Thread: router with at least 2 @ vlan on the local lan

anyone have practical experience with a decent router that routes 2 VLANs on the local gigabit LAN NOT on the WAN side.

I want to be able to route two separate subnets of a c class on a local lan by eth port hopefully so I can give one internet access as well as printer and file access whilst restricting the other subnet to just the file and print services.

not many under $1500 that will do it from what I am seeing except for a couple of draytec units.

anyone know of any others that are capable?

TIA

Originally Posted by incisor

anyone have practical experience with a decent router that routes 2 VLANs on the local gigabit LAN NOT on the WAN side.

I want to be able to route two separate subnets of a c class on a local lan by eth port hopefully so I can give one internet access as well as printer and file access whilst restricting the other subnet to just the file and print services.

not many under $1500 that will do it from what I am seeing except for a couple of draytec units.

anyone know of any others that are capable?

TIA

Just had another read of your post, and a poke around on the router to confirm it can definitely do it (answer is yes). Comments below apply to the Mikrotik but I can't comment on the Draytek as I've never used them, and only have sketchy Cisco vlan and ACL experience.

When you say you're wanting to route "by eth port" it almost sounds like you can physically split the subnets and plug one into eg eth0 and the other into eth1. If that's the case you don't need to mess around with vlan's - just configure the subnets on different ports - it will automatically route between interfaces as it sees both active. If I've misinterpreted and you're talking proper 802.1Q tagging the Mikrotik will still handle it happily.
A few firewall rules would sort out the access control you want to put in place. Default block rule for all traffic from LAN outbound on the internet port/interface, then allow what you DO want to go out. You've got the complete range of network/device attributes to base your rules on but simple ones based on source interface/port, subnet or vlan would likely sort you out.

Very easy bandwidth throttling/reservation too if you need to keep little Johnny developer's software download from impacting the owner streaming his favorite sport.

I expect that you could get away with a much lower spec Mikrotik device than the CCR1016, but I don't have personal experience with any.

To give you and idea of the CCR1016 capability - in our case it handles multiple lans/vlans with upwards of 1000 devices total (data and voice), a bunch of on-premises servers, and multiple internet WAN interfaces.
We have all but one of the 12 ports used, either bridged and connected to one of the lan, or as various seperate interfaces (LAN/WAN/DMZ etc).

It was originally bought it as we needed something at a reasonable price that had better than Gigabit routing throughput for a high speed connection between sites and the $3K HP layer3 switches we had bought were ghastly to work with (and not really appropriate in hindsight).
Its ended up being a case of "damn - these are seriously awesome, does everything we throw at it and I don't need a PhD in astroCiscoPIX to drive it!!!"

Only downside from our perspective is they aren't really mainstream so don't have Cisco Smartnet style extended support and availability is limited. Definitely not a suitable fit for some organisations.

Steve