecutively ordered
between.
For a device to take part in a network it must have an address on that network. This is its physical
address and is considered part of layer 2 of the OSI model. This address is 6 bytes, or 48 bits, or 12 hex
digits, in length. It is known as the Media Access Control, or MAC, address. Each network device in the
world has at least one MAC address and that MAC address is unique no matter whether the device is a
hardwired or wireless network component.
Ethernet and WiFi operate at layer 2. Each uses MAC addressing, only.
1

1.3. Buttons to reset the switch
Networking protocols are layer 3. TCP/IP is an example of a networking protocol. Each such protocol
has its own addressing scheme. For example IPv4 uses a 24 bit address expressed by 4 decimal digit
separated by a dot, for example 192.14.134.231. By constrast IPv6 uses a 128 bit address expressed
as eight 16 bit blocks, each block expressed as 4 hex digits with blocks separated by a colon, an example
being FE80:0000:0000:0000:0202:B3FF:FE1E:8329. These addressing schemes are different de-
spite IPv4 and IPv6 both being TCP/IP protocols. Other networking protocols use different addressing
schemes. But each network protocol addressing scheme needs to be converted to, and from, a MAC
address.
The GS724Tv4 switch uses TCP/IP network addressing. In this work IPv4 network addressing only will
be used. The same techniques shown here also apply to IPv6.
Each network element has fixed and changable addesss assignments. The MAC address is fixed in the
hardware. The changable parts are in the software which implements the network protocol such as
TCP/IP. These parts are the address of the device, its network mask, and the gateway to be used by data
to get off the device. Some software implementations require the broadcast address and network ad-
dress to be defined, but these can be calculated from the device address and network mask. The network
address is calculated by applying the AND operation to the address and the netmask combination. The
broadcast address is calculated by applying the OR operation to the combination of the network address
with the bit inverse of the network mask. But contrast, the gateway address must be specified and is to
where a TCP/IP packet is to be sent if the destination to which the packet is addressed cannot be found.
1.2 Switch hardware
The small brown coloured Philips head machine screws supplied with the switch are for attaching the
supplied mounting brackets to the switch housing. Four screw holes threaded for those screws are
provided at both ends of the switch housing.
The larger, chrome plated screws are for attaching the mounting bracket to a mounting frame supplied
by others.
Two mounting brackets in the form of drilled right-angled brackets in a blue colour to match the switch
housing are supplied with the switch.
Power to the switch is through the socket on the back of the switch. A power cable is provided with the
switch for that purpose. No isolating switch for that supply is provided on the switch.
The factory reset button is located on the bottom right of the front housing of the switch. It is recessed
from the surface. Use a straighted paper clip to depress this switch.
1.3 Buttons to reset the switch
There are two reset buttons on the switch. The Reset button is on the far left-hand side of the face
of the switch while the Factory Defaults button is on the right-hand side of the switch. Both buttons
are resessed from the surface requiring them to be pressed using a straightened paper clip. The switch
acknowledges the button as having been pressed by turning on all of the System LEDs. The reset process
takes two or more minutes to complete. Upon completion of the reset process, the System LEDs are
resturned to indicating the port usage.
The switch documentation states pressing the Factory Defaults button removes any configuration on
the switch and sets the address of the switch to 192.168.0.239. This proved untrue.
2

1.3. Buttons to reset the switch
To determine the actual behaviour of the Reset and Factory Defaults buttons, a series of trials were
performed. The results of those trial are contained in Table 1.1.
Important to note: The address of the switch does not answer a ping.
Trials were performed with firmware version 6.3.1.9on the switch. To determine the address of the
switch, version 1.1.3.2 of the Smart Control Center software running on a Windows 8.1 PC plugged into
socket 11 of the switch was used. Switch ports 7 and 19 only were used in the trials. To each of those
ports a PC running Linux was connected. Each trial consisted of exchanging ping packets between those
PCs and observing the results produced. Between trials, the network addresses of each PC was changed.
Table 1.1: Effects of switch reset buttons on switch content
Addresses Before Button Addresses After
gateway switch Pressed gateway switch Result
gateway device 192.168.23.244 connected
.23.244 static .23.105 reset .23.244 dynamic .23.105 I
.23.244 static .23.105 factory .23.244 dynamic .23.105 R
.8.254 static .8.78 reset .8.254 static .8.78 I
.8.254 static .8.78 factory .23.244 dynamic .23.105 R
.23.244 dynamic .23.105 reset .23.244 dynamic .23.105 I
.23.244 dynamic .23.105 factory .23.244 dynamic .23.105 R
.23.244 static .23.78 reset .23.244 static .23.78 I
.23.244 static .23.78 factory .23.244 dynamic .23.105 R
.23.2 static .23.78 reset .23.2 static .23.78 I
.23.2 static .23.78 factory .23.244 dynamic .23.105 R
gateway device 192.168.23.244 removed
.23.2 static .23.78 reset 23.3 static .23.78 I
.23.2 static .23.78 factory 0.0.0.0 dynamic .0.239 R
.0.244 dynamic .0.239 reset 0.0.0.0 dynamic .0.239 I
.0.244 dynamic .0.239 factory 0.0.0.0 dynamic .0.239 R
0.0.0.0 dynamic .0.239 reset 0.0.0.0 dynamic .23.105 I
0.0.0.0 dynamic .0.239 factory 0.0.0.0 dynamic .0.239 R
gateway device 192.168.23.244 connected
0.0.0.0 dynamic .0.239 reset .23.244 dynamic .23.105 I
0.0.0.0 dynamic .0.239 factory .23.244 dynamic .23.105 R
With respect to the trials data reported in Table 1.1, Note:
•all addresses shown are prefixed by 192.168, execpt 0.0.0.0
•no device corresponding to the switch gateway address 192.168.8.254 was attached
•switch firmware required its gateway and its address be set on same network
•only in static address mode could the switch address be set manually
•gateway and switch before addresses were those set using the Smart Control Center software
•the Result column shows results produced relative to the prior port configuration setting
•Result indicators: I means intact (no change); R means reset(change)
Behaviour patterns appear in Table 1.1. When the Factory reset button was applied:
•removes all port behaviour configuration
3

1.4. Environment used in switch configuration examples
•switch address set to dynamic 192.168.239 only if no gateway device was connected
•switch gateway address before does not effect outcome gateway address
When the Reset button was applied:
•always leaves port behaviour configuration unchanged
1.4 Environment used in switch configuration examples
Two networks were used; a hardwired network and a wireless network. The network address of the
hardwired network was 192.168.14.0 and 192.168.8.0 for the wireless network.
Table 1.2: Summary of devices connected to switch of the examples
Port Description of device IP address assigned MAC address
g1 HP Color Laserjet Pro M252dw printer 192.168.14.31 d0:bf:9c:bd:4b:4d
g2 Netgear ReadyNAS 316 192.168.14.107 28:c6:8e:d5:ed:08
g7 Mac Pro server Linux 192.168.14.9 00:3e:e1:c1:74:b3
g19 Mac mini server Linux 192.168.8.7 c8:2a:14:56:3c:a2
g23 D-Link DAP-1650 wireless extender 192.168.8.240 c0:a0:bb:f7:44:c0
Table 1.2 shows the details of the devices used in the examples. The switch was set with address 192.
168.14.155, placing it on the hardwired ethernet. The netmask for each device was set to 255.255.
0.0. That mask enabled devices on both networks to communicate. This enabled that Mac mini with
address 192.168.8.7 to act as controller for the switch.
switch
wireless network
Internet
gateway
Figure 1.1: Model of the network visualizations used here
Figure 1.1 shows the style of diagram used to depict the network of each example. In Figure 1.1 the
switch is configured to have two networks with one device connected to the switch and the configured
network. An internet gateway on a separated wireless network is also shown.
A D-Link ASL-2900AL Viper wireless router with IP address on the wireless network of 192.168.
8.244 with corresponding MAC address e8:cc:18:f1:79:6f provided a link between the wireless
network and the Internet. The D-Link DAP-1680 wireless extender provided the link between the hard-
wired and wireless networks.
4

1.5. Basic control of the switch itself
The devices shown in Table 1.2 on the two networks are divided into two groups. The computers were
used to configure the switch and test the behaviour of the resulting network. The printer and NAS
acted as target addresses for testing the network. The wireless extender was used as an additional target
address together with providing hardware coupling of the hardwired ethernet to the wireless network
containing the Internet interface, which also provided additional address targets. The DSL-2900AL
Viper router was part of the wireless network and not directly connected to the switch.
The examples will show the usefulness of the switch comes from it being able to change relationships be-
tween connected devices without physically changing the connections. For example, without changing
the physical connections to the network, the behaviour of this hardwired/wireless network is changed
by re-configuring the switch.
1.5 Basic control of the switch itself
The Netgear GS724Tv4 switch has network parameters which can be reset from their default values.
Values selected for these parameters influence access to the switch and behaviour of the network formed
using the switch. The network devices plugged into the switch ports form the network elements, but
the switch is an active media connecting those devices.
1.5.1 Access to the switch
Control of the switch is menu base accessed through a web browser. This menu system is only accessible
after logging into the switch.
The menu sequence
System →IP Configuration
enables the address of the switch, its network mask, and gateway can be reset. Assume the network
address was assigned here to 192.168.8.155, replacing the default switch address. The network
mask assigned here appeared not to have any effect.
In a LAN-based network, the switch can only be logged into from a device having the same network
component of its address as the address of the switch. For example, a device with address 192.168.8,
7can log into the switch with address 192.168.8.155, but a device with address 192.168.14.10
cannot.
1.5.2 VLAN
A basic unit for the switch is a Virtual LAN or VLAN. Devices connected to the ports on the switch
are assigned to one or more VLANs. This port/VLAN correspondence can be configured. A device
assigned to a VLAN behaves within the behaviour characteristics configured for that VLAN.
All ethernet ports of the switch are Untagged (U) members of VLAN 1 by default. However only devices
with the same network component of their address can communicate. For example address 192.168.
14.9 can ping address 192.168.14.107 but not 192.168.8.7.
The menu command sequence
Switching →VLAN →Advanced →VLAN Membership
accesses the port connections on a VLAN. Clicking the box under a particular port number through the
sequence U→blank →Tchanges the type of connection between the VLAN and the port. The blank
5

1.7. Gateway from a simple network on the switch
removes the connection. Once the connection type is selected, the Apply button in the bottom right
hand corner of the screen is clicked to have the switch perform the change.
The port to VLAN connection types are:
T trunk carrying traffic for more than one VLAN
U untagged
blank not connected
When a port box is shown as blank, the device connected to that port is no longer accessible from other
devices on the VLAN having the same network address.
1.6 Initial switch configuration
Default address of the switch was 192.168.0.239 and default switch gateway address 192.168.0.
254. These defaults were changed by logging into the switch using a PC whose ethernet address is
192.168.0.x where x is a value in the range 1 to 253, excluding 239 (which would give a conflict with
the default network address of the switch). The value of x chosen was 7. This PC was connected to the
switch via any of the RJ45 ethernet ports on the switch. Putting the address 192.168.0.239 into the
address field of a web broswer running on the PC opened the login page of the switch. Using the default
password password enabled logging into the switch and enabling the PC’s web browser to be used to
set up the switch.
The address of the switch is required to configure the switch. It is a good idea to have the switch address
laying on one of the LANs the switch is handling. To change the switch address, log into the switch, and
then use the switch command sequence
System >Management >IP Configuration
to bring up the page containing the current network settings of the switch. It is a good idea to have the
switch of a fixed address. So set the Current Network Configuration Protocol radio button
Static IP Address to on. Then assigned an address to the switch by changing the IP Address
field on the page to contain that selection. Then press the Apply button in the bottom right of the
command screen.
The switch address should not be on a VLAN to be handled by the switch. This is particularly true if
VLANs are to be routed. The address 192.168.10.60 and default gateway 192.168.10.244 were
assigned to the switch for this work.
1.7 Gateway from a simple network on the switch
A LAN was created by plugging network components into the switch. This LAN is shown in Figure 1.2
as containing a PC and a wireless extenter which were physically plugged into the switch. The switch
thus became an active part of the LAN. The LAN required a gateway to access the Internet and this
was to be provided by the wireless extender which had been configured to route any data sent to it out
onto the wireless network. Without changing the addresses of the LAN devices, the gateway was to be
produced.
6

1.8. Warnings
wireless extender
switch
PC
192.168.8.240192.168.8.7
Figure 1.2: Switch forming a LAN with an internet gateway
1.7.1 Implementation
Only a standard network is required with the switch only performing the function of a plug-board into
which the network components are physically connected.
The simple rule (which cna be broken as shown in Section!2.1.2) is on a LAN, the network address of
all connected devices should be the same. The wireless extender was configured to act as a repeater;
the hardwired and wireless LANs had the same network address. It provided connection between the
hardwired LAN contained by the switch to the wireless network which contained the Internet connec-
tion. The Internet connection had the address 192.168.8.244. In the /etc/network/interfaces
file on the PC, the gateway address was set as 192.168.8.244 and then the PC restarted. From the
PC, Internet connection could be demonstrated.
An alternate to the above procedure might be to change the gateway address of the switch and leave the
gateway address of the PC pointing somewhere else. The switch gateway was set to 192.168.8.244
using the System >Management >IP Configuration command menu sequence on the switch.
When this gateway address was filled in, and pressing the Apply button on the switch command page,
the PC could not access the Internet.
1.8 Warnings
•Don’t remove the control port from VLAN 1. If you do, then use the Reset button on the switch
to restore the switch. So never use the Remove All option in the Group Operation of the VLAN
Configuration for VLAN 1.
•Dynamic address assignment using DHCP (Dynamic Host Configuration Protocol) is not used.
Only static/direct address assignment is used in all the work here.
•The address of the switch must not be on a VLAN which is to be routed.
7

Chapter 2
Layer 2
Layer 2 configuration of the switch uses MAC addresses of the attached network devices. This layer
enables the 24 ports on the switch to be grouped into virtual logical area networks (VLANs). Such
VLANs can a connected together using functions of the switch enabling data to move between these
VLANs.
In using VLANs it is important to remember what they are. A VLAN is a Virtual LAN. A LAN is at
OSI Layer 2, meaning it is a physical link. The broadcast and multicast network packets generated by
devices contained on the LAN when trying to establish a communication path between devices remain
on the LAN. This means a device and only communicate with another device on the LAN on which it is
located. The Virtual LAN (VLAN) also has those properties. For a device to communicate across a LAN
or VLAN, a network link, or OSI Layer 3 connection is required.
In the following, two networks are used. The behaviour of two networks was taken as being able to be
generalized to many networks implemeneted on a switch.
2.1 All devices on the default VLAN
The five device tabulated in Table 1.2 form a single physical LAN. Those devices have two network
addresses 192.168.14.0 and 192.168.8.0. A LAN as shown in Figure 2.1 was formed by using the
ports on the switch. The two networks formed by the two network addresses co-existed on the switch.
192.168.8.240
switch
192.168.8.7192.168.14.9
printer
192.168.14.31
NAS
192.168.14.107
wireless extender
g2g1g7 g19 g23
PC 1PC 2
Figure 2.1: A single VLAN containing all devices
8

2.2. A new VLAN holding all devices
2.1.1 Implementation
In the default switch configuration, all ports on the switch are linked to the VLAN with VLAN ID 1.
This association on the switch is viewed using the switch menu sequence:
Switching →VLAN →VLAN Membership
in which the box under each port label contains a U.
2.1.2 Results from testing
Testing was done by issuing ping commands from the two PCs. Table 2.1 shows the results. In this
table, the ⇐⇒ symbol indicates a successful ping while the symbol indicates an unsuccessful ping. It
is taken as given that each PC could ping itself with the corresponding entry in Table 2.1 shown as a ‘x’.
Table 2.1: Ping exchange betwenn devices on one VLAN
g7 g19
192.168.14.9 192.168.8.7
255.255.255.0 255.255.0.0 255.255.255.0 255.255.0.0
g1 255.255.255.0 ⇐⇒ ⇐⇒  ⇐⇒
g2 255.255.255.0 ⇐⇒ ⇐⇒  
g7 255.255.255.0 x x  
g1 255.255.0.0 ⇐⇒ ⇐⇒  ⇐⇒
g2 255.255.0.0 ⇐⇒ ⇐⇒  ⇐⇒
g7 255.255.0.0 x x  ⇐⇒
g23 255.255.255.0   ⇐⇒ ⇐⇒
g19 255.255.255.0   x x
g23 255.255.0.0  ⇐⇒ ⇐⇒ ⇐⇒
g19 255.255.0.0  ⇐⇒ x x
Each device was set to have a network mask of 255.255.255.0 then 255.255.0.0. With each net-
work mask setting pings between the PCs and devices were exchanged.
In this switch network configuration, an unsecure isolation of the two networks was obtained. By chang-
ing it’s network mask, a PC on one network could access devices not only on it’s onw network, but also
on another. Only partial isolation of network devices is shown in Table 2.1 as being achieved by setting
the network masks on the devices.
2.2 A new VLAN holding all devices
For this configuration the five devices of Figure 2.1 occupy a VLAN on their own, separate from VLAN
1.
VLANs are assiged identification when they are set up. This new VLAN is to be given the VLAN ID of
12 and named VLAN-A-12.
9

2.3. Two isolated LANs
2.2.1 Implementation
A new VLAN was created on the switch by the switch menu sequence:
Switching →VLAN →VLAN Configuration
In the screen resulting, 12 was typed into the VLAN ID box, and VLAN-A-12 into the VLAN Name box.
The VLAN Type was set to Static. Then the ADD button at the bottom right-hand of the screen was
clicked to create the new VLAN. Once created, the new VLAN with the ID, name, and type appeared in
the VLAN Configuration table.
The ports with devices connected were then assigned to this new VLAN. The initial switch menu se-
quence
Switching →VLAN →Advnaced →VLAN Membership
brought up the screen showing the ports associated with VLAN 1, the default VLAN. All port boxes
contained a U, indicating all ports of the switch were connected to this VLAN, no matter if a device is
plugged into the corresponding switch port or not. For ports 1, 2, 7, 19, and 24 the contents of their
corresponding port box containing a Uwas replaced with a blank by repeatedly clicking the port box
until the blank appeared. After all ports were reset, the APPLY button in the bottom right-hand side of
the screen was clicked.
Note: The PC connected to port 19 was also used to control the switch, i.e. to configure the switch.
This necessary control connection must be on VLAN 1. Any port showing a Uin the display of VLAN
Membership for VLAN 1 could be selected. Socket 13 was selected. The netword address of the switch
was 192.168.8.155. So the PC having address 192.168.8.7 which lies on the network of the switch
could be unplugged from port 19 and plugged into port 13 to control the switch.
From the VLAN Membership screen, the ID (12) of the new VLAN was selected from the selection
available on the VLAN ID window. The screen for VLAN ID 12 which resulted had blank in all the port
boxes. For each of the port boxes, 1, 2, 7, 19, and 24 a Uwas set into the box by repeated clicking the box
until the Uappeared. Then the APPLY button in the bottom right-hand side of the screen was clicked.
This new VLAN was then assigned a PVID (Port Vlan ID). The menu sequence
Switching →VLAN →Advnaced →Port PVID Configuration
provided the needed screen. The small box on the left of ports labelled g1, g2, g7, g19, and g24 were
clicked resulting in a ticket appearing in the small box and the line being highlighted in orange. In
the widow labelled Configured PVID the value 12 was entered and the APPLY button on the botton
right-hand side of the screen clicked. Highlighting of the lines disappeared, and the value 12 assigned
was shown on those previsously highlighted lines under the Configured PVID, Current PVID,
and VLAN Member columns.
2.2.2 Results from testing
Aping command issued from each of the two PCs to test connectivity between the two networks. Net-
work masks 255.255.255.0 and then 255.255.0.0 were applied to each PC and device. Table 2.1
shows the results. Since all devices were on the same VLAN, the results are identical to those obtained
in Section 2.1. The difference here is the single VLAN was manually defined while that in Section 2.1
was the default VLAN.
2.3 Two isolated LANs
Two LANs were to co-exist on a single switch. Although the two LANs were on the same media (the
switch), they were to be isolated, i.e. not allowing data to be transferred between each. One LAN
10

2.3. Two isolated LANs
contained only one network address while the other contained two.
This is the ideal situation for using two VLANs. Multiple VLANs can be setup on the switch.
2.3.1 Implementation
Figure 2.2 shows the implementation of the required two LANs. Each LAN is implemented as a separate
VLAN. Collected on each VLAN are devices having a common network address. The ports used to
house each device are the same as in Section 2.1 and in Table 1.2.
switch
192.168.8.7
wireless extender
192.168.8.240
PC 1PC 2NAS
192.168.14.107
VLAN−B−22
g7 g23 g19g2 g1
printer
VLAN−A−12
192.168.14.31
192.168.14.9
Figure 2.2: Switch forming two LANs
Initially all five network devices connected to the switch were connected to the default VLAN, having
the default name VLAN 1.
Two VLANs having names VLAN-A-12 and VLAN-B-22 with identifications 12 and 22, respectively,
were used to form the LANs. The switch menu sequence:
Switching →VLAN →VLAN Configuration
gave the VLAN creation screen. For VLAN-A-12, the value 12 was typed into the window labelled
VLAN ID and VLAN-A-12 into the window labelled VLAN Name. Then the ADD button at the bottom of
the right-hand side of the screen was clicked to create the new VLAN. By typing 22 into the VLAN ID
window, and VLAN-B-22 into the VLAN Name window, followed by clicking the ADD button, the other
VLAN was created. The two new VLANs appear in the VLAN Configuration tabulation.
Next, the devices connected through the ports of the switch were assigned to each VLAN. The PC on
port 19 was moved to port 13 of the switch to act as the control. The menu sequence:
Switching →VLAN →Advnaced →VLAN Membership
gave the screen which enabled such assignments. First VLAN 1 was called up on screen using the pull-
down list of the VLAN ID window. The Uwhich appears under each port label indicated that port was
attached to this VLAN. The Uof ports 1, 2, 7, 19, and 23 were set to blank, then the APPLY button
clicked to disconnect those ports from VLAN 1.
Having freed the ports to be used, those freed ports were then connected to the two newly created
VLANs. VLAN 12 was then called up using the VLAN ID pull-down list. A Uwas set under port labels
2, and 7, before clicking the APPLY button. VLAN 22 was then called using the VLAN ID window and a
Uset under port labels 1, 19, and 23 before clicking the APPLY button.
To activate the two VLANs, the menu sequence:
Switching →VLAN →Advnaced →Port PVID Configuration
was used to enable setting a PVID for each VLAN. In the Configured PVID the value 12 was entered
for VLAN 12. The box at the left of the g2, and g7 port labelled lines were clicked resulting in a tick
appearing in that box and each line being displayed in orange. Then the APPLY button was clicked.
This sequence was repeated for VLAN 22 using the value 22, then ports 1, 19 and 23 were ticked to link
them into VLAN 22.
11

2.4. Dividing a LAN
Note: If a port is moved from one VLAN to another, the port PVID Configuration procedure needs to be
applied to both VLANs. The rule is: If the ports on a VLAN are changed, update the PVID configuration.
2.3.2 Results from testing
For testing, the control PC was removed from port 13 of the switch and installed in port 19, becoming
g19.
A ping was used to indicate two isolated LANs had been produced on the two VLANs. PC 2 (g7) could
only ping the devices of ports 1 and 2. PC 1 (g19) could ping port 23, and via port 23 the Internet.
Table 2.2: Ping exchange between devices on isolated VLANs, one VLAN with two networks
g7 g19
192.168.14.9 192.168.8.7
255.255.255.0 255.255.0.0 255.255.255.0 255.255.0.0
g2 255.255.255.0 ⇐⇒ ⇐⇒  
g7 255.255.255.0 x x  
g2 255.255.0.0 ⇐⇒ ⇐⇒  
g7 255.255.0.0 x x  
g1 255.255.255.0    
g23 255.255.255.0   ⇐⇒ ⇐⇒
g19 255.255.255.0   x x
g1 255.255.0.0    ⇐⇒
g23 255.255.0.0   ⇐⇒ ⇐⇒
g19 255.255.0.0   x x
The rows in Table 2.2 collect together the ports/devices which were configured on the switch into the
two VLANs. A indicates the ping was blocked, a ⇐⇒ indicates a successful ping, and a xindicates a
successful ping of the test PC itself.
Symmetry can be seen in the behaviours of the pings. The top two left-hand groupings in Table 2.2 show
similar behaviour to the botton two right-hand groupings. In those two groupings, the PC sending the
ping, g7 and g19 respectively, were in the VLAN represented by the group. In particular the behaviour
of the g19 and g1 is noted. In this case, g19 and g1 had different network addresses although contained
on the same VLAN.
The other symmetry is between the bottom two left-hand groupings and the top right-hand groupings.
These indicate VLAN containing ports/devices g2 and g7, and that containing g1,g23, and g19 were
isolated from one another.
2.4 Dividing a LAN
A LAN is a network with a single network address. For the network of Figure 2.3 this network address
is 192.168.8.0. Al devices on a LAN have access to all other devices on that LAN for they are in the
same address space, meaning they have the same network address. Note: same network address not the
same IP address.
In its default, or initial configuration a GS724Tv4 switch implements a single LAN in the default VLAN,
ID 1. All ports of the switch are initially members of VLAN 1. It is good practise not to use VLAN 1 as
12

2.4. Dividing a LAN
an operational VLAN.
wireless network
NAS
VLAN−B−22
g7g2
VLAN−A−12
printer
g1 g19
PC 2 PC 1
192.168.8.7
Internet
gateway
switch
wireless extender
g23
192.168.8.240192.168.8.9192.168.8.107192.168.8.31
Figure 2.3: Two VLANs dividing a single LAN into two unconnected parts
The LAN devices were plugged into ports 1, 2, 7, 19, and 23 of the switch. This forms a LAN using
VLAN 1 as its container. To create a new VLAN to contain each of these devices, a new VLAN was
created. The sequence of events to create a VLAN is:
•create a VLAN giving it a ID number and a name;
•assign ports to the created VLAN;
•remove those ports from their previous position (maybe from VLAN 1); and
•set the PVID of all ports assigned to the VLAN the value of the VLAN’s ID
2.4.1 A single network
Starting with one VLAN containing all the devices which were plugged into the switch. This is to be a
new VLAN having an ID of 12 and a name of VLAN-A-12. The switch menu sequence: Switching →
VLAN →Basic →VLAN Configuration
resulted in the VLAN Configuration screen. Into the VLAN ID field the value 12 was typed and then
VLAN-A-12 into the VLAN Name field. The ADD button at the bottom of the screen was then clicked to
create the VLAN.
The switch menu sequence: Switching →VLAN →Advnaced →VLAN Membership
was used to bring up the VLAN Membership screen. The value 12 was typed into the VLAN ID field
to bring up the display of the ports assigned to VLAN 12. This was blank. Under ports 1, 2, 7, 23, and
23 their input pad was clicked until a U was produced. This indicated the port was to be connected to
the VLAN as an untagged member. When all ports had been assigned, the APPLY button at the bottom
of the screen was clicked. Then VLAN 1 was selected. This showed all 24 ports of the switch as being
untagged members of it. The input pad under each port 1, 2, 7, 19, and 23 were clicked until the pad was
cleared. The APPLY button was clicked to tell the switch those ports were no longer assigned to VLAN
1.
The switch menu sequence: Switching →VLAN →Advnaced →Port PVID Configuration
was used to bring up the Port PVID Configuration screen. The little square adjacent to Interfaces
13

2.5. Divided LAN sharing one Internet connection
g1, g2, g7, g19, and g23 were clicked and then 12 entered in the Configured PVID field. The APPLY
button at the bottom of the screen was cliked to finish the configuration.
At this point the switch supported a single LAN in a signe VLAN. All devices could be pinged. If 192.
168.8.244 which was the modem on the wireless past of the network produced by 192.168.8.240
(port 23), and the url 192.168.8.244 was specified in the configuration of a device, then that device
could access the Internet.
Note:
•If the PVID part of the configuration is not down, then the apparently connected devices do not
ping;
•Gateway configuration is not part of the switch configuration.
2.4.2 Dividing the network into two parts
It may be desired for all devices be on the same network but to have some network devices isolated from
others. Figure ?? shows such a situation where all devices belong to the same 192.168.14.0 network.
The starting point was the single VLAN network configured above. The single VLAN is to be split into
two VLAN, the additional VLAN was to have ID 22 and name VLAN-B-22.
A new VLAN is created using the switch menu sequence:
Switching →VLAN →Basic →VLAN Configuration
resulted in the VLAN Configuration screen. Into the VLAN ID the value 22 was typed, then the value
VLAN-B-22 in the VLAN Name field before clicking the add button.
The switch menu sequence:
Switching →VLAN →Advnaced →VLAN Membership
was used to bring up the VLAN Membership screen. The value 12 was typed into the VLAN ID field.
The ports 19 and 23 were removed from this list and the APPLY button clicked. The value 22 was typed
into the VLAN ID field and ports 19 and 23 were added as untagged members before clicking the APPLY
field.
The switch menu sequence: Switching →VLAN →Advnaced →Port PVID Configuration
was used to bring up the Port PVID Configuration screen. The little square opposite the g19 and
g23 entries were clicked, the value 22 typed into the Configured PVID field, then the APPLY button
clicked.
With the two VLAN configuration completed, the two VLANs were tested. The devices on both VLANs
could be picged from devices in the VLAN, but not from the other VLAN. Now, only VLAN 22, which
contained the wireless network with it’s router could access the Internet.
2.5 Divided LAN sharing one Internet connection
The two VLAN network of Figure 2.3 was modified to that shown in Figure 2.4. In this configuration,
the two VLANs share the wireless network with its router allowing all members of each VLAN access
to the Internet.
The wireless extender connected to the switch at port was the be shared by VLANs 12 and 22. It was
already a member of VLAN 12. To added it to VLAN 12 the switch meenu sequence:
14

2.6. Ensuring only known devices can use a network
Switching →VLAN →Advnaced →VLAN Membership
was used to show the VLAN Membership screen. The value 12 was typed into the VLAN ID field and
port 23 was added as an untagged member before the APPLY button was clicked.
wireless network
NAS
VLAN−B−22
g7g2
VLAN−A−12
printer
g1 g19
PC 2 PC 1
192.168.8.7
Internet
gateway
switch
wireless extender
g23
192.168.8.240192.168.8.9192.168.8.107192.168.8.31
Figure 2.4: Two VLANs dividing a LAN but sharing an Internet access
Because a new distribution of ports to VLANs had been introduced, the PVID of both VLANs needed
revision. The switch menu sequence:
Switching →VLAN →Advnaced →Port PVID Configuration
was used to bring up the Port PVID Configuration screen. First PVID 12 was applied to ports 1, 2,
7, and 23 before clicking the APPLY button. Then PVID 22 was applied to ports 19 and 23 (despite these
ports not having been changed on VLAN 22).
With URL 192.168.8.244 set in the configuration of the devices on both VLANs 12 and 22, all mem-
bers of each VLAN could access the Internet. However, members of one VLAN could not access the
other.
Any device connected to the switch could be shared by one or more VLANs on a switch by following
the above configuration appoach.
The problem with this technique of sharing is there is no control over access: any device on either
VLAN can access the shared device or devices. This contrasts to using ACL which can be applied to
routing VLANs as described in Section ??. This is an advantage provided by the Layer 3 attributes of
the GS724Tv4 switch.
2.6 Ensuring only known devices can use a network
There is an opinion that only complex, or important, networks warrant the expense of network security
or network protection. But network security is available on a GS724Tv4 switch. This availability makes
assessment of what warrants securing an easier matter to decide. Small networks become candidates
for using network security.
Consider the network of Figure 2.5. It is a small network similar to that of Figure 2.1 but here all devices
having the same network address 192.169.14.0 on a single VLAN named VLAN-FRED. There is no
Internet connection. However, the existence of the wireless extender means the network is composed of
hardwired and wireless parts, i.e. wireless devices can connect onto the network as can devices which
plug into ports on the switch.
15

2.6. Ensuring only known devices can use a network
switch
192.168.14.9
printer
192.168.14.31
NAS
192.168.14.107
wireless extender
g2g1g7 g19 g23
PC 1PC 2
192.168.14.7 192.168.14.240
Figure 2.5: Two VLANs dividing a private LAN
Are parts of the network of Figure 2.5 worth protecting so as not to allow access by everybody? Every-
body on the network should be able to print using the printer. But should everybody be able to access
the printer itself. Such access allows hanging of the printers address. Change that and the printer is no
longer a resource available to everybody. The netwok interface of the printer is not even password pro-
tected. The NAS is the storage on the network. In contrast to the printer, it’s web interface is password
protected. However, if an unwarranted person was to access this device they might delete, overwrite,
or take a copy files which are important, personal, or secret. There is a case for protecting such devices
on this network.
The switch can provide protection to devices network connected to it.
2.6.1 Security designed to give specific devices access to given devices
The secturity/protection design aim for the network of Figure 2.5 was:
•PC 1 only was allowed access to the NAS, and
•PC 2 only was allowed access to the printer.
The specific hardware devices PC 1, PC 2, the NAS, and the printer. Although each device has a given
IP address, each such address could be changed resulting in the corresponding rule would no longer
operating. A more secure approach was to use the hardware address (MAC address) of each device.
The MAC addresses of the devices and port on the switch are given in Table 2.3, having been taken from
Table 1.2.
Table 2.3: Addresses needed to implement the required MAC address security
Port Device MAC address
g1 printer d0:bf:9c:bd:4b:4d
g2 NAS 28:c6:8e:d5:ed:08
g7 PC 2 00:3e:e1:c1:74:b3
g19 PC 1 c8:2a:14:56:3c:a2
2.6.2 Aspects common to each implementation alternative
Two alternate routes to implementing the security design were followed. There are, however, common
threads.
16

2.6. Ensuring only known devices can use a network
Configuration of protection by the switch is via it’s Security tab.
With respect to the GS724Tv4 switch:
•Actions are implemented by rules
•A rule can either allow an incoming network packet access or deny access to a device
•Rules are executed in the numerical order of the order number assigned when the rule was created
until one is satisfied
•Rules can be based either on IP address or device MAC address
•Every rule can only perform one action
•A rule can either IP address or MAC address directed
When security is configured on the switch, each network packet arriving at the switch is checked against
the rules. If the packet matches a rule, the action assicated with the rule is performed. If not, then the
next rule is checked. If no match is obtained, the packet is discarded by the switch.
Important to remember: Switch based network security is device centred. A device has a MAC address
and a IP address, and it is those addresses which the switch uses to implement security. If a user can
access the device, then that user can use the security assigned to the device.
Each security rule is implemented through through an ACL (Access Control List). Each ACL is given
an action, and a name, ID, match criteria, destination and mask address when it is created. This ACL is
linked to one or more ports on the switch and the VLANs on which the port or ports reside, i.e. each
ACL is bound to one or ports. This binding is done after creation of the ACL.
When a ACL is applied to a port on a VLAN, that port is automaticly denied access to all other devices
connected to that VLAN. So if a port is to only access one device, the ACL should indicated the address
of that device with the action of permit.
The starting point with each alternative was the switch configured to provide the network shown in
Figure 2.5. The VLAN was named VLAN-FRED and it’s ID was set to 12. In that configuration PC1 and
PC 2 were verified to ping the NAS and printer using their IP addresses.
2.6.3 Implementation Alternative 1
The ACL Wizard alternative uses defaults supplied by the switch. It was invoked by using the switch
menu sequence:
Security →ACL
which resulted in the ACL Wizard screen. From the ACL Type pull down menu ACL Based on
Destination MAC was selected (this was the default on the menu). In the table titled ACL Based
on Destination MAC the value 2 was typed into the Rule ID window, from the Action pull down
menu Permit was selected, and False from the Every Match pull down menu. Then the address
d0:bf:9c:bd:4b:4d was typed into the Destination MAC window and 00:00:00:00:00:00
into the Destination MAC Mask window. Finally the value 12 was entered into the VLAN window.
This had set up the ACL for accessing the printer.
Under the Binding Configuration part of the ACL Wizard screen, the Unit 1 label was clicked.
Since the device at port 7 (PC 2) was the access the printer, the small box under port 7 was clicked,
which produced a tick mark in that box. The configuration of this ACL and assigning it to a port was
then complete, so the ADD button at the bottom of the screen was clicked to activate that ACL.
17