I'm confused about the best way to handle this setup and the use of the two QCA 8337 switch chips.
I want to route 4 VLANS with internet access and some firewall rules, VPN... uplinked to a managed switch.
First thing that I don't know exactly how to handle with switch chip.
Internet Access: VLAN 832 and dhcp client to get public IP
Just use ETH1 as WAN:
Then to use the ISP Router as ATA for VOIP, just set a DHCP server on VLAN 832 to the router to get access.
add comment="WAN ORANGE FTTH - VLAN 832" interface=ether1 name=WAN-ORANGE-832 vlan-id=832
I'm getting my Public IP address of ETH1.832 and sending a dhcp 192.168.99.1/31 to ETH10.832
add comment="Set DHCP server to give the router an IP address " interface=ether10 name=VLAN-VOIP-LIVEBOX vlan-id=832
This are the same VLAN (but isolated) and different switch chip.
Now comes the guidance part that would be much apriecated.
The RB3011 enough ports...
I set up 4 bridges for each VLAN this way I can tag a trunk or interface to that bridge.
Let`s name them: OFFICE, SECURITY, GUEST, PUBLIC 100,200,300,400
I don't know if this is the best way but..
NOTE: About the vlan-filtering on bridges (without switch chip), with it enabled got like 400-500 mbps vlan routing, with it disabled wirespeed.
/interface bridge add frame-types=admit-only-vlan-tagged igmp-snooping=yes name=OFFICE pvid=100 vlan-filtering=yes
For testing I'll use just two Bridges: SECURITY and OFFICE and for mixing things. ETH3 with untagged "OFFICE" and "SECURITY" tagged.
I add the VLAN 200 to the ETH3.
Later add it to the SECURITY bridge.
/interface vlan add interface=ether3 name=VLAN_SECURITY_ETH3 vlan-id=200
I add ether6 untagged to the mix.
Then I just have DHCP server and Firewall rules to the Bridges to manage more easily what could be.
/interface bridge port add bridge=OFFICE frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=100 add bridge=SECURITY frame-types=admit-only-vlan-tagged interface=VLAN_SECURITY_ETH3 pvid=200 add bridge=OFICINA interface=ether6 pvid=100 /interface bridge vlan add bridge=SECURITY comment="VLAN FOR SURVEILLANCE" tagged=SECURITY,VLAN_SECURITY_ETH3 vlan-ids=200 add bridge=OFFICE comment="VLAN OFFICE" tagged=OFFICE untagged=ether3,ether6 vlan-ids=100
I upgraded to RC, to test LACP and add two nics and trunk the VLANS to the Switch. I want to have wirespeed to Surveillance VLAN so the two have good bandwidth, the rest would be tagged and shared. I can set this up different ways from trunks or untagged.
Then comes the use of the Switch CHIP, you can configure VLANS on different places , tagging bridges, vlan on bridges.. so I'm a little confused. And having the switch chip in conjunction with the same vlan-id for wan and a dhcp server but want both isolated.
Would be much appreciated some guidance for the best way to do things.